TLS and SRTP for VoIP security

TLS protects SIP signalling in transit. SRTP protects RTP media in transit. Using TLS alone does not encrypt the conversation, and using SRTP alone does not hide SIP identities or call setup.

Verify these controls

• Certificate name matches the hostname used by the endpoint.
• Certificate chain is trusted and not expired.
• Devices agree on supported TLS versions and cipher suites.
• SIP messages negotiate SRTP consistently through every SBC and carrier boundary.
• Keying material is protected and rotated according to the platform design.
• Logs and packet captures do not expose credentials or sensitive media.

Operational trade-offs

Encryption can complicate troubleshooting because middleboxes may not inspect payloads, and certificate failures can look like simple reachability failures. Document trust anchors, renewal ownership, and fallback behaviour before rollout.

Related: VoIP protocols and packet captures.