diff --git a/basis/io/sockets/secure/debug/debug-docs.factor b/basis/io/sockets/secure/debug/debug-docs.factor
new file mode 100644
index 0000000000..1fd710eef0
--- /dev/null
+++ b/basis/io/sockets/secure/debug/debug-docs.factor
@@ -0,0 +1,6 @@
+USING: help.markup help.syntax io.sockets.secure ;
+IN: io.sockets.secure.debug
+
+HELP: <test-secure-config>
+{ $values { "config" secure-config } }
+{ $description "A secure config only suitable for testing!" } ;
diff --git a/basis/io/sockets/secure/secure-tests.factor b/basis/io/sockets/secure/secure-tests.factor
index 64ddab0ab9..d591ac15e7 100644
--- a/basis/io/sockets/secure/secure-tests.factor
+++ b/basis/io/sockets/secure/secure-tests.factor
@@ -1,14 +1,11 @@
 IN: io.sockets.secure.tests
-USING: accessors kernel io.sockets io.sockets.secure system tools.test ;
+USING: accessors io.sockets io.sockets.secure io.sockets.secure.debug
+kernel system tools.test ;
 
 { "hello" 24 } [ "hello" 24 <inet> <secure> [ host>> ] [ port>> ] bi ] unit-test
 
 { } [
-    <secure-config>
-        "vocab:openssl/test/server.pem" >>key-file
-        "vocab:openssl/test/dh1024.pem" >>dh-file
-        "password" >>password
-    [ ] with-secure-context
+    <test-secure-config> [ ] with-secure-context
 ] unit-test
 
 { t } [ os windows? ssl-certificate-verification-supported? or ] unit-test
diff --git a/basis/openssl/openssl-tests.factor b/basis/openssl/openssl-tests.factor
index aaae521a62..5a6dbb2dd4 100644
--- a/basis/openssl/openssl-tests.factor
+++ b/basis/openssl/openssl-tests.factor
@@ -1,21 +1,14 @@
-USING: io.sockets.secure io.encodings.ascii alien.strings
-openssl namespaces accessors tools.test continuations kernel ;
+USING: accessors io.sockets.secure io.sockets.secure.debug namespaces
+openssl tools.test ;
 
 openssl secure-socket-backend [
-    [ ] [
-        <secure-config>
-            "vocab:openssl/test/server.pem" >>key-file
-            "vocab:openssl/test/root.pem" >>ca-file
-            "vocab:openssl/test/dh1024.pem" >>dh-file
-            "password" >>password
+    { } [
+        <test-secure-config>
         [ ] with-secure-context
     ] unit-test
 
     [
-        <secure-config>
-            "vocab:openssl/test/server.pem" >>key-file
-            "vocab:openssl/test/root.pem" >>ca-file
-            "wrong password" >>password
+        <test-secure-config> "wrong password" >>password
         [ ] with-secure-context
     ] must-fail
 ] with-variable
diff --git a/extra/webapps/todo/todo.factor b/extra/webapps/todo/todo.factor
index eb81c2b78a..103bb1bdab 100644
--- a/extra/webapps/todo/todo.factor
+++ b/extra/webapps/todo/todo.factor
@@ -1,19 +1,10 @@
 ! Copyright (c) 2008 Slava Pestov
 ! See http://factorcode.org/license.txt for BSD license.
-USING: accessors kernel sequences namespaces
-db db.types db.tuples validators hashtables urls
-html.forms
-html.components
-html.templates.chloe
-http.server
-http.server.dispatchers
-furnace
-furnace.boilerplate
-furnace.auth
-furnace.actions
-furnace.redirection
-furnace.db
-furnace.auth.login ;
+USING: accessors kernel sequences namespaces db db.types db.tuples validators
+hashtables urls html.forms html.components html.templates.chloe http.server
+http.server.dispatchers furnace furnace.boilerplate furnace.auth
+furnace.actions furnace.redirection furnace.db furnace.auth.login
+io.sockets.secure.debug ;
 IN: webapps.todo
 
 TUPLE: todo-list < dispatcher ;
@@ -139,13 +130,6 @@ io.sockets.secure ;
         todo ensure-table
     ] with-db ;
 
-: <todo-secure-config> ( -- config )
-    ! This is only suitable for testing!
-    <secure-config>
-        "vocab:openssl/test/dh1024.pem" >>dh-file
-        "vocab:openssl/test/server.pem" >>key-file
-        "password" >>password ;
-
 : <todo-app> ( -- responder )
     init-todo-db
     <todo-list>
@@ -154,7 +138,7 @@ io.sockets.secure ;
 
 : <todo-website-server> ( -- threaded-server )
     <http-server>
-        <todo-secure-config> >>secure-config
+        <test-secure-config> >>secure-config
         8080 >>insecure
         8431 >>secure ;