Map protection by traffic type and adjacent hop
TLS can protect one SIP signaling connection. SRTP and SRTCP protect media and media control under a negotiated cryptographic context. Enabling either one does not enable or prove the other. A phone, PBX, SBC and provider can terminate and originate separate signaling and media legs, each with its own trust, certificate, keying and packet path.
Document every termination point and avoid the phrase end-to-end encryption unless the actual participants, keys and intermediary access support it. A browser padlock, SIP TLS registration or endpoint security icon is not evidence for the full call path.
Encryption on one leg is not proof of end-to-end encryption. Review the provider boundary, certificates and media keying method.
Distinguish SDES from DTLS-SRTP key establishment
SRTP does not define its own key-management exchange. RFC 4568 SDES carries crypto suite and inline key parameters in SDP and therefore requires confidentiality and integrity protection for that signaling content. DTLS-SRTP instead uses a DTLS handshake on the media path to derive SRTP keys; SDP fingerprints and setup roles bind the expected certificate and handshake roles.
These modes are not interchangeable labels. Record the offered and selected mechanism, every signaling intermediary that can read or rewrite SDP, the certificate or fingerprint evidence, selected SRTP profile and downgrade policy. Do not expose SDP crypto values or private keys in shared diagnostics.
Verify negotiation, protected packets and decoded media separately
Preserve the offer and answer for each media stream, including transport profile, crypto or fingerprint attributes, setup role, address, port and payload mapping. Then locate the DTLS handshake or SDES selection, subsequent SRTP and SRTCP packets, authentication or replay errors, and bidirectional decoded audio. A completed SIP dialog, one encrypted packet or an unreadable payload cannot stand in for the full sequence.
Repeat the check after hold, transfer, ICE change or direct-media re-INVITE because the media peer or keys can change. Use bounded, authorized captures and retain metadata whenever payload collection is unnecessary.
Keep authorization, recording and maintenance in scope
Encryption does not grant permission to call. Preserve identity, authentication, dialplan authorization, emergency behavior and toll controls independently. If a PBX records, transcodes or mixes media, state where it decrypts and which administrators or services can access media and keys.
Inventory signaling and DTLS certificate consumers separately, test renewal and restart behavior, and record rollback. For an Asterisk deployment, use the PJSIP media-encryption guide to map endpoint policy, call legs, direct media and loaded runtime evidence. No endpoint, PBX, certificate, protected packet path or call was inspected or tested for this guide.
Bind Genesys BYOC TLS evidence to its Voice platform
The Genesys Cloud BYOC record preserves different legacy and Dynamic Cloud Voice certificate roots, addresses and URI suffixes. It also retains the outbound-only transport-setting boundary and Dynamic platform's lack of mutual TLS.
Preserve the Azure-facing certificate and media boundary
The ACS Direct Routing record binds TLS 1.2, public-CA trust, SBC FQDN and the published SRTP suite to the Azure-facing leg without projecting them onto the carrier leg or treating encryption as a completed call.
Apply the signaling-versus-media boundary to Linphone
Linphone exposes SRTP, ZRTP and DTLS media choices independently of signaling transport. The Linphone encryption guide follows configured policy into the selected call state and keeps ZRTP SAS verification separate from encrypted media and SIP TLS.
Trace a LoopUp mutual-TLS and SRTP failure by stage
Use the LoopUp secure-trunk diagnostic to separate DNS, TCP, customer certificate, LoopUp trust, mutual TLS, SIP, SDP security descriptions and SRTP packets.
Protect the intercom call without confusing transport and door authorization
The GDS3712 guide treats SIP signaling, media protection and remote-unlock authorization as separate policies. A protected call does not by itself authorize a relay action or secure the management plane.
Resolve SignalWire profile and credential encryption on the call
The SignalWire guide separates stored project defaults, credential settings, TLS registration, INVITE transport, certificate validation, SRTP negotiation and media outcome.
