Security, TLS and network
How signaling, media, web traffic and internal connections are encrypted, where certificates and secrets live, which outbound traffic leaves through the proxy and which ports and sources the platform accepts. Browse the feature map or configuration finder.
Availability: Next. Entries that depend on an optional feature, a role or a deployment choice name it in their own Availability line.
Features in this family
- SIP over TLS at the edge
- TLS checks on inbound trunks
- TLS and mutual authentication on egress trunks
- SRTP media encryption
- Activate trunk certificates and trust material
- Platform secrets and secret storage
- Public edge certificates and renewal
- TLS for the media and recording service
- Encrypted database and Redis connections
- TLS on internal service listeners
- Outbound egress proxy
- Network ports, allowed sources and firewall
- Edge source verification and call token checks
SIP over TLS at the edge
When the TLS listener is enabled, the SIP edge speaks SIP over TLS 1.2 or newer on the SIPS port, presents the deployment listener certificate and offers the default cipher suites of its TLS library.
For: Integrators, Deployment operators
Read more:
- Reference: TLS versions, cipher suites and certificate checks
- Reference: Supported SIP TLS cipher suites in 0.9.18
Related features: TLS checks on inbound trunks, TLS and mutual authentication on egress trunks, Public edge certificates and renewal, Activate trunk certificates and trust material.
TLS checks on inbound trunks
An inbound trunk can require TLS, verify the carrier certificate, demand a client certificate and match the expected subject name before a call is accepted.
For: Deployment operators, Integrators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › SIP Trunks › trunk › TLS Security(tlsRequired, tlsVerifyCert, tlsRequireClientCert, tlsCaCertMaterialId, tlsPeerNameVerifyMode, tlsRemoteSubjectName) | TLS and media |
Read more:
- Set it up: TLS and media
- Reference: TLS versions, cipher suites and certificate checks
Related features: SIP over TLS at the edge, SRTP media encryption, Activate trunk certificates and trust material.
TLS and mutual authentication on egress trunks
An outbound carrier trunk can use TLS with certificate verification and present a client certificate when the carrier requires mutual authentication.
For: Deployment operators, Integrators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › Egress › trunk › TLS fields(/admin-settings/egress, tlsVerifyCert, tlsRequireMutual, tlsCaCertMaterialId, tlsClientCertMaterialId, tlsClientKeyMaterialId, tlsPeerNameVerifyMode) | Trunk fields |
Read more:
- Reference: Trunk fields
- Set it up: Activate SIP trust and client material
Related features: SIP over TLS at the edge, Activate trunk certificates and trust material, Platform secrets and secret storage.
SRTP media encryption
Media on a trunk can be offered or required as SRTP with SDES keys exchanged over a TLS signaling leg; plain RTP stays available for trunks that do not support it.
For: Integrators, Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › SIP Trunks › trunk › SRTP Mode(srtpMode) | TLS and media |
Read more:
- Set it up: TLS and media
- Reference: SDP and media security
Related features: TLS checks on inbound trunks, SIP over TLS at the edge.
Activate trunk certificates and trust material
Trunk CA bundles and client key pairs are stored as platform secrets, published to Redis and picked up by the SIP edge, which reloads TLS without dropping calls.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › Platform Settings › Secret Storage › TLS materials collection(tlsCollectionPath, voiceai:tls:materials) | Activate SIP trust and client material |
Read more:
- Set it up: Activate SIP trust and client material
- Reference: Register a platform secret
Related features: Platform secrets and secret storage, TLS checks on inbound trunks, TLS and mutual authentication on egress trunks.
Platform secrets and secret storage
Provider keys, certificates and other credentials are stored in AWS Secrets Manager under a deployment namespace, entered and rotated from an admin page without exposing stored values.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › Platform Settings › Secret Storage(platformSecrets, awsRegion, namespace, generalCollectionPath, tlsCollectionPath, PLATFORM_SECRETS_NAMESPACE) | Establish platform secret storage |
Read more:
- Set it up: Establish platform secret storage
- Reference: Register a platform secret
- Set it up: Rotate, remove and recover a secret
Related features: Activate trunk certificates and trust material, Public edge certificates and renewal, Platform settings.
