> ## Documentation Index
> Fetch the complete documentation index at: https://docs.get2dial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption and certificates

> What Get2Dial encrypts in transit, where TLS applies, and how SIP domain certificates are issued, renewed, and managed.

What Get2Dial encrypts between your phones, your carrier, and your workspace, and where that
encryption comes from.

## How it works

Get2Dial encrypts SIP signaling in two places:

* **Carrier trunks.** When you [connect a carrier](/voice/connect-a-carrier), you choose the
  transport your carrier expects — UDP, TCP, or **TLS**. TLS encrypts the signaling between
  Get2Dial and your carrier; it's a setting on the carrier, not a workspace-wide switch.
* **Browser and desk phone registration.** Your workspace's SIP domain and **WSS URI** (see
  [View your workspace settings](/account/workspace-settings)) use WebSocket Secure — SIP
  signaling over TLS — for every browser softphone and desk phone that registers against it.

Certificates for your [SIP domains](/voice/sip-domains) are issued automatically through
Let's Encrypt and renewed 30 days before expiry, then deployed to whichever of your edge
servers carry that domain. Your workspace's default, Get2Dial-managed domain needs nothing
from you — the certificate is already in place and stays current on its own. When a certificate
is replaced, Get2Dial keeps the working certificate active until the replacement has been
installed and verified on every assigned edge server.

### Custom domain certificates

<Note>
  A [custom SIP domain](/voice/sip-domains) needs an `_acme-challenge` CNAME delegation before
  automatic certificate issuance can start. Get2Dial provides the target; add the record at
  your DNS provider and keep it in place. This limits Get2Dial's access to certificate
  validation only: you never provide your Cloudflare account, an API key, or other DNS-provider
  credentials.
</Note>

## When to use it

Set transport to **TLS** on a carrier connection when your carrier requires or offers encrypted
signaling. For a Get2Dial-managed SIP domain, issuance and renewal are automatic. For a custom
domain, add the validation CNAME during onboarding, then Get2Dial handles the ongoing lifecycle.

## What it affects

<Note>
  Get2Dial encrypts call **signaling** (TLS/WSS) but does not encrypt call **media** — there is
  no SRTP support today. Audio for a call travels as unencrypted RTP even when its signaling is
  on TLS. If encrypted media is a requirement for your organization, confirm this with Get2Dial
  before relying on the platform for calls where that matters.
</Note>

Choosing TLS for a carrier trunk affects only that trunk's signaling. It doesn't change how any
other carrier, or your workspace's own SIP domain, is secured.

## Limits and constraints

Certificates are issued and renewed automatically — you don't need to take any action to
keep a domain's certificate valid. Get2Dial holds the private key throughout; there's no
upload path for bringing your own certificate, and no download of key material.

## Next steps

<CardGroup cols={2}>
  <Card title="Connect a SIP carrier" href="/voice/connect-a-carrier" />

  <Card title="Security controls" href="/compliance/security-controls" />
</CardGroup>