diff --git a/README.md b/README.md
index ef09d09..fefdaab 100644
--- a/README.md
+++ b/README.md
@@ -152,9 +152,17 @@ With a running Couchbase Server, you can pass the database details in:
 
     CB_HOST=10.144.211.101 CB_USER=Administrator CB_PSWD=password docker-compose -f mix-and-match.yml up backend frontend
 
+<!--
+If you are connecting to a cloud hosted database, such as Couchbase Capella, you may need to use DNS SRV connection, and provide a path to a TLS certificate.
+
+    CB_HOST=cb.abcdefghijklmnop.cloud.couchbase.com CB_USER=Administrator CB_PSWD=password CB_DNSSRV=true CB_CERT=./capella.cert docker-compose -f mix-and-match.yml up backend frontend
+-->
+
 The Docker image will run the same checks as usual, and also create the
 `hotels-index` if it does not already exist.
 
+NOTE: If you are connecting to a cloud hosted database, such as Couchbase Capella, then see below for now (this will be supported via Docker in due course.)
+
 ### Running the Java API application manually
 
 You may want to run the Java application yourself, to make rapid changes to it,
@@ -179,11 +187,15 @@ For example, using the Docker image provided:
     export CB_HOST=localhost CB_USER=Administrator CB_PSWD=password
     ./wait-for-couchbase.sh echo "Couchbase is ready!"
     
-    mvn spring-boot:run -Dspring-boot.run.arguments="--storage.host=$CB_HOST storage.username=$CB_USER storage.password=$CB_PSWD"
+    mvn spring-boot:run -Dspring-boot.run.arguments="--storage.host=$CB_HOST --storage.username=$CB_USER --storage.password=$CB_PSWD"
 
 If you already have an existing Couchbase server running and correctly configured, you might run:
 
-    mvn spring-boot:run -Dspring-boot.run.arguments="--storage.host=localhost storage.username=Administrator storage.password=password"
+    mvn spring-boot:run -Dspring-boot.run.arguments="--storage.host=localhost --storage.username=Administrator --storage.password=password"
+
+If you are connecting to a cloud hosted database, such as Couchbase Capella, you may need to use DNS SRV connection, and provide a path to a TLS certificate.
+
+    mvn spring-boot:run -Dspring-boot.run.arguments="--storage.host=cb.abcdefghijklmnop.cloud.couchbase.com --storage.username=Administrator --storage.password=password --storage.dnssrv=true --storage.cert=./capella.cert"
 
 Finally, if you want to see how the sample frontend Vue application works with your changes,
 run it with:
diff --git a/src/main/java/trycb/config/Database.java b/src/main/java/trycb/config/Database.java
index 0bfdde1..afa448b 100644
--- a/src/main/java/trycb/config/Database.java
+++ b/src/main/java/trycb/config/Database.java
@@ -21,8 +21,14 @@
  */
 package trycb.config;
 
+import java.nio.file.Paths;
+
 import com.couchbase.client.java.Bucket;
 import com.couchbase.client.java.Cluster;
+import com.couchbase.client.java.env.ClusterEnvironment;
+import com.couchbase.client.core.env.SecurityConfig;
+import com.couchbase.client.core.env.IoConfig;
+import com.couchbase.client.java.ClusterOptions;
 
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
@@ -42,9 +48,36 @@ public class Database {
 
     @Value("${storage.password}")
     private String password;
+    
+    @Value("${storage.dnssrv}")
+    private Boolean dnssrv;
+    
+    @Value("${storage.cert}")
+    private String cert; // blank means no cert
 
     public @Bean Cluster loginCluster() {
-        return Cluster.connect(host, username, password);
+        
+        ClusterEnvironment.Builder envBuilder
+            = ClusterEnvironment.builder();
+            
+        if (dnssrv) {
+            envBuilder.ioConfig(IoConfig.enableDnsSrv(true));
+        }
+        
+        if (cert != "") {
+            envBuilder.securityConfig(SecurityConfig
+                .enableTls(true)
+                .trustCertificate(Paths.get(cert)));
+            }
+        }
+            
+        ClusterEnvironment env = envBuilder.build();
+
+        return Cluster.connect(
+            host,
+            ClusterOptions
+                .clusterOptions(username, password)
+                .environment(env));
     }
 
     public @Bean Bucket loginBucket() {
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 41f5548..59dea9d 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -4,6 +4,11 @@ storage.host=db
 storage.bucket=travel-sample
 storage.username=Administrator
 storage.password=password
+storage.dnssrv=false
+
+# blank for no cert, fill in to enable TLS
+storage.cert=
+
 #in seconds, set to 0 to disable
 storage.expiry=0
 logging.level.org.springframework.web.filter.CommonsRequestLoggingFilter=DEBUG