asterisk users - Jun 2019 - how to create a working certificate for using TLS?

Hi,

how can I create a self-signed certificate for asterisk which
actually works?  I had one that did work, and yesterday it suddenly
quit working for no reason.  I had to spend hours to create another
one that would finally work, and it suddenly quit working today.

The certificate verifies just fine with


openssl verify -verbose -CAfile ca.crt asterisk.pem


Yet asterisk keeps saying:


tcptls.c:173 handle_tcptls_connection: Certificate did not verify: unable to get
local issuer certificate


no matter what I do until I set 'tlsdontverifyserver=yes' in sip.conf.
Why doesn't the error message at least say which certificate it is
referring to?

Every time I have to deal with certificates, I hate that stuff more
and more ...

On 6/26/19 1:33 PM, hwilmer wrote:
> 
> Hi,
> 
> how can I create a self-signed certificate for asterisk which
> actually works?
follow this guide:
https://fabianlee.org/2018/02/17/ubuntu-creating-a-trusted-ca-and-san-certificate-using-openssl-on-ubuntu/

On 6/27/19 12:11 PM, hwilmer wrote:
> On 6/26/19 1:33 PM, hwilmer wrote:
>>
>> Hi,
>>
>> how can I create a self-signed certificate for asterisk which
>> actually works?
> 
> follow this guide:
>
https://fabianlee.org/2018/02/17/ubuntu-creating-a-trusted-ca-and-san-certificate-using-openssl-on-ubuntu/
> 
This has again, and for no reason, ceased to work again after restarting 
asterisk.  No matter what I try, I can't create a certificate asterisk
would verify.

Is this a bug in 16.4, or how can I create a certificate that doesn't
stop working randomly?