RFC 3711
TLS and SRTP
TLS locks signaling. SRTP locks audio. One without the other is a half-locked call.
- SIP/TLS — 5061. The certificate name must match the peer the phone dials.
- SIP/TLS — The trunk security profile is a separate decision from the phone security profile.
- SRTP — Crypto attributes in SDP. A successful TLS handshake does not encrypt RTP by itself.
Mixed mode, CAPF, and the CTL are CUCM concerns. A 488 after you require SRTP usually means the far side offered RTP only.