SRTP call encryption - Hybrid SIP trunks, CrazyPBX and standard SIP trunks
SRTP (Secure RTP) encrypted calls are supported on Hybrid SIP trunks and CrazyPBX, for inbound and outbound calls. Pair SRTP with SIP over TLS (SIPS, port 5061) so call audio and signalling are both encrypted. Standard SIP trunks do not support SRTP; use a Hybrid SIP trunk instead.
Where SRTP is supported
| Product | SRTP | Notes |
|---|---|---|
| Hybrid SIP trunk | Yes | Register to hybrid.sip.crazytel.net.au over TLS on port 5061 and turn on SRTP in your PBX or phone. |
| Hybrid WebRTC (browser webphone and WebRTC softphones) | Yes | Always encrypted. WebRTC uses DTLS-SRTP over wss://hybrid.sip.crazytel.net.au:8443. |
| CrazyPBX | Yes | Supported and maintained on the CrazyPBX platform. |
| Standard SIP trunk | No | Standard SIP trunks (sip.crazytel.net.au and sip.biz.crazytel.net.au) do not support SRTP. Some customers used it unofficially in the past; network changes removed it. |
Set up SRTP on a Hybrid SIP trunk
- Set the trunk's SIP server to
hybrid.sip.crazytel.net.au. Always use the hostname, not an IP address. - Set the transport to TLS and the port to 5061.
- Set media encryption to SRTP in your PBX or phone. Some systems call this "Media Encryption", "SRTP Mode" or "Secure RTP".
- Save, then check the trunk re-registers over TLS.
- Make a test call in each direction and confirm the call shows as encrypted on your PBX.
SRTP works outbound but not on inbound calls
Inbound calls are sent to your PBX over the connection it registered with. If the trunk registers over UDP or TCP, inbound calls arrive on that transport even when your outbound calls are sent over TLS with SRTP.
- Make sure the trunk registers over TLS on port 5061, not only sends calls over TLS.
- Remove any older UDP or TCP registration for the same trunk, for example from a second PBX or an old phone.
- Check your PBX accepts SRTP offers on inbound calls, not only on outbound calls.
If inbound calls are still not offered SRTP after the trunk registers over TLS, email helpdesk@crazytel.com.au or call 1800 272 998 with the trunk username and the time and number of a test call.
Need SRTP on a standard SIP trunk?
Use a Hybrid SIP trunk. Hybrid trunks are $5.00 per trunk per month on any SIP Trunk plan and also add hold, transfer, call recording and a WebRTC webphone. See Hybrid SIP Trunks - features and pricing and https://crazytel.com.au/hybrid-sip-trunks/.
Related
- Hybrid SIP Trunks - hold, transfer, recording, features and pricing
- Hybrid SIP Trunks - WebRTC credentials, password, TURN and calls by SIP URI
Need help?
Email helpdesk@crazytel.com.au or call 1800 272 998.