Keep Telnyx route selection separate from protected media
A Telnyx route or response-code failure is not repaired by weakening certificate, SRTP or codec policy. The Telnyx diagnostic moves to transport and media evidence only after signaling reaches the intended PBX route.
Verify Amazon Chime encryption on the actual selected path
An encryption-enabled Voice Connector uses TLS on 5061 and SRTP, but the selected connector, certificate trust, cipher and SDP still need evidence. The diagnostic keeps routing and negotiation together.
Do not infer PhonerLite protection from a restored profile
After recovering PhonerLite state, verify the selected profile, TLS handshake and media protection on the actual call. A copied sipper.ini or successful REGISTER proves none of those together.
Simwood TLS and SRTP remain separate negotiations
The Simwood guide requires evidence for certificate validation, signaling transport, SDP crypto and each media direction.
Sinch SRTP is coupled to TLS signaling
The Sinch diagnostic requires hostname trust, TLS negotiation, SDP crypto and media evidence separately.
Scope 8x8 trunk protection to the account SOW
The 8x8 provider guide separates current SOW-scoped SIPS and SRTP guidance from endpoint ports and historical interface details.
Bound Flowroute TLS to the documented signaling route
The Flowroute guide keeps URI-route transport, certificate validation and Direct Media as separate evidence.
Verify AireSpring TLS and SRTP on the actual carrier leg
The AireSpring guide keeps ordered options, certificate validation, signaling protection, media keying and decoded audio separate.
Keep JsSIP WSS protection scoped to its hop
The JsSIP guide does not treat a valid WebSocket TLS session as proof of downstream SIP or media protection.
Keep DIDWW TLS and SRTP as separate leg protections
The DIDWW guide treats signaling and media protection independently and does not claim end-to-end encryption.
Verify Exotel TLS and SRTP separately
The Exotel diagnostic checks certificate validation, signaling transport, SDP protection and both media directions independently.
Verify Voximplant signaling and media protection per leg
The Voximplant guide keeps transport, SDP, media endpoints and scenario-created leg boundaries explicit.
Check Colt SDES and MKI behavior separately from TLS
The Colt failover and media diagnostic verifies certificate-authenticated signaling and both media directions.
Do not infer Gamma encryption from private access
The Gamma provider record separates access isolation, CallGuard, SIP transport and media protection.
Bind Bandwidth transport evidence to the selected product
The Bandwidth provider record does not import one product path’s transport or media profile into another.
Treat legacy Jitsi protection claims as session questions
The Jitsi Desktop guide requires certificate, signaling and negotiated media evidence instead of relying on an old feature list or lock icon.
Separate three protected Sipnetic paths
For Sipnetic, DNS over TLS, SIP signaling over TLS and SRTP or ZRTP media are independent negotiations with different peers and evidence. None establishes the others.
Do not infer Allstream encryption from port support
The Allstream guide treats TCP 5061 and RTP or SRTP range documentation as capability evidence, not proof of TLS identity, SRTP negotiation or protected end-to-end media.
Separate Orange TLS signaling from SRTP media
The Orange Business Talk guide records DNS, time, certificate, TLS and SDP security as separate acceptance checkpoints.
Treat Vodafone encryption as an ordered option
The Vodafone Evolved Voice diagnostic separates TLS identity, negotiated SDP, SRTP profile, packet delivery and decoded media.
Keep trusted access separate from negotiated protection
The Swisscom Enterprise SIP diagnostic separates MPLS or IP access, SBC trust, signaling transport, SDP, media protection and decoded audio.
Do not infer Proximus protection from service reachability
The Proximus Business Trunking diagnostic separates access, signaling transport, negotiated media protection and decoded audio.
Do not transfer Crazytel Hybrid SRTP to standard trunks
The Crazytel SIP Trunking guide separates TLS signaling, standard-trunk media and Hybrid or CrazyPBX SRTP.
Do not infer MaxoTel encryption from SIP registration
The MaxoTel SIP Trunking guide records its reviewed UDP transport boundary without inventing TLS or SRTP support.
