<aside> 🔒 Use this if your SIP client or platform requires encrypted signalling and media. Most desk phones and softphones work fine on the standard settings — see Configure a SIP Client. Encryption is required by some AI voice and contact-centre platforms, which will not connect over unencrypted SIP.
</aside>
Both are needed for an end-to-end encrypted call. TLS on its own protects the signalling but leaves audio in the clear.
Everything is the same as a standard registration except the port, the transport, and the media encryption setting.
| Value | What to enter | Common field labels |
|---|---|---|
| Registrar / Outbound proxy | sip-registrar.vaspian.com | Proxy, Outbound Proxy, SIP Server, Registrar |
| Port | 5061 | Port, Server Port, TLS Port |
| Transport | TLS | Transport, Protocol |
| Media encryption | SRTP | Media Encryption, SRTP, Secure RTP |
| SIP domain | Your SIP domain (e.g. main.acme) | Domain, SIP Domain |
| Username / Auth name | Your extension (e.g. 188) | Username, User ID, Authorization Name |
| Password | Your SIP PIN | Password, Auth Password |
<aside> ⚠️ Register to the hostname, not an IP address. The TLS certificate is issued to sip-registrar.vaspian.com, so a client pointed at an IP will fail certificate validation even though the address is reachable.
</aside>
| Requirement | Detail |
|---|---|
| TLS version | TLS 1.2. TLS 1.0 and 1.1 are not accepted. |
| Certificate | Issued by a public certificate authority — no manual trust store changes needed on current devices. |
| Firewall | Allow outbound TCP 5061 in addition to your existing RTP media range. |
| SRTP | Must be enabled on the client. A TLS registration with unencrypted media may be rejected. |
<aside> 📅 Older desk phones may not support TLS 1.2. If a phone registers fine on the standard settings but fails on TLS, check for a firmware update before anything else — older firmware often only offers TLS 1.0, which is refused. Devices also need a roughly correct date and time, or certificate validation fails.
</aside>
| Symptom | Where to look |
|---|---|
| Connection refused or timeout on 5061 | A firewall is blocking outbound TCP 5061. Check the network, not the client. |
| TLS or certificate error | Registering to an IP instead of the hostname, an out-of-date clock on the device, or firmware that only supports TLS 1.0/1.1. |
| Registers, but calls fail or drop at answer | Media encryption mismatch — confirm SRTP is enabled, not just TLS. |
| One-way or no audio | A firewall or NAT is blocking RTP. Allow the media range outbound and turn off SIP ALG on the router. |
Need help? [email protected] — include your extension number, the client or platform you are using, and whether it registers on the standard settings.