Secure SIP / TLS on Linux

[Walter Santos]

Does anyone use Secure SIP / TLS on Linux?
All the documentation I found was for Windows only.
I would like to use Secure SIP and Secure RTP

 

[cobaltit]

SRTP is just a check box. TLS to the extension is basically non existing at this point.

 

[StefanW]

the core is ready to handshake on TLS to Extensions but it is not a provisional option. Our 3CX SBC, however, would overcome this. U3 of v16 added TLS to SIP Trunk Providers

 

[eddv123]

Which phone model are you using ?

You can/will be able to enable TLS on the phones as well if they support it, Yealinks which we use support this feature, obviously you don't want to do this on every endpoint if you have a large site so alteration to the template could be an option.

 

[Walter Santos]

Well, I understand that we have 2 scenarios: Secure SIP and SRTP for internal communication (PBX / Endpoints) and Secure SIP and SRTP for external communication (PBX / SIP Provider).

From the research I did, I came to some conclusions:

1 - SRTP enabled does not work if Secure SIP is not enabled and working (as I understand it, it does not matter if the call is internal or external).

2 - Phones must have certificate support and in case of external calls the SIP Provider must also support Secure SIP and SRTP for communication.

3 - Secure SIP works on port 5061.

If I am right, basically to work in secure mode, just follow these steps:

1 - Go to Settings> Security> Secure SIP. Here it is possible to work with certificate

2 - For the SIP Provider go to: SIP Trunks> choose trunk> Change port to 5061. In Options> advanced, select SRTP.

3 - For phones go to: Extensions> Choose Extension> Phone Provisioning. In the part that is written Networks go to SIP Transport and switch to TLS, then in RTP mode choose only secure and save.

My problem is in step 1 where for Linux I don't know how to get the certificate.

My current scenario is:

3CX v16 on Linux on Google Cloud;
Yealink T19P IP Phones in STUN;

No SBC, no VPN, very simple scenario.

 

[Evolute IT]

Well, I understand that we have 2 scenarios: Secure SIP and SRTP for internal communication (PBX / Endpoints) and Secure SIP and SRTP for external communication (PBX / SIP Provider).

From the research I did, I came to some conclusions:

1 - SRTP enabled does not work if Secure SIP is not enabled and working (as I understand it, it does not matter if the call is internal or external).

2 - Phones must have certificate support and in case of external calls the SIP Provider must also support Secure SIP and SRTP for communication.

3 - Secure SIP works on port 5061.

If I am right, basically to work in secure mode, just follow these steps:

1 - Go to Settings> Security> Secure SIP. Here it is possible to work with certificate

2 - For the SIP Provider go to: SIP Trunks> choose trunk> Change port to 5061. In Options> advanced, select SRTP.

3 - For phones go to: Extensions> Choose Extension> Phone Provisioning. In the part that is written Networks go to SIP Transport and switch to TLS, then in RTP mode choose only secure and save.

My problem is in step 1 where for Linux I don't know how to get the certificate.

My current scenario is:

3CX v16 on Linux on Google Cloud;
Yealink T19P IP Phones in STUN;

No SBC, no VPN, very simple scenario.

The certificate is supposed to be in Settings -> Security -> Secure SIP. Even on Linux.

 

[Walter Santos]

The certificate is supposed to be in Settings -> Security -> Secure SIP. Even on Linux.

Yes, but there is no way to import

 

[Evolute IT]

Yes, but there is no way to import

Why would you? The one already there is the Let's Encrypt one.

 

[Walter Santos]

Why would you? The one already there is the Let's Encrypt one.

For SIP?

 

[Evolute IT]

For SIP?

SIP uses TLS certificate just like HTTP. Secure SIP is TCP just like HTTP too.

If the fields in the Security Settings are field with certificate data, you're good to go. Just setup everything manually or use custom templates.