Skip to main content
What Get2Dial encrypts between your phones, your carrier, and your workspace, and where that encryption comes from.

​
How it works

Get2Dial encrypts SIP signaling in two places:
  • Carrier trunks. When you connect a carrier, you choose the transport your carrier expects — UDP, TCP, or TLS. TLS encrypts the signaling between Get2Dial and your carrier; it’s a setting on the carrier, not a workspace-wide switch.
  • Browser and desk phone registration. Your workspace’s SIP domain and WSS URI (see View your workspace settings) use WebSocket Secure — SIP signaling over TLS — for every browser softphone and desk phone that registers against it.
Certificates for your SIP domains are issued automatically through Let’s Encrypt and renewed 30 days before expiry, then deployed to whichever of your edge servers carry that domain. Your workspace’s default, Get2Dial-managed domain needs nothing from you — the certificate is already in place and stays current on its own. When a certificate is replaced, Get2Dial keeps the working certificate active until the replacement has been installed and verified on every assigned edge server.

​
Custom domain certificates

A custom SIP domain needs an _acme-challenge CNAME delegation before automatic certificate issuance can start. Get2Dial provides the target; add the record at your DNS provider and keep it in place. This limits Get2Dial’s access to certificate validation only: you never provide your Cloudflare account, an API key, or other DNS-provider credentials.

​
When to use it

Set transport to TLS on a carrier connection when your carrier requires or offers encrypted signaling. For a Get2Dial-managed SIP domain, issuance and renewal are automatic. For a custom domain, add the validation CNAME during onboarding, then Get2Dial handles the ongoing lifecycle.

​
What it affects

Get2Dial encrypts call signaling (TLS/WSS) but does not encrypt call media — there is no SRTP support today. Audio for a call travels as unencrypted RTP even when its signaling is on TLS. If encrypted media is a requirement for your organization, confirm this with Get2Dial before relying on the platform for calls where that matters.
Choosing TLS for a carrier trunk affects only that trunk’s signaling. It doesn’t change how any other carrier, or your workspace’s own SIP domain, is secured.

​
Limits and constraints

Certificates are issued and renewed automatically — you don’t need to take any action to keep a domain’s certificate valid. Get2Dial holds the private key throughout; there’s no upload path for bringing your own certificate, and no download of key material.

​
Next steps

Connect a SIP carrier

Security controls