Register 7101 and 7102 over TLS and call through a dedicated test route. Confirm SRTP on both legs, then have both callers repeat a short phrase. Record TLS verification, SIP registration, media negotiation, and two-way audio separately. The lab follows FreeSWITCH v1.11.3 on an internal test node with SIP TLS and SDES-SRTP capable phones, working extensions, and FreeSWITCH handling the media.
Configure the internal TLS listener
Locate the configuration root with fs_cli -x 'global_getvar conf_dir' and back up the profile and dialplan. Point a test DNS name such as pbx.lab.example at the node. Obtain a certificate with that DNS SAN from your local CA. Put the server key, leaf certificate, and intermediate chain as needed in /etc/freeswitch/tls-lab/agent.pem. Put the CA bundle in cafile.pem in the same directory. Limit access to the key and separately install the appropriate CA in the phones' trust stores.
Merge the following settings into sip_profiles/internal.xml, preserving the existing addresses, directory domain, authentication, and routing. Disable any separate WebSocket listeners if they are outside the lab scope. Check other profiles for plain SIP.
<!-- 替换 internal 的 settings 中已有同名参数。 -->
<param name="tls" value="true"/>
<param name="tls-only" value="true"/>
<param name="tls-sip-port" value="5061"/>
<param name="tls-cert-dir" value="/etc/freeswitch/tls-lab"/>
<param name="tls-version" value="tlsv1.2"/>
<!-- 先进入拨号计划，再协商入局媒体。 -->
<param name="inbound-late-negotiation" value="true"/>
tls enables SIP over TLS. tls-only removes the plain SIP listener for this profile. The lab uses TCP 5061, so update the approved sources from the previous lab for the actual TLS port. RTP keeps its UDP range. tls-cert-dir points to the certificate directory. Verify the certificate actually served, since missing files can lead to a fallback. tls-version selects the enabled protocol versions. Use TLS 1.2 here and verify interoperability before adding versions.
tls-passphrase applies to an encrypted key. The lab assumes a permissions-protected key readable by the service. Plan client certificates and tls-verify-policy separately for mutual TLS. Here the phones verify the server certificate and extension authentication remains SIP Digest. During a migration, document which ports serve each transport and verify the actual phone connection.
Require SRTP on the test route
SDES conveys media keying material in SDP. Protect the signaling on each hop carrying it. Create dialplan/default/18_srtp_lab.xml under the configuration root. The vanilla default context includes these files. Check that 787101 and 787102 are free and use the extensions' actual authenticated context.
<include>
<extension name="fs18-secure-test">
<condition field="destination_number" expression="^78(710[12])$">
<!-- A 腿设为必需；向新建通道传播通用设置。 -->
<action application="set" data="rtp_secure_media_inbound=mandatory"/>
<action application="export" data="rtp_secure_media=mandatory"/>
<!-- B 腿明确设置出局方向的媒体策略。 -->
<action application="bridge" data="{rtp_secure_media_outbound=mandatory}user/$1@${domain_name}"/>
</condition>
</extension>
</include>
787102 resolves to 7102 and 787101 to 7101. The domain's user/ routing must use the fresh TLS registrations. Clear old test contacts before dialing. The inbound direction is explicitly mandatory, the general media policy is exported, and the new outbound leg receives an explicit mandatory setting. Direction-specific values take precedence. Late negotiation lets the dialplan set the inbound policy first. Avoid answering or negotiating media before this test route.
mandatory requires secure media, optional permits compatibility, and forbidden disables secure media. Confirm a common suite on the phones. With FreeSWITCH handling media, check both legs independently. The two test numbers are SIP extensions. Queue agent and tier configuration remains distinct.
Verify signaling, negotiation, and audio
# 在隔离节点、没有活动通话时重新加载。
fs_cli -x 'reloadxml'
fs_cli -x 'sofia profile internal restart'
fs_cli -x 'sofia status profile internal'
# 从话机所在网段用实际的 CA 和主机名验证 TLS。
openssl s_client -connect pbx.lab.example:5061 \
-servername pbx.lab.example -verify_hostname pbx.lab.example \
-CAfile ./lab-ca.pem -verify_return_error </dev/null
Drain calls before restarting the profile. Check the 5061 handshake, chain, and server name from the phone network. Register both phones over TLS on 5061 using the existing credentials. If the phone separates server address and authentication realm, use the certificate hostname for the server and preserve the directory domain for authentication.
Call 787102 from 7101 and 787101 from 7102. Check the final negotiation on each leg, including a secure profile such as RTP/SAVP and the selected crypto suite. Verify audio in both directions. Record only the profile and suite for shared evidence. Redact inline keys, authorization headers, and numbers. On the same test route, turn SRTP off on one phone and confirm that the call cannot complete with plain media. Restore the phone immediately after the test. These are expected results and were not tested on a live FreeSWITCH instance.
Troubleshoot and restore
- 5061 is unreachable. Check the listener, port conflicts, service logs, firewall, and certificate file permissions.
- TLS handshake fails. Compare the actual DNS name, SAN, trust chain, expiry, client clock, and protocol compatibility.
- Registration works and calling fails. Check the test route, the B-leg contact and common SDES suites. If negotiation succeeds without audio, compare the media addresses and UDP paths on both legs.
From the OS console, restore the previous profile and phone transport, remove the lab dialplan, and undo the lab firewall rules. Reload XML and restart the profile. Verify registration and calling with both extensions again.