Leave Aussie Broadband protection unverified without the handoff
The Aussie Broadband SIP Trunks guide does not convert absent public TLS or SRTP details into either support or non-support claims.
Scope Wave protection to the observed legs
The Grandstream Wave diagnostic does not convert TLS, SRTP, HTTPS, RemoteConnect or a lock icon into end-to-end protection proof.
Bind Symbio TLS and SRTP to the order
The Symbio Enterprise SIP Trunking guide treats published TLS and SRTP as optional voice-termination features, not universal enterprise entitlement.
Verify NUSO TLS and SRTP independently
The NUSO guide separates ordered protection, TLS peer validation, SDP selection, SRTP packets and audible media.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- RFC 3261 SIP ↗
- RFC 3711 Secure RTP ↗
- RFC 4568 SDP Security Descriptions ↗
- RFC 5763 DTLS-SRTP framework for SDP offer and answer ↗
- RFC 5764 DTLS-SRTP ↗
- Asterisk 22 res_pjsip configuration reference ↗
- About Genesys Cloud BYOC Cloud ↗
- Carrier requirements for BYOC Cloud ↗
- Create a BYOC Cloud trunk ↗
- Configure SIP routing for a BYOC Cloud trunk ↗
- Choose a BYOC Cloud trunk transport ↗
- TLS trunk transport specification for BYOC Cloud ↗
- Dynamic Cloud Voice platform overview and migration guide ↗
- Dynamic Cloud Voice future-default announcement ↗
- SIP provider questionnaire for BYOC trunks ↗
- Genesys Cloud sites overview ↗
- Select an inbound Number Plan Site ↗
- Set up emergency services with BYOC ↗
- Genesys Cloud fair use policy ↗
- BYOC Cloud configuration checklist ↗
- Azure Communication Services retirement and breaking-changes guide ↗
- Provision Azure Communication Services Direct Routing ↗
- Azure Direct Routing infrastructure requirements ↗
- Azure Direct Routing SIP protocol specification ↗
- Monitor Azure Communication Services Direct Routing ↗
- Migrate ACS Direct Routing to Teams Phone ↗
- Azure Communication Services emergency-calling scope ↗
- Azure telephony known limitations ↗
- Certified SBCs for Azure Communication Services Direct Routing ↗
- Azure Communication Services pricing scenarios ↗
- Linphone softphone security architecture ↗
- Liblinphone 5.5 media parameters ↗
- Liblinphone 5.5 call control ↗
- Liblinphone provisioning configuration keys ↗
- RFC 6189 ZRTP ↗
- LoopUp SIP Trunking Setup Guide ↗
- LoopUp SIP Trunking Public Certificate Chain ↗
- LoopUp SIP Trunking Supported Root Certificate Authorities ↗
- LoopUp SIP Trunking Configuration for AudioCodes Mediant SBCs ↗
- LoopUp SIP Trunking Configuration for Ribbon 1000, 2000, and SWe Edge SBCs ↗
- RFC 5246: TLS 1.2 ↗
- RFC 4568: SDP Security Descriptions for Media Streams ↗
- Grandstream GDS3712 product page ↗
- Grandstream GDS3712 datasheet ↗
- Grandstream GDS3710/GDS3712 user manual ↗
- Grandstream GDS3712 quick installation guide ↗
- Grandstream GDS37xx and GRP26xx integration guide ↗
- Grandstream GDS37xx digital input configuration ↗
- Grandstream GDS37xx event logs guide ↗
- SignalWire SIP trunking ↗
- SignalWire SIP credentials ↗
- SignalWire Get SIP credential API ↗
- SignalWire Update SIP profile API ↗
- SignalWire FreePBX integration ↗
- SignalWire caller ID and CNAM ↗
- SignalWire rate limits ↗
- SignalWire E911 ↗
- SignalWire rates ↗
- Telnyx SIP trunking service objects ↗
