TLS and SRTP: encrypted signaling and audio
Choose TLS as the transport to protect SIP signaling, and set Encrypt audio to Required to protect the call itself. Both depend on your server supporting them.
Shown with demo accounts and sample numbers.
Two layers, two settings
A SIP call has two parts. Signaling sets the call up: who is calling whom, which codecs to use, where to send the audio. Media is the audio itself, carried by RTP. SIPdia lets you encrypt each layer separately, because servers differ in what they support.
| Layer | SIPdia setting | Protocol | Protects |
|---|---|---|---|
| Signaling | Transport: TLS | SIP over TLS (TCP 5061 by default) | Credentials exchange, dialed numbers, call metadata, SRTP keys |
| Media | Encrypt audio: Optional or Required | SRTP (RFC 3711) with SDES key exchange in SDP | The voice itself |
How to turn encryption on
- On the Account page, set Transport to TLS. If your server uses a port other than 5061, add it to the server address as
host:port. - Under Advanced, set Encrypt audio to Required if the server supports SRTP, or Optional if you are not sure.
- Save and Register. If the status stays red, check the certificate requirement below and the registration troubleshooting guide.
The certificate requirement
SIPdia verifies the server's TLS certificate against public certificate authorities and checks that the name matches the server address. This blocks man-in-the-middle attempts, but it also means a PBX with a self-signed certificate cannot register over TLS. Free public certificates are available from several CAs; if that is not possible, use UDP or TCP over a VPN rather than disabling verification.
What encryption does and does not cover
- It covers the path between SIPdia and your SIP server, or your outbound proxy if you set one.
- Your server decrypts both layers. From there, protection depends on your PBX or provider and on the far end.
- SIPdia has no ZRTP or end-to-end key agreement, so it cannot promise that nobody between the two phones can listen.
- Encryption does not hide that a call happened, its duration, or the server you talk to.
Why you should pair TLS with SRTP
SIPdia negotiates SRTP keys with SDES, which places the keys inside the SDP body of the SIP messages. Without TLS, anyone who can read the signaling can read the keys. Use TLS whenever you use SRTP.
Frequently asked questions
What is the difference between TLS and SRTP in SIPdia?
TLS is the transport for SIP signaling: registration, call setup, the numbers you dial. SRTP encrypts the audio stream itself. You normally use both; TLS alone leaves the audio in the clear, and SRTP alone sends its keys in unencrypted signaling.
What do Optional and Required mean for Encrypt audio?
Optional offers SRTP and falls back to plain RTP if the other side cannot do it. Required refuses the call unless SRTP is negotiated. Use Required when your server supports SRTP and you never want unencrypted audio.
Why does SIPdia reject my PBX's certificate?
SIPdia trusts certificates issued by public certificate authorities only (the system trust store on macOS, Mozilla's root list on iOS). Self-signed certificates and roots installed through profiles are not used. Get a certificate from a public CA, or use UDP or TCP over a VPN.
Which port does TLS use?
TCP 5061 unless the server address names another port. Some networks block 5061; ask for it to be opened or use the provider's alternative port.
Is a SIPdia call end-to-end encrypted?
No. TLS and SRTP protect the path between SIPdia and your SIP server. What happens beyond the server, for example to the public telephone network, depends on your provider. SIPdia does not offer ZRTP or any end-to-end key agreement.
Get SIPdia for your Mac, iPhone or iPad
Bring the SIP account you already have. The Mac and iPhone apps are in release preparation; download links appear on the download page when each release is live.
