TLS and SRTP on Asterisk and FreePBX

Out of the box, SIP and RTP travel in the clear. An afternoon of PBX work encrypts both legs between your iPhone and your server: TLS for signalling, SRTP for the audio itself.

1. Certificates

For production, a Let's Encrypt certificate for your PBX's hostname is the right answer, and FreePBX can manage one for you under Admin → Certificate Management. For a lab, self-signed works:

on the PBX

mkdir -p /etc/asterisk/keys

# a tiny CA
openssl genrsa -out /etc/asterisk/keys/ca.key 4096
openssl req -new -x509 -days 3650 -key /etc/asterisk/keys/ca.key \
    -out /etc/asterisk/keys/ca.crt -subj "/CN=Asterisk CA"

# the server certificate (CN must be the domain the app connects to)
openssl genrsa -out /etc/asterisk/keys/asterisk.key 2048
openssl req -new -key /etc/asterisk/keys/asterisk.key \
    -out /etc/asterisk/keys/asterisk.csr -subj "/CN=pbx.example.com"
openssl x509 -req -days 365 -in /etc/asterisk/keys/asterisk.csr \
    -CA /etc/asterisk/keys/ca.crt -CAkey /etc/asterisk/keys/ca.key \
    -CAcreateserial -out /etc/asterisk/keys/asterisk.crt

chmod 600 /etc/asterisk/keys/*.key
chown asterisk:asterisk /etc/asterisk/keys/*

2. The TLS transport

/etc/asterisk/pjsip.conf

[transport-tls]
type = transport
protocol = tls
bind = 0.0.0.0:5061
cert_file = /etc/asterisk/keys/asterisk.crt
priv_key_file = /etc/asterisk/keys/asterisk.key
ca_list_file = /etc/asterisk/keys/ca.crt
method = tlsv1_2

If the PBX sits behind NAT, tell the transport what the world sees, so SDP and Contact headers carry reachable addresses:

add to the transport when NATed

local_net = 192.168.0.0/24
external_media_address = 203.0.113.10
external_signaling_address = 203.0.113.10

3. The secure endpoint

Add media encryption to the extension the app registers to:

pjsip.conf endpoint settings

media_encryption = sdes
media_encryption_optimistic = no   ; require encryption, don't just prefer it
transport = transport-tls
direct_media = no
ice_support = yes
rtp_symmetric = yes
force_rport = yes
rewrite_contact = yes

In a wizard block, prefix with endpoint/ (so endpoint/media_encryption = sdes and so on). On FreePBX, the same settings live on the extension's Advanced tab: Media Encryption → SRTP via in-SDP (SDES), and Transport → the TLS transport.

4. RTP and the firewall

/etc/asterisk/rtp.conf

[general]
rtpstart = 10000
rtpend = 20000
icesupport = yes
strictrtp = yes

firewall

# SIP over TLS
iptables -A INPUT -p tcp --dport 5061 -j ACCEPT
# RTP (SRTP uses the same port range)
iptables -A INPUT -p udp --dport 10000:20000 -j ACCEPT

5. The app side

Good news: this is the default. New accounts in Saffron SIP use TLS on port 5061 already, so once the PBX side is up, the app connects encrypted with no changes. Just make sure the Server Domain in the app matches the certificate's hostname. A lab without certs can switch to TCP under Settings → Advanced any time.

Troubleshooting →All guides →