The ca_list_file option requires /etc/ssl/certs/ca-certificates.crt to
exist and be readable. That file is created by the ca-certificates
package, which was only a Recommends dep (not installed via
--no-install-recommends), so the file was absent in the container image
and Asterisk rejected the entire transport-tls config with:
ERROR: ca_list_file /etc/ssl/certs/ca-certificates.crt is either
missing or not readable
ca_list_file is only consulted when verify_client=yes (mutual TLS /
client certificate auth). Since we never set that option, the line
serves no purpose and is removed from both the fresh-config generator
and the upgrade-injection block.
Also add ca-certificates explicitly to the Dockerfile apt-get install
so the package is always present for any future use.
https://claude.ai/code/session_01PTzYWkePEG3tDCMSLfWrXE
Claude
376a99b768