Unencrypted VoIP traffic is vulnerable to eavesdropping and call interception. SRTP (encrypted media) and TLS (encrypted signaling) together secure both the actual voice audio and the call setup process.
What Needs Encrypting in a VoIP Call
Signaling (SIP messages establishing and controlling the call) and media (the actual audio/video content) are separate data flows — both need independent encryption for a call to be genuinely secure end-to-end.
TLS for SIP Signaling
Encrypts the SIP messages themselves (call setup, authentication) — without this, an attacker on the network path could potentially observe call metadata or even authentication credentials in transit.
SRTP for Media Encryption
Encrypts the actual voice/video content — without this, anyone able to capture network traffic could potentially reconstruct and listen to the raw audio of a call.
Prerequisites
- An SSL/TLS certificate for your PBX's domain (see How to Install Let's Encrypt SSL with Certbot)
Step 1 — Configure TLS Transport in pjsip.conf
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/letsencrypt/live/yourdomain.com/fullchain.pem
priv_key_file=/etc/letsencrypt/live/yourdomain.com/privkey.pem
method=tlsv1_2Step 2 — Configure an Endpoint to Require TLS
[1001]
type=endpoint
transport=transport-tls
media_encryption=sdes
...Step 3 — Allow the TLS Signaling Port
sudo ufw allow 5061/tcpStep 4 — Configure SRTP for Media Encryption
[1001]
type=endpoint
media_encryption=sdes
media_encryption_optimistic=no
...media_encryption_optimistic=no requires encryption rather than merely preferring it, ensuring calls fail rather than silently falling back to unencrypted media.
Step 5 — Configure Client Softphones/Devices for TLS/SRTP
Most modern SIP clients support TLS/SRTP — enable it explicitly in the client's account settings, since many default to unencrypted UDP transport for broader legacy compatibility.
Step 6 — Verify Encrypted Registration
sudo asterisk -rx "pjsip show endpoint 1001"Confirm the endpoint shows as registered via the TLS transport, not the unencrypted UDP one.
Considerations for SIP Trunk Encryption
Check whether your SIP trunk provider supports TLS/SRTP — not all providers do, meaning the trunk-facing leg of a call might remain unencrypted even with your internal extensions fully secured; this is a real limitation worth understanding, not a configuration failure on your end.
Performance Impact
Encryption adds modest CPU overhead per call compared to unencrypted — generally negligible for most deployment sizes on modern hardware, but worth factoring into sizing for very high concurrent call volumes.
Balancing Security and Compatibility
Requiring TLS/SRTP for all endpoints improves security but can break compatibility with older devices/softphones lacking proper support — verify your actual device fleet supports encrypted transport before making it mandatory network-wide.
Common Errors
Endpoint fails to register over TLS — verify certificate paths are correct and readable by the Asterisk process, and that the client is actually configured to use TLS transport, not defaulting to UDP.
Calls connect but with no audio when SRTP is required — verify both endpoints in the call actually support and correctly negotiate SRTP; a mismatch causes silent media failure.
Continue Reading
- How to Set Up SIP Trunking for Your PBX
- How to Secure a VoIP Server Against Toll Fraud
- How to Install Let's Encrypt SSL with Certbot (Nginx & Apache)
Browse more articles in VoIP & Communication Servers.
