FreePBX certificates, TLS and SRTP

Separate the three requirements

Certificate Management stores certificates for PBX services. TLS protects a signaling transport and authenticates the server when the client validates it. SRTP protects media using a negotiated keying method. Selecting a certificate does not automatically enable both encrypted signaling and encrypted audio on every extension or trunk.

Write the server hostname, certificate issuer, endpoint trust store and media policy for each call leg. A trunk may have different capabilities from an internal phone.

Prepare before changing transports

Use a certificate whose names match the hostname phones connect to. Include the required chain and confirm expiry and system time. Configure the intended PJSIP transport and endpoint settings through supported FreePBX controls; generated Asterisk files are not the durable edit point.

Pilot one extension with certificate validation enabled. Keep a local management path available while changing the phone’s registration settings. A temporary trust bypass hides the issue you need to solve.

Verify signaling and media independently

Confirm the phone reaches the TLS listener, validates the certificate and registers. Then place a call and inspect the negotiated media protection on that leg. Successful TLS registration alone does not prove SRTP is active, nor does SRTP imply end-to-end encryption across a PBX that terminates media.

On failure, check clock, DNS name, chain, trust and supported TLS parameters before resetting credentials. Use TLS registration troubleshooting for the observable failure sequence.

Make renewal operational

Assign an owner and an alert before certificate expiry. After renewal, verify that the service is actually presenting the new certificate and the phone still trusts it. Renewal on disk and renewal on the running listener are different states.