SIP with TLS and SRTP

[pba-jordy]

Hello,

We have trouble configuring TLS and SRTP on 3CX and Yealink T46S/G.

Phones:
TLS on the phones works but if we set SRTP to "Compulsory" it rings but we can not answer the phone.

3CX:
If we enable TLS (in the SIP trunk) the entire SIP trunk stops working (with correct .pem file).
I set the certificate and key in the key in Setting\Security\Secure SIP.
If we enable SRTP it seems fine.

We have an on premise deployment with our host KeenSystems.

 

[cobaltit]

I'm not sure why you are trying to enable either of them. If you search the forum there's numerous threads on people having issues with this and not a single one of them had a truly valid reason for this. Many reason why they WANT to do this but none for why they NEED to do this and specifically this way.

TLS on the trunk is very tricky. I wouldn't even bother trying to do this unless you are working with a 3CX supported SIP trunking provider that will help you with this. For the rest, if this is a WANT I wouldn't waste your time. Once TLS/SRTP becomes main stream 3CX will enable it and it will be like a single checkbox in the PBX, at least when using 3CX FQDN and things will just work. Until them, you're just creating a support headache.

If you have specific goal in mind, it's better to state the desired outcome. Something like XYZ standard requires VoIP encryption (none do that I'm aware of) and how best to achieve that. Then the answer would be to use the tools you already have because any environment that has those needs or requirements already has the tools in place to do things things. Things like VLANs, VPN, PVC, etc.

And no idea who KeenSystems is but if you are really serious about doing this, in production and for a legitimate reason, then assuming they are your 3CX partner you should be working with them. If they can't help you, you should be working with another partner. This is not something you trust to forum support, especially if you are trying to do this for compliance reasons.