docs(self-hosted): describe purpose and usage of privateKey opt… (#5897)

docs/usage/self-hosted-configuration.md

@@ -119,6 +119,15 @@ This option is useful for troubleshooting, particularly if using presets. e.g. r
 
 ## privateKey
 
+This private key is used to decrypt config files.
+
+The corresponding public key can be used to create encrypted values for config files. If you want a simple UI to encrypt values you can put the public key in a HTML page similar to <https://renovatebot.com/encrypt>.
+
+To create the key pair with openssl use the following commands:
+
+- `openssl genrsa -out rsa_priv.pem 4096` for generating the private key
+- `openssl rsa -pubout -in rsa_priv.pem -out rsa_pub.pem` for extracting the public key
+
 ## productLinks
 
 Override this object if you wish to change the URLs that Renovate links to, e.g. if you have an internal forum for asking for help.