- Telnyx authentication methods ↗
- Telnyx failover and retries ↗
- Telnyx SIP response codes ↗
- Telnyx Outbound Voice Profiles ↗
- Telnyx round-robin routing ↗
- Telnyx current SIP network information ↗
- Telnyx machine-readable voice network data ↗
- Telnyx configuration-guide boundary ↗
- AWS: Managing Amazon Chime SDK Voice Connectors ↗
- AWS: Editing Voice Connector settings ↗
- AWS: Creating a Voice Connector and encryption scope ↗
- AWS: Managing Voice Connector groups ↗
- AWS: Amazon Chime SDK endpoints and quotas ↗
- AWS: Voice Connector network and bandwidth requirements ↗
- PhonerLite downloads and release history ↗
- PhonerLite profiles, SIP settings and configuration-file locations ↗
- PhonerLite PLP provisioning profiles ↗
- PhonerLite sound devices, active calls and recordings ↗
- PhonerLite logbook and recorded-call linkage ↗
- Simwood Hosted SIP Trunks ↗
- Simwood hosted trunks interop ↗
- Simwood hosted trunk overview ↗
- Simwood Asterisk 16 hosted trunk example ↗
- Simwood hosted TLS/SRTP settings ↗
- Simwood Partner and Direct IP addresses and whitelisting ↗
- Simwood portal overview ↗
- Simwood Carrier Services API v3 ↗
- Sinch Voice API SIP Trunking reference ↗
- Sinch Voice API callback reference ↗
- Sinch Voice API authentication reference ↗
- Sinch Voice API call headers ↗
- Sinch Voice API call detail records ↗
- Sinch Voice API release notes ↗
- Sinch Elastic SIP Trunking product overview ↗
- Sinch BYOC SIP Trunking overview ↗
- 8x8 SIP trunking interface specification ↗
- 8x8 X Series SIP Trunk FAQ ↗
- 8x8 Network Best Practices ↗
- 8x8 X Series upgrade impact ↗
- 8x8 Admin Console phone-number claiming ↗
- 8x8 Admin Console service and emergency addresses ↗
- Flowroute inbound routes and number assignment ↗
- Flowroute preferred inbound PoP configuration ↗
- Flowroute host-based routing and DID assignment ↗
- Flowroute connected PoP review ↗
- Flowroute PoP interconnection requirements ↗
- Flowroute edge proxy and PoP configuration changes ↗
- Flowroute Direct Media firewall requirements ↗
- Flowroute IP-based outbound authentication ↗
- Flowroute TLS requirements ↗
- Flowroute service guide technical specifications ↗
- AireSpring SIP Trunking ↗
- AireSpring SIP Trunking data sheet, revision May 12, 2023 ↗
- AireSpring Master Service Agreement ↗
- AireSpring Long-Distance SIP Trunking ↗
- AireSpring data-sheet index ↗
- AireSpring Top 10 Reasons for SIP Trunking infographic, revision July 5, 2022 ↗
- JsSIP project site ↗
- JsSIP architecture overview ↗
- JsSIP documentation index ↗
- JsSIP current UA API ↗
- JsSIP current RTCSession API ↗
- JsSIP failure and end causes ↗
- JsSIP 3.10 getting-started guide ↗
- JsSIP 3.10 UA configuration parameters ↗
- JsSIP project repository ↗
- JsSIP repository changelog ↗
- Published JsSIP npm package ↗
- DIDWW inbound SIP routing methods ↗
- DIDWW create an inbound SIP trunk ↗
- DIDWW inbound SIP connectivity ↗
- DIDWW SIP connectivity reference ↗
- DIDWW registration history ↗
- DIDWW inbound registration credentials ↗
- DIDWW outbound trunks ↗
- DIDWW outbound authentication and security ↗
- DIDWW outbound SIP information ↗
- DIDWW Caller ID and CNAM OUT ↗
- DIDWW service failover and load balancing ↗
- DIDWW inbound call logs ↗
- DIDWW emergency calling on outbound trunks ↗
