--- title: VoIP Encryption - Why service providers turn off TLS/SRTP — and what they should have built instead description: Voice encryption is the easiest feature to advertise and the hardest one to keep on. The reason isn't engineering laziness. It's an SBC architecture decision made years before anyone realized it would matter. image: https://www.ecg.co/hubfs/Blogs/Featured%20Images%20for%20Blogs/Project%20and%20Design/feat-projectanddesign2.png --- [![ECG](https://www.ecg.co/hubfs/lp/cloud-migration/logo-vector.svg)](https://www.ecg.co) - Who We Are Company [**About ECG** Learn about the team behind the networks and services that solve real problems.](https://www.ecg.co/about) [**Careers** Join a fun, collaborative, engineer-owned company.](https://www.ecg.co/careers) Industries We Serve [**Enterprises** Optimize multi-site voice networks while meeting compliance requirements.](https://www.ecg.co/sectors/enterprise) [**Universities** Professional services designed for the unique needs of campus networks.](https://www.ecg.co/sectors/universities) [**Government** Engineering services built for government agency voice challenges.](https://www.ecg.co/sectors/government) [**Service Providers** Deep voice expertise to maintain compliance and keep customers connected.](https://www.ecg.co/sectors/service-providers) - Technologies **Carrier & Trunking Services** SIP trunking, resilience & carrier interconnect **Compliance & Call Authentication** STIR/SHAKEN, 603+ & secure signaling **Unified Communications & Collaboration** UC capabilities & platform expertise **Platform Reliability & Security** Infrastructure, capture & network fundamentals ### Carrier & Trunking Services Design, harden, and secure the carrier side of your voice network — from SIP trunking to encrypted media and compliant recording. [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) ### Compliance & Call Authentication Meet regulatory requirements end-to-end — call authentication, robocall mitigation, lawful capture, and encrypted signaling. [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) ### Unified Communications & Collaboration Modern UC capabilities backed by deep, hands-on expertise across every major voice platform. [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) ### Platform Reliability & Security The infrastructure layer underneath your voice services — engineered, monitored, and secured by people who run it every day. [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) - How We Do It Services [**Services Overview** Our experience and expertise in voice and data engineering.](https://www.ecg.co/services) [**Network Operations** Keep your voice network running with outsourced network operations.](https://www.ecg.co/services/network-operations) [**Staff Augmentation** Expert engineering support to meet deadlines and fill knowledge gaps.](https://www.ecg.co/services/staff-augmentation) [**IT Consulting & Engineering** Complete short-term projects faster with a dedicated project manager.](https://www.ecg.co/services/it-consulting-and-engineering) - Resources #### [Utilities Launch Delay Calculator Estimate what a potential product launch delay would cost your business. Try the calculator](https://www.ecg.co/cost-delay-calculator) #### [Resource Library Guides, White Papers & Tools In-depth resources on voice engineering, compliance, and AI — built from real client work. Explore resources](https://www.ecg.co/resource-library) #### [Blog Latest from the ECG Team Practical articles on SIP, UC platforms, network operations, and voice AI. Read the blog](https://www.ecg.co/blog) - [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) Who We Are [About ECG](https://www.ecg.co/about) [Careers](https://www.ecg.co/careers) Industries We Serve [Enterprises](https://www.ecg.co/sectors/enterprise) [Universities](https://www.ecg.co/sectors/universities) [Government](https://www.ecg.co/sectors/government) [Service Providers](https://www.ecg.co/sectors/service-providers) Technologies Carrier & Trunking Services [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) Compliance & Call Authentication [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) Unified Communications & Collaboration [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) Platform Reliability & Security [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) How We Do It Services [Services Overview](https://www.ecg.co/services) [Network Operations](https://www.ecg.co/services/network-operations) [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) Resources [Launch Delay Calculator](https://www.ecg.co/cost-delay-calculator) [Guides, White Papers & Tools](https://www.ecg.co/resource-library) [Latest from the ECG Team](https://www.ecg.co/blog) [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) # VoIP Encryption - Why service providers turn off TLS/SRTP — and what they should have built instead By: ECG Team 5 min read May 13, 2026 ## Voice encryption is the easiest feature to advertise and the hardest one to keep on. The reason isn't engineering laziness. It's an SBC architecture decision made years before anyone realized it would matter. A confession from inside a Tier-1 voice provider's NOC, paraphrased only slightly: *"We turned on TLS. We offer it as a service. But if a customer doesn't want it, we have a toggle right here. And honestly — if we turn it off, it's a lot easier for everybody."