SIP TLS and SRTP: what each protects

Two protections for different traffic

TLS can protect the signaling connection between participating systems. SRTP protects media using an agreed cryptographic context. Enabling one does not automatically enable the other. A phone can use TLS signaling while its audio follows a different protection policy.

A PBX or carrier can terminate and originate separate legs. Protection on the phone-to-PBX leg does not establish end-to-end confidentiality across every intermediary or the public telephone network.

TLS and SRTP protect different traffic

Establish trust correctly

For TLS, the client must validate the expected server identity and certificate chain according to the supported implementation. Accurate time matters for certificate validity. Using a numeric address while expecting a certificate for a DNS name can create an identity mismatch.

Do not make disabling certificate verification the permanent answer to a registration problem. Correct the name, trust chain, time or certificate deployment through the documented platform process.

Agree on media security

SRTP requires compatible media-security negotiation and keys, in addition to compatible audio formats. A media-policy mismatch can reject call setup or produce an unusable leg. Consult both endpoint references to determine the supported negotiation methods.

Check the actual negotiated session on each relevant leg. A padlock icon is useful only when its meaning for that product is understood.

Test the full workflow

Validate incoming and outgoing calls, hold, transfers and remote use under the intended encryption policy. Include certificate renewal and phone restart in the maintenance plan. Restrict access and calling permissions independently; encrypted traffic from a compromised account can still place unauthorized calls.