pjsip: clarify tls cert and key file usage

A question arose as to whether a .pem file
could be provided in place of the .crt and
.key files in a PJSIP TLS configuration. I
tested this and discovered that although a
cert will be read from the pem file, a key
will not, and thus the priv_key_file entry
is still required. This update to the fine
documentation clarifies the option usage.

AST-1448 #close
Review: https://reviewboard.asterisk.org/r/4129/
Reported by: John Bigelow

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@426928 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/configs/pjsip.conf.sample b/configs/pjsip.conf.sample
index c0523931c475281eb0901c87f98f2dc2b346a789..51cdf2eeb15eb71d74f73c5b51cec77fcf474eaa 100644 (file)
--- a/configs/pjsip.conf.sample
+++ b/configs/pjsip.conf.sample
@@ -699,7 +699,10 @@
         ; "")
 ;ca_list_file=  ; File containing a list of certificates to read TLS ONLY
                 ; (default: "")
-;cert_file=     ; Certificate file for endpoint TLS ONLY (default: "")
+;cert_file=     ; Certificate file for endpoint TLS ONLY
+                ; Will read .crt or .pem file but only uses cert,
+                ; a .key file must be specified via priv_key_file
+                ; (default: "")
 ;cipher=        ; Preferred cryptography cipher names TLS ONLY (default: "")
 ;domain=        ; Domain the transport comes from (default: "")
 ;external_media_address=        ; External IP address to use in RTP handling

diff --git a/res/res_pjsip.c b/res/res_pjsip.c
index b22219834d6406ab57708e86143d35fa66a1cc69..25fda1d52a20054a19495d63d87d6d75d6ef32b9 100644 (file)
--- a/res/res_pjsip.c
+++ b/res/res_pjsip.c
@@ -817,6 +817,12 @@
                                </configOption>
                                <configOption name="cert_file">
                                        <synopsis>Certificate file for endpoint (TLS ONLY)</synopsis>
+                                       <description><para>
+                                               A path to a .crt or .pem file can be provided.  However, only
+                                               the certificate is read from the file, not the private key.
+                                               The <literal>priv_key_file</literal> option must supply a
+                                               matching key file.
+                                       </para></description>
                                </configOption>
                                <configOption name="cipher">
                                        <synopsis>Preferred cryptography cipher names (TLS ONLY)</synopsis>