* That's not a hypothetical. That's the operational reality at networks serving tens of millions of subscribers. The marketing pages list TLS and SRTP as features. The provisioning UI lets you turn them on. But across the industry, voice encryption is one of the most quietly-toggled-off capabilities in modern UC — and it isn't because engineers don't care about security. It's because of an architectural choice made when SBCs were the most expensive piece of the network and nobody was being audited. ![tls trap alternative](https://www.ecg.co/hs-fs/hubfs/tls%20trap%20alternative.png?width=800&height=400&name=tls%20trap%20alternative.png) ### Two Customers Buying the Same Phone Call Every voice network is selling the same product to two customers with completely different definitions of success. The person on the call wants one thing: the call goes through. Transfers work. Hold music plays. The IVR doesn't drop the bridge. They do not care, in any operational sense, whether their RTP is encrypted. The security or compliance lead at the same enterprise wants something else entirely. They want the media leg encrypted in transit, the signaling leg encrypted in transit, and a defensible audit trail proving both. They do not particularly care whether the call goes through, because if it doesn't, that's a different team's problem. When TLS/SRTP interacts badly with a call transfer, a media swap, a recording integration, a fax fallback, or a sloppy SDP renegotiation — and at scale, it always interacts badly with at least one of those — the toggle gets flipped. The first customer is satisfied immediately. The second customer never finds out, because nobody is auditing the configuration state of every endpoint every day. **A network with a TLS/SRTP toggle is a network where TLS/SRTP, in practice, depends on whether anyone has recently filed a ticket.** ### Why the Toggle Is There at All The toggle exists because of testing economics. A large voice provider runs dozens of distinct call scenarios across the network on any given day: attended transfer, blind transfer, media swap mid-call, recording with CALEA capture, IVR-to-agent handoff, conference bridge, fax fallback, emergency calls, voicemail deposit. Every one of those scenarios has to behave correctly with TLS/SRTP on, with TLS/SRTP off, and across multiple PSTN gateways belonging to different upstream providers. The combinatorics get expensive quickly. When a defect surfaces — for example, a sequence-number mismatch during media renegotiation that drops one in fifty transferred calls — fixing it in a core network element means risking regression on a hundred other scenarios. The change-control conversation goes the way it always goes. The change gets deferred. The toggle gets documented as a workaround. The toggle gets used. That's not laziness. That's a rational response to a network design that didn't put encryption in the right place. ### The Architecture That Would Not Have Needed a Toggle The right place is the edge of the network, and only the edge. If TLS/SRTP only ever lives between the SBC and the phone — and the SBC always terminates encryption, transcodes media, and reissues fresh RTP into the core with every sequence number and timestamp regenerated — then nothing inside the core network ever has to know encryption exists. Recording integrations work the same. CALEA capture works the same. Call transfers work the same. Mid-call SDP renegotiations don't break, because the renegotiation only ever touches the SBC and the endpoint. The toggle disappears, because there is nothing left to toggle. This isn't theoretical. It's the architecture you would design today if you were starting from scratch. It's also not free. An SBC that handled 50,000 concurrent calls in pass-through mode handles closer to 12,000 when it transcodes every leg at the edge. You pay for that capacity in CPU, in licenses, hardware, and rack units. A single edge-transcoding SBC cluster — every subscriber terminates against them, every core-side leg is plain RTP — could cost more on day one than the topology most large providers actually built. It would have been worth it. The cost difference is real, but it is small compared to the operational cost of running a network where your security feature is conditional on whether the support team felt patient that afternoon. ### The Counterintuitive Part: Smaller Providers Are Better Positioned Across the 700-plus cloud communication providers ECG benchmarked, the relationship between provider size and TLS/SRTP support runs in the wrong direction. Larger providers are far more likely to claim the feature. Smaller providers are far less likely to advertise it at all. That gap is backwards. A small provider has fewer call scenarios to regression-test, fewer PSTN gateways to validate against, fewer customer-specific call flows to break. They can pick a clean SBC architecture without ripping anything out. TLS/SRTP, on a small network, is genuinely not that hard. ![well designed network dont have tls toggle](https://www.ecg.co/hs-fs/hubfs/well%20designed%20network%20dont%20have%20tls%20toggle.png?width=600&height=295&name=well%20designed%20network%20dont%20have%20tls%20toggle.png) What it is, for a small provider, is a procurement gate. Any enterprise with HIPAA, SOC 2, PCI-DSS, FedRAMP, or any other audited security framework is going to disqualify a provider that can't demonstrate encrypted media — even if the local relationship is good and the price is right. Procurement will not bend on this. So a small provider that ships TLS/SRTP correctly is competing for a class of customers that the rest of its size cohort can't reach at all. For a large provider, the question is harder. It's whether the architecture team is willing to admit that a five-year-old SBC topology decision was wrong, and whether finance is willing to fund the rebuild. Most won't. The toggle stays. ### What To Actually Do - **If you operate a network with a TLS/SRTP toggle:** stop counting the feature as supported. Start measuring the percentage of active subscribers with it enabled, and report that number to whoever in your organization cares about regulatory exposure. The number will not look the way the data sheet does. - **If you buy voice services:** ask the right question. Not *"Do you support TLS/SRTP?"