- Exotel SIP Trunking overview ↗
- Exotel SIP Trunking quickstart ↗
- Exotel call directions and routing modes ↗
- Exotel Dynamic SIP Trunking API ↗
- Exotel developer network and firewall guidance ↗
- Exotel SIP errors and troubleshooting ↗
- Exotel Connect Applet setup for inbound SIP ↗
- Exotel Dynamic SIP Trunking overview ↗
- Exotel SIP Trunking TCP India ↗
- Exotel SIP Trunking TLS India ↗
- Exotel Network and Firewall Configuration ↗
- Exotel view and manage a trunk ↗
- Voximplant SIP calls and registrations ↗
- Voximplant routing rules ↗
- Voximplant applications ↗
- Voximplant processing calls in scenarios ↗
- Voximplant CallEvents reference ↗
- Voximplant AppEvents reference ↗
- Voximplant SIPRegistration Management API ↗
- Voximplant VoxEngine limits ↗
- Colt SIP Trunking data sheet ↗
- Colt SIP Trunking External Technical Guide, version 2.1 ↗
- Colt: how to access your voice applications ↗
- Colt SIP Trunking support catalogue ↗
- Colt Voice Product News ↗
- Colt CLI Presentation archive ↗
- Colt SIP Trunking product page ↗
- Colt Companion service assurance ↗
- Gamma SIP Trunks and Call Management ↗
- Gamma SIP Trunking user support and training ↗
- Gamma help and support ↗
- Gamma service status ↗
- Gamma codes of practice ↗
- Gamma Business Communications Code of Practice ↗
- Gamma disaster-recovery planning article ↗
- Gamma Inbound Call Routing user support and training ↗
- Bandwidth Build SIP trunking setup ↗
- Bandwidth SIP Registrar setup ↗
- Bandwidth Vapi SIP integration ↗
- Bandwidth number features and Final Destination URI ↗
- Bandwidth telephone-number options and features ↗
- Bandwidth voice and E911 IP whitelist ↗
- Bandwidth moving phone numbers ↗
- Bandwidth global SIP trunking ↗
- Jitsi Desktop project repository ↗
- Jitsi Desktop release archive ↗
- Jitsi Desktop legacy download page ↗
- Jitsi Desktop legacy product site ↗
- Jitsi Desktop Windows setup guide ↗
- Jitsi security clarification: The Mossos confusion ↗
- Jitsi Meet Electron project repository ↗
- Jitsi Desktop jit.si account setup notice ↗
- ↗
- ↗
- ↗
- ↗
- ↗
- ↗
- ↗
- Allstream SIP Trunking Quick Start Guide ↗
- Allstream SIP Portal Overview — Native SIP and PRI-SIP ↗
- Allstream SIP Portal Overview — SIP Extreme and SIP Gateway ↗
- Allstream advisory for 911 access using VoIP services in Canada ↗
- Orange Business — Business Talk and Contact Center Access service documents ↗
- Orange Business assistance — Manage Business Talk IP sites ↗
- Orange Business — Business Talk and BTIP Patton SmartNode eSBC configuration guide ↗
- Orange Business — Business Talk Microsoft Teams Direct Routing guide ↗
- Orange Business — Business Talk Cisco CUCM and Webex Calling guide ↗
- Orange Business — Why cloud is the way forward for enterprise voice ↗
- Vodafone UK — SIP trunking ↗
- Vodafone — Converged Hybrid/Evolved Voice Service Specific Terms v1.4 ↗
- Vodafone — Converged Hybrid Voice data sheet ↗
- Vodafone — Tiered Support Services brochure ↗
- Vodafone storm Service Specific Terms v2.3 ↗
- Swisscom — Enterprise SIP for your private branch exchange ↗
- Swisscom — Enterprise SIP factsheet ↗
- Swisscom — Enterprise SIP compatibility list, July 2026 ↗
- Swisscom — Enterprise Connect getting started ↗
