SIP TLS & SRTP: The Complete Guide to Encrypted Voice Communications

Standard SIP calls travel over the internet in plain text. Every SIP INVITE message, every DTMF tone, every spoken word can be captured by anyone with access to the network path between your PBX and your SIP trunk provider. This is not a theoretical risk — it is a practical reality that organizations face daily.

Without encryption, an attacker positioned on the network path can:

• Eavesdrop on conversations — Capture and reconstruct full audio from RTP packets using freely available tools like Wireshark
• Steal SIP credentials — Harvest usernames and digest authentication hashes from SIP REGISTER and INVITE messages
• Intercept DTMF tones — Capture credit card numbers, PINs, and access codes entered via phone keypad
• Launch man-in-the-middle attacks — Modify SIP headers to redirect calls, inject audio, or impersonate callers
• Commit toll fraud — Use stolen credentials to make unauthorized calls through your trunk

What an Attacker Sees

INVITE sip:+18005551234@sip.ipcomms.net
From: "John Smith" <sip:1001@pbx.acme.com>
To: <sip:+18005551234@sip.ipcomms.net>
Authorization: Digest username="acme_trunk",
  response="a1b2c3d4e5f6..."
Contact: <sip:1001@203.0.113.50>

17 03 03 00 8a 5c 2f 91 a3 b7 4e
f8 22 d1 0c 6b 83 47 a9 e5 1f 3c
90 bb 14 72 d8 6e c4 55 08 af 3d
7b e6 19 50 c1 8f 2a 94 dd 63 07
b5 48 fc 76 e2 3b a0 9c 1d 58 ...

Encrypted vs Unencrypted: Side by Side

A SIP phone call involves two distinct data streams, each requiring its own encryption layer. Encrypting only one leaves the other exposed.

Encrypted SIP Call Flow

Full Encrypted Call Flow Diagram

SIP over TLS (sometimes called SIPS) works by wrapping the standard SIP protocol inside a TLS-encrypted TCP connection, using port 5061 instead of the standard port 5060. The process follows the standard TLS handshake:

1. TCP connection: Your PBX opens a TCP connection to the SIP provider on port 5061
2. TLS handshake: Client and server exchange certificates and negotiate cipher suites (e.g., TLS_AES_256_GCM_SHA384)
3. Certificate validation: Your PBX verifies the server certificate against trusted Certificate Authorities. Optionally, the server can also verify your client certificate (mutual TLS)
4. Encrypted channel: All subsequent SIP messages flow through the encrypted tunnel — REGISTER, INVITE, BYE, and everything in between

Protocol Comparison

TLS Handshake Sequence

SRTP (Secure Real-time Transport Protocol, defined in RFC 3711) encrypts the media portion of a VoIP call. While TLS protects the signaling, SRTP protects the actual audio content — the spoken words.

Key Exchange Methods

Why TLS Alone Is Not Enough

SIP signaling and media travel on separate streams. TLS encrypts the SIP signaling (the control channel), but the actual audio data flows as RTP packets on different UDP ports (typically 10000–20000). Without SRTP, these audio packets are unencrypted even when signaling is protected by TLS.

Think of it this way: TLS encrypts the envelope (who is calling whom, from where), while SRTP encrypts the letter inside (what is being said). You need both for complete protection.

Voice encryption is not just a security best practice — for many industries, it is a regulatory requirement. Here are the major compliance frameworks that mandate or strongly recommend TLS/SRTP for voice communications.

Do You Need Voice Encryption?

Compliance Requirements Matrix

Both TLS/SRTP and VPN tunnels encrypt voice traffic, but they operate at different layers and serve different purposes. Here is how they compare.

This section walks you through configuring Asterisk 18+ with PJSIP to connect to IPComms using TLS for signaling and SRTP for media encryption.

Network Architecture

Step 1: Generate or Install TLS Certificates

You need a certificate and private key for Asterisk’s TLS transport. For production, use Let’s Encrypt:

Option A: Let’s Encrypt (production):

# Install certbot if not already present
apt install certbot

# Generate certificate for your PBX hostname
certbot certonly --standalone -d pbx.yourdomain.com

# Create symlinks for Asterisk
mkdir -p /etc/asterisk/keys
ln -s /etc/letsencrypt/live/pbx.yourdomain.com/fullchain.pem \
    /etc/asterisk/keys/asterisk.crt
ln -s /etc/letsencrypt/live/pbx.yourdomain.com/privkey.pem \
    /etc/asterisk/keys/asterisk.key

# Download the ISRG Root X1 CA bundle
wget -O /etc/asterisk/keys/ca.crt \
    https://letsencrypt.org/certs/isrgrootx1.pem

Option B: Self-signed (testing only):

# Generate self-signed certificate
openssl req -new -x509 -days 365 -nodes \
    -out /etc/asterisk/keys/asterisk.crt \
    -keyout /etc/asterisk/keys/asterisk.key \
    -subj "/CN=pbx.yourdomain.com"

# Copy cert as CA for self-signed
cp /etc/asterisk/keys/asterisk.crt /etc/asterisk/keys/ca.crt

# Set permissions
chown asterisk:asterisk /etc/asterisk/keys/*
chmod 640 /etc/asterisk/keys/*

Step 2: Configure PJSIP TLS Transport

Add a TLS transport to your /etc/asterisk/pjsip.conf:

