Skip to content
FlySIPFlySIP Docs

Accept and send SIP over TLS

TLS encrypts SIP signalling between the switch and a customer or vendor, so numbers and headers cannot be read on the way. This page sets up both directions: incoming TLS calls from customers and outgoing TLS calls to a vendor. Allow 30 minutes.

Before you start

Section titled “Before you start”
  • You have Administrator access to the environment.
  • You have a valid certificate and its private key for the switch’s SIP name, or you can issue one with Let’s Encrypt as in Install an SSL certificate for the web interface. An expired certificate cannot establish a TLS connection.
  • You know the IP addresses of the customers and vendors that will use TLS.
  • For outgoing calls: the vendor’s TLS address and port, and its CA certificate if you want to verify the vendor.

Step 1: Allow TLS in the firewall

Section titled “Step 1: Allow TLS in the firewall”

SIP over TLS uses TCP, port 5061 by default, and the IP Firewall closes it for everyone until you allow it.

  1. Open System Management → IP Firewall and select the SIP tab.
  2. Click Add Rule, select Type SIP/TLS, enter the IP Address and Netmask of a customer or vendor and set Rule to Allow.
  3. Repeat for every peer and click Save.

Result: the peers are listed under SIP/TLS. See Set up the firewall.

Step 2: Add the certificate

Section titled “Step 2: Add the certificate”
  1. Open System Management → SSL Management → SSL Certificates and click Add.
  2. Enter Name and Common Name, the SIP name of the switch.
  3. Select Use Domain SIP TLS and the Type: Uploaded with the certificate and key under Advanced Parameters, or Issued by LetsEncrypt.org.
  4. Click Save & Close.

Result: the certificate is listed with its Expiration Date.

Step 3: Accept incoming TLS calls

Section titled “Step 3: Accept incoming TLS calls”

The switch accepts TLS on TCP 5061 of every IP address of the environment. A listener needs a certificate before it answers.

  1. Open System Management → SIP Features → Incoming SIP TLS Connections.
  2. Click Add.
  3. Select the Network Listener, the IP address and port that will accept TLS.
  4. Select the SSL Certificate from step 2 and the TLS Method.
  5. Click Save.
Screenshot "operations/incoming-sip-tls" has not been generated yet — see scripts/screenshots/screens.yml.
TLS Method Protocols accepted
SSLv23 Any: SSLv2, SSLv3, TLSv1, TLSv1.2, TLSv1.3
TLSv1_3 TLSv1.3 only
TLSv1_2 TLSv1.2 only
TLSv1 TLSv1 only

Use TLSv1_2 or TLSv1_3 unless a peer cannot do it; SSLv23 also accepts protocols that are no longer secure.

Result: in about a minute, the listener accepts TLS calls. Customers point their devices at this address and port with the TLS transport.

Step 4: Send calls to a vendor over TLS

Section titled “Step 4: Send calls to a vendor over TLS”
  1. Optional: to verify the vendor’s certificate, open System Management → SSL Management → CA Lists, click Add, enter Name, select Use Domain SIP TLS, upload the vendor’s CA certificate in Upload CA List and save.
  2. Open Vendors → Vendors and click Connections in the vendor’s row.
  3. Open the connection, or add one. Set Protocol to SIP/TLS, enter the vendor’s TLS address and port, and click Save & Close. SIP/TLS is offered only when at least one SSL certificate exists.
  4. In the connections list, click SIP TLS Options in the row of the connection.
  5. Select the SSL Certificate from step 2, the CA List if you added one, and the TLS Method.
  6. Click Save.
Screenshot "operations/connection-sip-tls" has not been generated yet — see scripts/screenshots/screens.yml.

Result: in about a minute, calls routed to this connection go out over TLS. TLS and TCP connections always use a single outgoing port.

Step 5: Test it

Section titled “Step 5: Test it”
  1. Make a test call from a customer device set to TLS. Open Reports → Call Records (CDRs) and check that the call is listed.
  2. Make a test call routed to the TLS connection and check its CDR under the vendor.
  3. If a TLS call does not reach the switch or the vendor, check the SIP/TLS firewall rule, the certificate’s Expiration Date, and that both sides accept the same TLS Method.

What’s next

Section titled “What’s next”