TLS Certificate Generation

Asterisk ships with ast_tls_cert, a shell script that creates a private Certificate Authority and signs server/client certificates for use with PJSIP TLS, WebRTC WSS, and the HTTP server.

Requirements

• openssl installed on the Asterisk server
• Write access to the certificate output directory (e.g., /etc/asterisk/keys/)

Create a CA and Server Certificate

# Generate CA + server cert in one step
./ast_tls_cert -C pbx.example.com -O "My Company" -d /etc/asterisk/keys

This produces:

Create a Client Certificate

# Sign a client cert using the existing CA
./ast_tls_cert -m client \
  -c /etc/asterisk/keys/ca.crt \
  -k /etc/asterisk/keys/ca.key \
  -C phone1.example.com \
  -O "My Company" \
  -d /etc/asterisk/keys \
  -o phone1

Using the Certificates

PJSIP TLS Transport (pjsip.conf)

[transport-tls]
type = transport
protocol = tls
bind = 0.0.0.0:5061
cert_file = /etc/asterisk/keys/asterisk.crt
priv_key_file = /etc/asterisk/keys/asterisk.key
method = tlsv1_2

HTTP/WebSocket TLS (http.conf)

[general]
tlsenable = yes
tlsbindaddr = 0.0.0.0:8089
tlscertfile = /etc/asterisk/keys/asterisk.pem
tlsprivatekey = /etc/asterisk/keys/asterisk.key

How it works

1. Private CA: ast_tls_cert first creates a self-signed CA (ca.crt / ca.key) if one doesn't already exist. All subsequent certificates are signed by this CA, establishing a chain of trust.
2. Server certificate: The -C flag sets the Common Name (CN), which should be the server's FQDN or IP address. SIP phones and WebRTC clients validate this against the hostname they connect to.
3. Client certificate: The -m client flag creates a certificate for a SIP device. Some phones (Polycom, Yealink) support mutual TLS authentication using client certificates.
4. PEM format: asterisk.pem concatenates the private key and certificate into a single file, which is what most Asterisk config directives (tlscertfile) expect.
5. Permissions: The script sets umask 177 so private key files are created with mode 600 (owner-readable only). Verify permissions: ls -la /etc/asterisk/keys/*.key.

Tips

• For production systems, use Let's Encrypt certificates instead of self-signed. Use certbot and point cert_file and priv_key_file to the Let's Encrypt paths.
• Self-signed certificates require importing ca.crt as a trusted root on every phone and browser. This is manageable for small deployments but doesn't scale.
• Certificates expire after 365 days. Set a calendar reminder to regenerate before expiry, or use a cert manager with auto-renewal.
• Restrict TLS to version 1.2+: method = tlsv1_2 in the PJSIP transport. TLS 1.0 and 1.1 are deprecated.
• Verify your TLS setup: openssl s_client -connect pbx.example.com:5061 will show the certificate chain and negotiated cipher.
• Keep ca.key offline or at least backed up securely: anyone with the CA key can sign certificates that your system trusts.