Public edge certificates and renewal
The public certificate for web, API and SIP is issued by automation through a DNS challenge or supplied manually, renewed by a weekly job before expiry and pushed to the edge hosts.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Platform settings | Admin Settings › Platform Settings › edge TLS(edgeTls, renewalThresholdDays, automation, manual) | Public edge certificate lifecycle |
| Services and containers | Bootstrap and tasker environment, edge TLS variables(EDGE_TLS_INPUT_MODE, EDGE_TLS_RENEWAL_THRESHOLD_DAYS, CERTBOT_EMAIL, HETZNER_API_TOKEN) | Ops variables |
Read more:
- Set it up: Public edge certificate lifecycle
- Reference: DNS names and certificates
- Reference: Verify platform TLS
Related features: SIP over TLS at the edge, TLS for the media and recording service, Platform secrets and secret storage, Background jobs and schedules.
TLS for the media and recording service
The media upload host serves HTTPS with its own certificate, supplied either as mounted files or as encoded variables, so media fetched by voice services travels encrypted.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Media host environment, media TLS variables(MEDIA_TLS_SOURCE, MEDIA_TLS_CERT_FILE, MEDIA_TLS_KEY_FILE, MEDIA_TLS_FULLCHAIN_B64, MEDIA_TLS_PRIVKEY_B64) | Establish and rotate Media HTTPS trust |
Read more:
- Set it up: Establish and rotate Media HTTPS trust
- Reference: Media variables
Related features: Public edge certificates and renewal, TLS on internal service listeners.
Encrypted database and Redis connections
PostgreSQL, the connection pooler and Redis can require TLS with a pinned internal CA, and every service verifies the server certificate unless an operator relaxes it explicitly.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Service environment, database and Redis TLS variables(DATABASE_SSL_MODE, DATABASE_SSL_CA_FILE, DATABASE_SSL_CA_BUNDLE_B64, REDIS_TLS_ENABLED, REDIS_TLS_CA_FILE, POSTGRES_TLS_ENABLED, PGBOUNCER_CLIENT_TLS_SSLMODE) | Verify internal database and Redis encryption |
Read more:
- Set it up: Verify internal database and Redis encryption
- Reference: Database variables
- Reference: Variables defined on other pages
Related features: Database connection and credentials, Redis connection, TLS on internal service listeners.
TLS on internal service listeners
The API service can terminate TLS itself with a certificate, key and CA path and optionally request client certificates, for deployments without a TLS-terminating proxy in front.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | API service environment, listener TLS variables(TLS_ENABLED, TLS_CERT_PATH, TLS_KEY_PATH, TLS_CA_PATH, TLS_REQUEST_CERT, TLS_REJECT_UNAUTHORIZED, API_TLS_ENABLED) | Verify platform TLS |
Read more:
- Set it up: Verify platform TLS
- Reference: Establish the expected configuration
Related features: Encrypted database and Redis connections, TLS for the media and recording service.
Outbound egress proxy
Outbound HTTP, WebSocket and mail traffic from the platform leaves through a Squid proxy on port 3128, set through the standard proxy variables, with a transparent redirect for clients that ignore them.
For: Deployment operators
| Level | Where to change it | Owner section |
|---|---|---|
| Services and containers | Host environment, proxy variables(HTTP_PROXY, HTTPS_PROXY, NO_PROXY, SMTP_PROXY, EGRESS_TLS_REJECT_UNAUTHORIZED, REDSOCKS_PROXY_HOST) | Outbound access |
Read more:
- Reference: Outbound access
- Reference: Network ports
- Reference: Shared runtime variables
Related features: Network ports, allowed sources and firewall.
Network ports, allowed sources and firewall
Each host role opens a defined set of ports for SIP, RTP, web and internal traffic, and the host firewall limits the internal ones to the private network and known carrier addresses.
For: Deployment operators, Integrators
Read more:
- Reference: Network ports
- Reference: Configuration and network ownership
Related features: Outbound egress proxy, Edge source verification and call token checks, SIP over TLS at the edge.
Edge source verification and call token checks
The SIP edge relays outbound transfers only when they come from a registered voice server, and trunks that demand a call token refuse calls whose token is missing or invalid, each with a distinct 403 reason.
For: Deployment operators, Integrators
Read more:
- Reference: Responses generated by the edge
- Troubleshoot: Rejects without a structured record
Related features: Network ports, allowed sources and firewall, SIP edge log records.