* but *"What percentage of your active subscribers have TLS/SRTP enabled today, and how do you measure it?"* The two answers are not the same answer. - **If you are designing a voice network today:** terminate TLS/SRTP at the edge. Transcode 100% of media into the core. Price the SBC capacity into the original budget. You will not regret it. ### Where ECG Comes In ECG works with voice providers on the parts of the network that don't make it into the marketing pages. "Toggle problems" — TLS/SRTP, STIR/SHAKEN signing rates, automatic E911 location updates, CALEA delivery completeness — all live there. If the gap between your documented capability and your deployed reality is wider than you'd want a regulator to see, that's the engagement we do.  [security](https://www.ecg.co/blog/tag/security) [cybersecurity](https://www.ecg.co/blog/tag/cybersecurity) [data privacy](https://www.ecg.co/blog/tag/data-privacy) [mTLS](https://www.ecg.co/blog/tag/mtls) ## Similar posts [![What You Need To Know Before the FCC STIR/SHAKEN Deadline of Jun 30,](https://www.ecg.co/hubfs/Imported_Blog_Media/regular_ecg_blog_stirshakendeadline-1.jpg)](https://www.ecg.co/blog/177-what-you-need-to-know-before-the-fcc-stir-shaken-deadline-of-jun-30-2023) ### [What You Need To Know Before the FCC STIR/SHAKEN Deadline of Jun 30,](https://www.ecg.co/blog/177-what-you-need-to-know-before-the-fcc-stir-shaken-deadline-of-jun-30-2023) [![Strengthening VoIP Device Security: Understanding Where the Industry Stands on mTLS Adoption](https://www.ecg.co/hubfs/Blogs/2025/Strengthening%20VoIP%20Device%20Security%20Understanding%20Where%20the%20Industry%20Stands%20on%20mTLS%20Adoption/ecg-feat-mTLS1.png)](https://www.ecg.co/blog/strengthening-voip-device-security-with-mtls) ### [Strengthening VoIP Device Security: Understanding Where the Industry Stands on mTLS Adoption](https://www.ecg.co/blog/strengthening-voip-device-security-with-mtls) [![Jeff Pulver: Why aren't there advanced services? Nobody has any guts.](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/29-jeff-pulver-why-aren-t-there-advanced-services-nobody-has-any-guts) ### [Jeff Pulver: Why aren't there advanced services? Nobody has any guts.](https://www.ecg.co/blog/29-jeff-pulver-why-aren-t-there-advanced-services-nobody-has-any-guts) ## Need Help With Your Network or AI Project? Get expert advice from engineers who've solved complex problems for carriers, enterprises, and government agencies. [Let's Talk](https://www.ecg.co/contact) [![ecg-logo-white](https://www.ecg.co/hubfs/ecg-site/global/ecg-logo-white.svg "ecg-logo-white")](http://ECG,%20Inc) 505 North Toombs St. Suite A Valdosta, Georgia 31601 USA #### Headquarters [![](https://www.ecg.co/hs-fs/hubfs/ECG_hexagons_and_url_borderless.jpeg?width=465&height=289&name=ECG_hexagons_and_url_borderless.jpeg)](http://ECG,%20Inc) - 1.866.324.0700 US Toll-free - 1.229.244.2099 International - 1.229.244.2399 Fax - [info@e-c-group.com](mailto:info@e-c-group.com) #### Services [![](https://www.ecg.co/hs-fs/hubfs/ECG_hexagons_and_url_borderless.jpeg?width=465&height=289&name=ECG_hexagons_and_url_borderless.jpeg)](http://ECG,%20Inc) - [Overview](https://www.ecg.co/services) - [Network Operations](https://www.ecg.co/services/network-operations) - [Custom AI Development](https://www.ecg.co/services/custom-ai-development) - [Outsourced NOC Support](https://www.ecg.co/services/outsourced-noc-support) - [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) - [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) #### Company [![](https://www.ecg.co/hs-fs/hubfs/ECG_hexagons_and_url_borderless.jpeg?width=465&height=289&name=ECG_hexagons_and_url_borderless.jpeg)](http://ECG,%20Inc) - [About](https://www.ecg.co/about) - [Careers](https://www.ecg.co/careers) - [Blog](https://www.ecg.co/blog) - [Resources](https://www.ecg.co/resource-library) - [Events](https://www.ecg.co/events) © ECG, Inc. [Privacy Policy](https://9353907.hs-sites.com/privacy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "ECG Team", "url" : "https://www.ecg.co/blog/author/ecg" }, "dateModified" : "2026-05-13T14:00:00.419Z", "datePublished" : "2026-05-13T14:00:00.000Z", "headline" : "VoIP Encryption - Why service providers turn off TLS/SRTP — and what they should have built instead", "image" : [ "https://www.ecg.co/hubfs/Blogs/Featured%20Images%20for%20Blogs/Project%20and%20Design/feat-projectanddesign2.png" ], "mainEntityOfPage" : { "@id" : "https://www.ecg.co/blog/voip-encryption-why-service-providers-turn-off-tls/srtp-and-what-they-should-have-built-instead", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.ecg.co/hubfs/ECG_hexagons_and_url_borderless.jpeg" }, "name" : "ECG, Inc" } } ```