diff --git a/src/test/modules/ssl_passphrase_callback/Makefile b/src/test/modules/ssl_passphrase_callback/Makefile
index a3b518b50d4..f81265c2963 100644
--- a/src/test/modules/ssl_passphrase_callback/Makefile
+++ b/src/test/modules/ssl_passphrase_callback/Makefile
@@ -20,3 +20,21 @@ include $(top_srcdir)/contrib/contrib-global.mk
 endif
 
 SHLIB_LINK += $(filter -lssl -lcrypto -lssleay32 -leay32, $(LIBS))
+
+# Targets to generate or remove the ssl certificate and key
+# Normally not needed. Don't run these targets in a vpath build, the results
+# won't be in the right place if you do.
+
+# needs to agree with what's in the test script
+PASS = FooBaR1
+
+.PHONY: ssl-files ssl-files-clean
+
+ssl-files:
+	openssl req -new -x509 -days 10000 -nodes -out server.crt \
+		-keyout server.ckey -subj "/CN=localhost"
+	openssl rsa -aes256 -in server.ckey -out server.key -passout pass:$(PASS)
+	rm server.ckey
+
+ssl-files-clean:
+	rm -f server.crt server.key
diff --git a/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl b/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl
index 8d135d2495f..dbc084f870e 100644
--- a/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl
+++ b/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl
@@ -15,12 +15,7 @@ unless (($ENV{with_openssl} || 'no') eq 'yes')
 my $clearpass = "FooBaR1";
 my $rot13pass = "SbbOnE1";
 
-# self-signed cert was generated like this:
-# system('openssl req -new -x509 -days 10000 -nodes -out server.crt -keyout server.ckey -subj "/CN=localhost"');
-# add the cleartext passphrase to the key, remove the unprotected key
-# system("openssl rsa -aes256 -in server.ckey -out server.key -passout pass:$clearpass");
-# unlink "server.ckey";
-
+# see the Makefile for how the certificate and key have been generated
 
 my $node = get_new_node('main');
 $node->init;