diff --git a/docs/rolereference.rst b/docs/rolereference.rst
index 98c4a5f4f205df9e8f9aea15f72db1247aa3019a..7dbaf3b928dba46fc3a05635fc5edb48b3aeb63f 100644
--- a/docs/rolereference.rst
+++ b/docs/rolereference.rst
@@ -150,7 +150,7 @@ defaults to be used for all servers, and then overrides it for one server:
 
   ---
 
-  ansible_key: /root/ansible/private.key
+  ansible_key: {{ lookup('file', '~/.ssh/id_rsa.pub') }}
   preseed_country: UK
   preseed_directory: /var/www/preseed
   preseed_keymap: UK
@@ -325,11 +325,10 @@ Parameters
   server. Each element of the list should be a simple string denoting the name
   of the package.
 
-**ca_certificates** (list, optional, ``[]``)
-  List of additional CA certificate files that should be deployed on the
-  server. Each element of the list should be a filepath to a CA certificate file
-  on originating (Ansible) host that should be copied to destination
-  server.
+**ca_certificates** (list, optional, ``{}``)
+  Dictionary containing the CA certificates to deploy. Keys are filenames to be
+  used when placing a certificate file in directory ``/etc/ssl/certs/``, while
+  values are corresponding content to be placed in the file.
 
 **incoming_connection_limit** (string, optional, ``3/second``)
   Rate at which the incoming ICMP echo-request packages and new TCP connections
@@ -375,7 +374,7 @@ packages on all servers:
     - debconf-utils
 
   ca_certificates:
-    - ../certs/truststore.pem
+    "truststore.pem": "{{ lookup('file', '../certs/truststore.pem') }}"
 
   incoming_connection_limit: 2/second