TLS (Transport Layer Security)

TLS is the same protocol that secures HTTPS. In SIP it wraps the TCP connection between a client and a server so that every message is encrypted and cannot be altered in transit. RFC 3261 section 26 recommends it as the transport-layer protection for SIP, and the current version of the protocol is TLS 1.3, defined in RFC 8446.

When a softphone connects over TLS, the server presents a certificate. The client checks that a trusted certificate authority issued it and that it matches the server's name. This step is what prevents an attacker from pretending to be the server and collecting credentials. A client that skips the check gains encryption but not authentication, which is why strict clients refuse self-signed certificates.

TLS protects signaling only, and only on one hop. Audio travels separately over RTP and needs SRTP for encryption. The next server in the path may or may not use TLS onward.

The default port for SIP over TLS is 5061. In SIPdia, choose TLS in the Transport field. The server must present a certificate from a public certificate authority; self-signed certificates are rejected. If your PBX cannot offer one, use UDP or TCP over a VPN instead.