--- a/testing/web-platform/tests/tools/serve/serve.py
+++ b/testing/web-platform/tests/tools/serve/serve.py
@@ -12,17 +12,17 @@ import sys
 import threading
 import time
 import traceback
 import urllib2
 import uuid
 from collections import defaultdict, OrderedDict
 from multiprocessing import Process, Event
 
-from ..localpaths import repo_root
+from localpaths import repo_root
 
 import sslutils
 from manifest.sourcefile import read_script_metadata, js_meta_re
 from wptserve import server as wptserve, handlers
 from wptserve import stash
 from wptserve.logger import set_logger
 from wptserve.handlers import filesystem_path, wrap_pipeline
 from mod_pywebsocket import standalone as pywebsocket
@@ -617,18 +617,17 @@ def get_ports(config, ssl_environment):
             if port == "auto":
                 port = get_port()
             else:
                 port = port
             rv[scheme].append(port)
     return rv
 
 
-
-def normalise_config(config, ports):
+def normalise_config(config, ports, base_path=repo_root):
     host = config["external_host"] if config["external_host"] else config["host"]
     domains = get_subdomains(host)
     ports_ = {}
     for scheme, ports_used in ports.iteritems():
         ports_[scheme] = ports_used
 
     for key, value in domains.iteritems():
         domains[key] = ".".join(value)
@@ -640,31 +639,46 @@ def normalise_config(config, ports):
         ports_[scheme] = ports_used
 
     # make a (shallow) copy of the config and update that, so that the
     # normalized config can be used in place of the original one.
     config_ = config.copy()
     config_["host"] = host
     config_["domains"] = domains
     config_["ports"] = ports_
+
+    path_properties = ["doc_root",
+                       "ws_doc_root",
+                       ("ssl", "openssl", "base_path"),
+                       ("ssl", "pregenerated", "host_key_path"),
+                       ("ssl", "pregenerated", "host_cert_path")]
+    for key in path_properties:
+        target = config_
+        if not isinstance(key, (str, unicode)):
+            for key_part in key[:-1]:
+                target = target[key_part]
+            key = key[-1]
+        target[key] = os.path.join(base_path, target[key])
+
     return config_
 
 
 def get_paths(config):
     return {"doc_root": config["doc_root"],
             "ws_doc_root": config["ws_doc_root"]}
 
 
-def get_ssl_config(config, ssl_environment):
+def get_ssl_config(config, ssl_environment, base_path=repo_root):
     external_domains = config["domains"].values()
     key_path, cert_path = ssl_environment.host_cert_path(external_domains)
-    return {"key_path": key_path,
-            "cert_path": cert_path,
+    return {"key_path": os.path.join(base_path, key_path),
+            "cert_path": os.path.join(base_path, cert_path),
             "encrypt_after_connect": config["ssl"]["encrypt_after_connect"]}
 
+
 def start(config, ssl_environment, routes, **kwargs):
     host = config["host"]
     ports = get_ports(config, ssl_environment)
     paths = get_paths(config)
     bind_hostname = config["bind_hostname"]
     ssl_config = get_ssl_config(config, ssl_environment)
 
     servers = start_servers(host, ports, paths, routes, bind_hostname, config,
@@ -778,17 +792,17 @@ def run(**kwargs):
     config = load_config(os.path.join(repo_root, "config.default.json"),
                          os.path.join(repo_root, "config.json"),
                          **kwargs)
 
     setup_logger(config["log_level"])
 
     with get_ssl_environment(config) as ssl_env:
         ports = get_ports(config, ssl_env)
-        config = normalise_config(config, ports)
+        config = normalise_config(config, ports, repo_root)
         host = config["host"]
         bind_hostname = config["bind_hostname"]
 
         if config["check_subdomains"]:
             paths = get_paths(config)
             ssl_config = get_ssl_config(config, ssl_env)
             check_subdomains(host, paths, bind_hostname, ssl_config, config["aliases"])