TLS
Click on the red underlined text to get to the source
... proxies must implement both UDP and TCP, along with TLS over TCP,
so that there is always an intersection of capabilities. Some form
...
... retain records with "SIPS" as the protocol, if the client supports
TLS. Second, a client MUST discard any service fields that identify
...
... SRV record for the server. It will also
allow the client to discover if TLS is available and its preference
for its usage.
...
... SIP+D2U" "" _sip._udp.example.com.
This indicates that the server supports TLS over TCP, TCP, and UDP ...
... service field SHOULD NOT be placed into the DNS, since it is not
possible to use TLS over UDP.
...
... certificate handed out by the server in the TLS exchange. Similarly,
the domain name in the SRV ...
... header can indicate "TLS", which
refers to TLS over TCP. When this value is present, the server MUST
use TLS ...
... TLS over TCP. When this value is present, the server MUST
use TLS over TCP to send the response.
...
... port from the Via, and the transport protocol
from the Via (again, a value of TLS refers to TLS over TCP). As in
...
... transport protocol
from the Via (again, a value of TLS refers to TLS over TCP). As in
the client ...
... service identifier "_sips" if the Via transport is "TLS", "_sip"
otherwise, and the transport from the topmost Via header ...
... otherwise, and the transport from the topmost Via header ("TLS"
implies that the transport protocol in the SRV ...
... NAPTR records are used to allow a client to discover that the
server supports TLS. An attacker could potentially modify these
records, resulting in a client ...
... This is partially mitigated by the presence of the sips URI scheme,
which is always sent only over TLS. An attacker cannot force a bid
down through deletion or modification of DNS records ...
... context, frequently on a business card or secure web page, or within
a SIP message which has already been secured with TLS. See RFC 3261prop
[1 ...
... URI is therefore preferred when security
is truly needed, but we allow TLS to be used for requests resolved by
a SIP URI to allow security ...