A student's open lab: learning and sharing, free for everyone.

SIP UniverseFree University

Home / TLS, SRTP, identity, and abuse / TLS and domain certificates

TLS and domain certificates

SIP over TLS is RFC 3261 section 18. The certificate has to identify the SIP domain, per RFC 5922.

Learn in 5 minutes

  1. Treat TLS as a transport for the same SIP messages
  2. Check the certificate against the SIP domain
  3. Refuse a name that is only a nearby web host

Visual

INVITE over TLS · study drawing · cyphermonkeylabs.com AliceCarrier INVITE 100 180 200

SVG HTML PNG

TLS covers the SIP messages on that connection. It does not by itself choose SRTP.

Worked example

Read a TLS Via Dissect the INVITE. The transport is TLS. The domain in the request is example.com.

  1. Press Dissect.
  2. Read Via.
  3. Name the domain RFC 5922 must find in the certificate.

Fault

TLS to example.com fails. The certificate presented on 5061 names a different host.

RFC 5922 compares the certificate with the SIP domain the client intended to reach.

Quiz

SIP over TLS is specified in


RFC 5922 checks


The usual SIP TLS port in RFC 3261 is


A successful TLS handshake means


Via on a TLS hop shows


A certificate that names only files.example.com, for a request to example.com,


Ecosystem

Glossary, sister systems, and the integration seam for this room.

Quality management and recording QM scores interactions. The standardized way an SBC forks a session to a recorder is SIPREC.

Glossary · Ecosystem map · Ports · Troubleshooting

Sources and go deeper