Agreed. Could you please take a look at what I did for the ldap + tls topic, in the part where the generated certificates are copied to their final places? See what you think?
We should probably correctly define this here instead of repeating it over and over for each service that supports TLS/SSL.