We should make a note in the documentation that the file should _never_ contain a private key.
I've verified that tlwebaccess happily accepts certificate files that also holds the private key, and private key files that also holds the certificate. Documentation note added in r29287.
Doc is fine.