Listeners should use global `certfiles`

I've setup certfiles

certfiles:
  - /usr/local/etc/ejabberd/certs/mydomain.tld.crt.pem
  - /usr/local/etc/ejabberd/certs/mydomain.tld.key.pem

...and XMPP works, multiple hosts and all that.

But now we have the A/V craze so I have to have a TURN server too.

And that works fine, 3478 at least, aka non-TLS.

So I need to setup turns then.

  -
    port: 5349
    use_turn: true
    turn_min_port: 60000
    turn_max_port: 65000
    turn_ip: MY.EXTE.RNAL.IP
    tls: true
    certfile: /usr/local/etc/ejabberd/certs/mydomain.tld.crt.pem
    module: ejabberd_stun

...but no?
[error] <0.24037.0> CRASH REPORT Process <0.24037.0> with 0 neighbours exited with reason: <<"SSL_CTX_use_certificate_file failed: error:0909006C:PEM routines:get_name:no start line">> in p1_fsm:init_it/6 line 386

Oh, right, let me put the key too, another certfile line, yes, what? [error] <0.24045.0>@ejabberd_config:reload:116 Configuration reload aborted: Invalid value of option listen->11: Duplicated option: certfile

But then? How? I can't just concatenate the files, that would be silly...surely... hey it works... at least it starts.

Now the question in the subject, why do I need to specify a certfile here?

I'd guess that you don't know for what domain this TURN server is setup (reverse DNS via stun.turn SRV records, maybe?), then again the log makes it clear that some smart choices are already done in place:
[info] <0.24025.0>@ejabberd_stun:prepare_turn_opts:127 You have several virtual hosts configured, but option 'auth_realm' is undefined and 'auth_type' is set to 'user', so the TURN relay might not be working properly. Using mydomain.tld as a fallback
so no need to specify a certain cert here, you can use auth_realm and extract the proper cert from the global one, right?

/LE: Testing a bit more and indeed, as @weiss points out global ones are used IF one does not specify another here.

Start at ejabberd_stun:prepare_turn_opts:127 and the listener option handling described in the issue, then inspect ejabberd_config:reload:116 for certificate validation. Reproduce a TLS TURN listener using global certfiles without a per-listener certfile, and verify that configuration reload succeeds and the listener starts with the expected certificate.