Fix TLS transport: remove ca_list_file that breaks transport on Docker

The ca_list_file option requires /etc/ssl/certs/ca-certificates.crt to
exist and be readable.  That file is created by the ca-certificates
package, which was only a Recommends dep (not installed via
--no-install-recommends), so the file was absent in the container image
and Asterisk rejected the entire transport-tls config with:

  ERROR: ca_list_file /etc/ssl/certs/ca-certificates.crt is either
         missing or not readable

ca_list_file is only consulted when verify_client=yes (mutual TLS /
client certificate auth).  Since we never set that option, the line
serves no purpose and is removed from both the fresh-config generator
and the upgrade-injection block.

Also add ca-certificates explicitly to the Dockerfile apt-get install
so the package is always present for any future use.

https://claude.ai/code/session_01PTzYWkePEG3tDCMSLfWrXE

Dockerfile

@@ -22,6 +22,7 @@ RUN echo "exit 101" > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d &&
         asterisk \
         asterisk-core-sounds-en-gsm \
         asterisk-modules \
+        ca-certificates \
         openssl \
         curl \
         wget \

docker/entrypoint.sh

@@ -207,7 +207,7 @@ bind=0.0.0.0:5061
 ; Server IP: ${local_ip} | Public IP: ${PUBLIC_IP:-unknown}
 cert_file=/etc/asterisk/certs/server.crt
 priv_key_file=/etc/asterisk/certs/server.key
-ca_list_file=/etc/ssl/certs/ca-certificates.crt
+; ca_list_file not set — only needed for verify_client=yes (client cert auth)
 method=tlsv1_2
 ${nat_settings}
 
@@ -273,7 +273,7 @@ protocol=tls
 bind=0.0.0.0:5061
 cert_file=/etc/asterisk/certs/server.crt
 priv_key_file=/etc/asterisk/certs/server.key
-ca_list_file=/etc/ssl/certs/ca-certificates.crt
+; ca_list_file not set — only needed for verify_client=yes (client cert auth)
 method=tlsv1_2
 ${nat_settings}