Call Encryption - TLS/SRTP

From VoIP.ms Wiki

You do not have permission to edit this page, for the following reasons:

• The action you have requested is limited to users in one of the groups: staff, customer.
• You must confirm your e-mail address before editing pages. Please set and validate your e-mail address through your user preferences.

You can view and copy the source of this page:

{| class="wikitable" |+ |- ! Article en Français !! Artículo en Español |- | [https://wiki.voip.ms/article/Cryptage_des_appels_-_TLS/SRTP Français] || [https://wiki.voip.ms/article/Encriptado_de_llamadas-_TLS/SRTP Español] |} This feature allows you to encrypt the communication between your device and our server, by using the SIP-TLS ''(Transport Layer Security)'' and SRTP ''(Secure Real-Time Transport Protocol)'' protocol. This adds a security layer when the packets are being transmitted between you and our server, it encapsulates and encrypt the transmission. In other words, when your device is configured with this encryption method, your device asks to our server a dedicated certificate to establish a trust and fully secure communication from each part. This is ideal if you are using a softphone on a public network. ''(We strongly recommend you to use this function in this case.)'' Once encrypted calls are enabled for your account or sub account, the SIP-TLS and SRTP must be used. Your account or sub account will no longer be able to use regular SIP communication method. Call Encryption - TLS/SRTP is currently only available for SIP protocol. IAX is not supported. __TOC__ == Blog Articles == [https://wiki.voip.ms/article/Understanding_VoIP_Encryption_%E2%80%93_SIP-TLS_%26_SRTP Understanding VoIP Encryption – SIP-TLS & SRTP] [https://wiki.voip.ms/article/Ensuring_the_Security_of_Your_Calls Ensuring the Security of Your Calls] == Activate This Option on Your Main Account == 1) To active this feature go to your Customer portal home and click on “'''Main Menu'''” > “'''<font color="#FF7C21">Account Settings</font>'''” :[[File:TLS-SRTP-Steps0001.png|border]] 2) Once you are in the “'''Account Settings'''” section, navigate through the submenu and go to “'''<font color="#FF7C21">Advanced</font>'''” and find the field “'''<font color="red">Encrypted SIP Traffic</font>'''”, set to '''Yes''' and press '''Apply''' :[[File:TLS-SRTP-Steps0002.png|border]] '''Note:''' If enabled, all the SIP traffic will be encrypted for the main account. ''' ''' Please note that if encrypted calls are enabled then you need to configure your device to make and receive encrypted calls. == Activate This Option on Your Sub Account == 1) You may also activate this feature on a sub account. You need to navigate through the navigation bar and select “'''Sub Accounts'''” > “'''<font color="#FF7C21">Manage Sub accounts</font>'''”. :''If you don't have a sub account yet, you can create one by clicking on the tab “'''Create Sub Account'''”'' :[[File:TLS-SRTP-Steps0003.png|border]] 2) In the column “'''<font color="#FF7C21">Actions</font>'''” click on the edit button [[File:edit_icon.png]], for the row of the sub account you need to activate this feature. :[[File:TLS-SRTP-Steps0004.png|border]] 3) Once you are in the Edit screen, find the “'''<font color="#FF7C21">Advanced Options</font>'''” and “'''Click here to display'''”. Then set “'''<font color="red">Encrypted SIP Traffic</font>'''” to '''Yes''', and press '''Update Account''' :[[File:TLS-SRTP-Steps0005.png|border]] '''Note:''' If enabled, all SIP traffic calls will be encrypted for this sub account. ''' ''' Please note that if encrypted calls are enabled then you need to configure your device to make and receive encrypted calls. == Configuration on SIP Client == Once you have activated the feature on your main account/sub account, you need to configure your SIP client. On some devices, you will have to configure some settings to '''enable''' the SIP-TLS communication method. In your settings you must select '''TLS''' as your transport protocol and activate ''media encryption or SRTP^*'' as '''Mandatory^*'''. Without mandatory ''media encryption^*'', this would result in a call rejection with the SIP error 488. '''''Some technical considerations that you need to know for using this feature.''''' Please take note, when using encrypted calls with a server, you must always use the server name with a '''number''' at the end. For example, you must use chicago'''1'''.voip.ms instead of chicago.voip.ms. This also applies to cities with only one server. For example, you select the POP server london.voip.ms in the portal, but write london'''1'''.voip.ms when you configure your [[Devices]], [[Softphones]] or [[PBXs]]. When you are using the TLS protocol, it is implied to be using TCP as packet transport. The reason is using TLS over UDP is not supported by the TLS specification. The TLS by TCP will use the port '''5061''' instead of 5060. We also have an alternative port such as '''5081''' and '''42873''' ''*The configuration and the terminology may vary from each device/PBX.'' ''*Take note; some SIP clients do not support the call encryption, in some cases is a paid feature, or is available only in the paid version.'' Some old systems/devices require to configure the certificate manually. In case is needed, please contact technical support via live chat or email to support@voip.ms (from the email address associated to your account), requesting the client certificate and advising the SIP server. '''NOTE''': The certificate expires every 90 days, so requesting a new one every period will be necessary to keep call encryption working under these circumstances To know more about that, please refer to the device configuration page or your device manual. == TLS/SRTP Registration Status Validation == When your device is fully registered by using SIP-TLS protocol, you will be able to see the registration status in the portal Home page “'''Main menu'''” > "'''Portal Home'''" for each account/sub account registered or in “'''Sub Accounts'''” > “'''Manage Sub accounts'''” tab to see all of your Sub Accounts registration status. A <font color="green">green padlock</font> [[File:green_padlock.png]] will appears on the right of <font color="green">"Registered"</font> in green. If you don’t see the padlock, you need to revalidate some configuration. :[[File:TLS-SRTP-Steps0006.png|border]] :[[File:TLS-SRTP-Steps0007.png|border]] == Notes == *It has been confirmed that ATA Obi100 does not support encrypted calls.

Return to Call Encryption - TLS/SRTP.