TLSAlso known as Transport Layer Security, SIP over TLS, SIPS

How SIP over TLS works

The client opens a TCP connection, performs a TLS handshake and checks the server certificate against a trusted certificate authority and the expected host name. SIP messages then flow inside the encrypted tunnel. Mutual TLS, where the client also presents a certificate, is common between carriers and SBCs.

• Confidentiality: dialled numbers, caller IDs and SDES keys for SRTP cannot be read on the wire.
• Integrity: messages cannot be modified in transit.
• Authentication: the certificate proves the far end is who it claims to be.

Deployment tips

Most SIP-over-TLS problems are configuration mismatches rather than cryptography: a phone that does not trust the server’s certificate authority, a host name that does not match the certificate, or a firewall that only opens UDP 5060. Check those three first when a TLS trunk will not register.

Disable SSL 3.0, TLS 1.0 and 1.1; prefer TLS 1.3 or TLS 1.2 with forward-secret cipher suites. Keep certificates renewed before expiry, as an expired certificate takes every TLS trunk down at once. Long-lived TLS connections also help with NAT traversal, because the device keeps an outbound connection open that the server can reuse for inbound calls.

TLS only protects signalling. Pair it with SRTP so the audio is encrypted too.

TLS on GSMCalls trunks

GSMCalls supports SIP trunks over UDP, TCP or TLS, and SIP over TLS between sites, so signalling to your PBX or softswitch can be encrypted end to end on the IP side. See SIP security: TLS and SRTP and the features page for details.