; ============================================
; TLS Transport for encrypted SIP signaling
; ============================================

[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/asterisk/keys/asterisk.crt
priv_key_file=/etc/asterisk/keys/asterisk.key
ca_list_file=/etc/asterisk/keys/ca.crt
method=tlsv1_2
; Require TLS 1.2 minimum - do not use tlsv1 or sslv3

Step 3: Configure IPComms Trunk with TLS/SRTP

Configure the IPComms trunk endpoint, AOR, and authentication using the TLS transport:

; ============================================
; IPComms Trunk - TLS Signaling + SRTP Media
; ============================================

[ipcomms]
type=endpoint
transport=transport-tls
context=from-ipcomms
disallow=all
allow=ulaw
allow=alaw
outbound_auth=ipcomms-auth
aors=ipcomms
from_domain=sip.ipcomms.net
media_encryption=sdes
media_encryption_optimistic=yes
direct_media=no
trust_id_inbound=yes
send_rpid=yes
send_pai=yes

[ipcomms-auth]
type=auth
auth_type=userpass
username=YOUR_TRUNK_USERNAME
password=YOUR_TRUNK_PASSWORD

[ipcomms]
type=aor
contact=sips:sip.ipcomms.net:5061
qualify_frequency=60

[ipcomms-identify]
type=identify
endpoint=ipcomms
match=sip.ipcomms.net

Step 4: Enable SRTP on Internal Extensions

For end-to-end encryption, your internal phones should also use TLS/SRTP. Add these settings to your extension endpoints:

; Secure endpoint template for internal phones
[endpoint-secure](!)
type=endpoint
transport=transport-tls
context=from-internal
disallow=all
allow=ulaw
allow=alaw
direct_media=no
media_encryption=sdes
media_encryption_optimistic=no
; Set to no to REQUIRE SRTP from all phones

; Example extension using secure template
[1001](endpoint-secure)
auth=1001-auth
aors=1001
callerid="John Smith" <1001>

[1001-auth]
type=auth
auth_type=userpass
username=1001
password=STRONG_RANDOM_PASSWORD_HERE

[1001]
type=aor
max_contacts=1
remove_existing=yes

Step 5: Dialplan Configuration

Configure your dialplan in /etc/asterisk/extensions.conf to route calls through the encrypted trunk:

; ============================================
; Outbound calls via encrypted IPComms trunk
; ============================================

[from-internal]
; US/Canada domestic - 10 or 11 digit
exten => _1NXXNXXXXXX,1,Dial(PJSIP/${EXTEN}@ipcomms,,b(add-headers^${EXTEN}^1))
exten => _NXXNXXXXXX,1,Dial(PJSIP/1${EXTEN}@ipcomms,,b(add-headers^1${EXTEN}^1))

; International
exten => _011.,1,Dial(PJSIP/${EXTEN}@ipcomms)

; Emergency
exten => 911,1,Dial(PJSIP/911@ipcomms)
exten => 933,1,Dial(PJSIP/933@ipcomms)

; ============================================
; Inbound calls from IPComms
; ============================================

[from-ipcomms]
exten => _X.,1,Goto(inbound-handler,${EXTEN},1)

[inbound-handler]
exten => _X.,1,Answer()
 same => n,Dial(PJSIP/1001&PJSIP/1002,30)
 same => n,Voicemail(1001,u)
 same => n,Hangup()

Step 6: Reload and Verify

Apply the configuration and verify TLS is working:

# Reload PJSIP configuration
asterisk -rx "module reload res_pjsip.so"

# Verify TLS transport is listening
asterisk -rx "pjsip show transports"

# Check that port 5061 is open
ss -tlnp | grep 5061

# Enable SIP debug logging to verify TLS handshake
asterisk -rx "pjsip set logger on"

# Make a test call, then check the logs for:
# - "Transport: TLS" in SIP messages
# - "a=crypto:" lines in SDP (SRTP negotiation)

Verify TLS is Active

# Check that Asterisk is listening on TLS port
asterisk -rx "pjsip show transports"
# Look for: transport-tls  tls  0.0.0.0:5061

# Verify TLS connection to IPComms using openssl
openssl s_client -connect sip.ipcomms.net:5061 -brief
# Should show: CONNECTION ESTABLISHED
# Protocol: TLSv1.2 (or TLSv1.3)

# Check active channels for encryption
asterisk -rx "pjsip show channelstats"

Verify SRTP is Active

# Enable RTP debug during a test call
asterisk -rx "rtp set debug on"

# Make a call and look in the logs for:
# "SRTP" and "a=crypto:1 AES_CM_128_HMAC_SHA1_80"
# in the SDP negotiation

# Disable RTP debug when done
asterisk -rx "rtp set debug off"

Wireshark Verification

For thorough verification, capture packets with tcpdump and analyze in Wireshark:

# Capture SIP traffic on the TLS port
tcpdump -i eth0 -w /tmp/sip-tls-test.pcap port 5061

# Open in Wireshark - you should see:
# - TLS handshake packets (Client Hello, Server Hello)
# - Application Data packets (encrypted SIP - unreadable)
# - NO readable SIP INVITE or REGISTER messages

Use this checklist to ensure your SIP TLS/SRTP implementation is complete: