From 376a99b7688a4bf7dfb3adde197648701fc47557 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 24 Feb 2026 21:25:44 +0000 Subject: [PATCH] Fix TLS transport: remove ca_list_file that breaks transport on Docker The ca_list_file option requires /etc/ssl/certs/ca-certificates.crt to exist and be readable. That file is created by the ca-certificates package, which was only a Recommends dep (not installed via --no-install-recommends), so the file was absent in the container image and Asterisk rejected the entire transport-tls config with: ERROR: ca_list_file /etc/ssl/certs/ca-certificates.crt is either missing or not readable ca_list_file is only consulted when verify_client=yes (mutual TLS / client certificate auth). Since we never set that option, the line serves no purpose and is removed from both the fresh-config generator and the upgrade-injection block. Also add ca-certificates explicitly to the Dockerfile apt-get install so the package is always present for any future use. https://claude.ai/code/session_01PTzYWkePEG3tDCMSLfWrXE --- Dockerfile | 1 + docker/entrypoint.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 477cc8f..96a54d5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -22,6 +22,7 @@ RUN echo "exit 101" > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d && asterisk \ asterisk-core-sounds-en-gsm \ asterisk-modules \ + ca-certificates \ openssl \ curl \ wget \ diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index 7079e32..ec51151 100644 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -207,7 +207,7 @@ bind=0.0.0.0:5061 ; Server IP: ${local_ip} | Public IP: ${PUBLIC_IP:-unknown} cert_file=/etc/asterisk/certs/server.crt priv_key_file=/etc/asterisk/certs/server.key -ca_list_file=/etc/ssl/certs/ca-certificates.crt +; ca_list_file not set — only needed for verify_client=yes (client cert auth) method=tlsv1_2 ${nat_settings} @@ -273,7 +273,7 @@ protocol=tls bind=0.0.0.0:5061 cert_file=/etc/asterisk/certs/server.crt priv_key_file=/etc/asterisk/certs/server.key -ca_list_file=/etc/ssl/certs/ca-certificates.crt +; ca_list_file not set — only needed for verify_client=yes (client cert auth) method=tlsv1_2 ${nat_settings}