--- doc/example-config/conf.d/10-ssl.conf
+++ doc/example-config/conf.d/10-ssl.conf
@@ -11,8 +11,8 @@ ssl = required
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/ssl/certs/dovecot.pem
-ssl_key = </etc/ssl/private/dovecot.pem
+ssl_cert = <@SSLDIR@/certs/dovecot.pem
+ssl_key = <@SSLDIR@/private/dovecot.pem
 
 # If key file is password protected, give the password here. Alternatively
 # give it when starting dovecot with -p parameter. Since this file is often
@@ -22,7 +22,7 @@ ssl_key = </etc/ssl/private/dovecot.pem
 
 # PEM encoded trusted certificate authority. Set this only if you intend to use
 # ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
-# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
+# followed by the matching CRL(s). (e.g. ssl_ca = <@SSLDIR@/certs/ca.pem)
 #ssl_ca = 
 
 # Require that CRL check succeeds for client certificates.
--- doc/mkcert.sh
+++ doc/mkcert.sh
@@ -5,8 +5,8 @@
 
 umask 077
 OPENSSL=${OPENSSL-openssl}
-SSLDIR=${SSLDIR-/etc/ssl}
-OPENSSLCONFIG=${OPENSSLCONFIG-dovecot-openssl.cnf}
+SSLDIR=${SSLDIR-@SSLDIR@}
+OPENSSLCONFIG=${OPENSSLCONFIG-@SSLDIR@/dovecot-openssl.cnf}
 
 CERTDIR=$SSLDIR/certs
 KEYDIR=$SSLDIR/private