- Swisscom — Enterprise Connect order company services ↗
- Swisscom — Enterprise Connect own-gateway configuration ↗
- Sunrise — Business Voice SIP ↗
- Sunrise — On-premises and hybrid PBX portfolio ↗
- Sunrise — SIP Trunk technical flyer, August 2018 ↗
- Sunrise — Business voice direct flyer, March 2017 ↗
- Sunrise — Business Voice for Microsoft Teams factsheet, June 2021 ↗
- Sunrise — Business support contact ↗
- Proximus — Business Trunking product overview ↗
- Proximus — Business Trunking contractual service description, 15 January 2024 ↗
- Proximus — Professional-customer legal documents ↗
- Proximus — Customer service for large organisations ↗
- Crazytel — Creating a Register Based SIP Trunk, updated 26 October 2026 ↗
- Crazytel — CGNAT setup recommendations, updated 26 October 2026 ↗
- Crazytel — SRTP compatibility, updated 26 October 2026 ↗
- Crazytel — Custom outbound proxy settings, updated 26 October 2026 ↗
- Crazytel — No sound on calls, 30 December 2025 ↗
- Crazytel — Real-time network status ↗
- MaxoTel — 3CX SIP Trunking, last modified 24 May 2023 ↗
- MaxoTel — Portal Guide: PBX Extensions and SIP Trunks, last modified 11 August 2023 ↗
- MaxoTel — 3CX Suddenly Loses SIP Trunk Registration, last modified 21 April 2020 ↗
- MaxoTel — SIP ALG, last modified 19 June 2019 ↗
- MaxoTel — NAT Issues, last modified 20 April 2021 ↗
- MaxoTel — Which codecs are supported?, last modified 19 April 2021 ↗
- MaxoTel — What VoIP Protocols are supported? ↗
- MaxoTel — Outage Communications Policy ↗
- Aussie Broadband — SIP Trunks ↗
- Aussie Broadband — SIP trunks Critical Information Summary, 1 July 2026 ↗
- Aussie Broadband — BYO VoIP settings, updated 14 September 2026 ↗
- Aussie Broadband — Integrated Public Number Database and emergency-service address, updated 26 August 2025 ↗
- Aussie Broadband — phone-number port timing, updated 5 May 2023 ↗
- Aussie Broadband — port forwarding and CGNAT, updated 13 August 2023 ↗
- Aussie Broadband — current, upcoming and past outages ↗
- Aussie Broadband — report a fault in MyAussie, updated 26 February 2024 ↗
- Aussie Broadband — business support and service-delivery contacts ↗
- Grandstream — Wave product page ↗
- Grandstream — Wave release tracks ↗
- Grandstream — Wave Desktop user guide ↗
- Grandstream — Wave Mobile application user guide ↗
- Grandstream — Wave Web user guide ↗
- Grandstream — Wave application FAQ ↗
- Grandstream — UCM RemoteConnect user guide ↗
- Grandstream — UCM RemoteConnect FAQ ↗
- Grandstream — Wave Android 1.0.35.7 and iOS 1.35.7 release notes, 21 September 2026 ↗
- Symbio — Enterprise SIP Trunking ↗
- Symbio — Australia voice network and carrier services ↗
- Symbio — phone numbers and porting ↗
- Symbio — SIP TLS and SRTP announcement, 24 January 2024 ↗
- Symbio — dual-carrier voice redundancy, 11 November 2025 ↗
- Symbio — security and trust ↗
- Symbio — Major Outage Register ↗
- Symbio — 24x7 Global Service Assurance, 19 December 2023 ↗
- NUSO — SIP Trunking product page ↗
- NUSO — Platform Services ↗
- NUSO — HIPAA compliance and SIP Trunking security responsibilities ↗
- NUSO — customer support contacts ↗
- NUSO — technical support and network-status path ↗
- NUSO — policies, programme documents and customer-service contact ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.