# TLS and SRTP encryption on Yealink phones

> Encrypt calls between your Yealink phones and the PBX with TLS signalling and SRTP audio.

- URL: https://kb.voipcloud.online/phones-and-apps/yealink/tls-and-srtp-encryption/
- Section: Phones and apps › Yealink
- Type: guide
- Applies to: All countries
- Last reviewed: 2026-11-09

TLS encrypts the connection between your SIP devices and the PBX, and SRTP encrypts the audio. Together they protect calls from being intercepted. You turn TLS on for the whole PBX, then update each Yealink phone.

## Before you start

- Turning TLS on affects **every** SIP device on your PBX, and every SIP trunk in **SIP registration** mode. Their SIP credentials change, so each one must be reconnected. Plan a time when you can update all of them.
- TLS encryption is free. There's no extra charge for turning it on.
- Update each phone to the latest firmware first. Some older phones (from before 2022) may not support the security certificates needed. If a phone can't register with TLS after updating, check Yealink's advice for that model.

## 1. Turn on TLS in the PBX

1. On the **PBX** tab, go to **Settings** › **General**.
2. Under **TLS encryption**, click **Enable**.
3. Click **Apply configuration**. The change doesn't take effect until you apply it.

See [General settings](https://kb.voipcloud.online/pbx/settings/general-settings/).

Each SIP device now shows **Transport protocol** **TLS** and **Media encryption** **SRTP** in **PBX** › **Devices**, with new SIP credentials.

## 2. Update the phone's account

**Note:** Menus can change between versions. If a label is different, check the vendor's own help.

1. In **PBX** › **Devices**, select the phone's SIP device and copy the new **Domain** (shown as `server:port`), **Username** and **Password**.
2. Sign in to the phone's web interface and go to **Account** › **Register**.
3. Enter the new **Register Name**, **User Name** and **Password**.
4. Under **SIP Server 1**, enter the **Server Host** and the new **Port** from the **Domain**.
5. Set **Transport** to **TLS** and click **Confirm**.

![Account Register page with Transport set to TLS and the TLS port](https://kb.voipcloud.online/images/phones-and-apps/yealink/tls-and-srtp-encryption-register.webp)

**Note:** [Auto-provisioned](https://kb.voipcloud.online/phones-and-apps/yealink/auto-provisioning/) phones don't need steps 2 and 3. When you turn TLS on or off, the PBX updates their provisioning settings (transport, port and SRTP) straight away. Restart each phone so it downloads them.

## 3. Turn on SRTP

1. Go to **Account** › **Advanced**.
2. Set **RTP Encryption (SRTP)** to **Optional** and click **Confirm**.

![Account Advanced page with RTP Encryption (SRTP) set to Optional](https://kb.voipcloud.online/images/phones-and-apps/yealink/tls-and-srtp-encryption-srtp.webp)

## 4. Update the codecs

1. Go to **Account** › **Codec**.
2. Under **Enable Codecs**, select **G722** and click the left arrow to move it to **Disable Codecs**.
3. Click **Confirm**.

![Codec page with G722 moved to Disable Codecs](https://kb.voipcloud.online/images/phones-and-apps/yealink/tls-and-srtp-encryption-codecs.webp)

## Check it works

- In **PBX** › **Devices**, the device shows **Online**, and **Transport protocol used** shows TLS.
- Make a test call to an outside number and check you can hear each other.

## If calls fail with TLS on

If the phone registers but calls don't connect, the phone's firmware may not trust the PBX's security certificate.

1. Update the phone to the latest firmware, which includes newer trusted certificates. Try again.
2. If calls still fail, go to **Security** › **Trusted Certificates** and check **Only Accept Trusted Certificates**. Changing it to **Disabled** lets the phone accept the certificate, but is less secure. Click **Confirm**.

![Trusted Certificates page with the Only Accept Trusted Certificates setting](https://kb.voipcloud.online/images/phones-and-apps/yealink/tls-and-srtp-encryption-trusted-certificates.webp)

If it still doesn't work, [open a support ticket](https://kb.voipcloud.online/support/support-tickets/).

## Turn TLS off again

Go to **Settings** › **General** › **TLS encryption** and click **Disable**, then apply the configuration. The SIP credentials change again, so update every phone with the new details and set **Transport** back to **TCP**.

## Related

- [Devices](https://kb.voipcloud.online/pbx/settings/devices/)
- [Set up a Yealink desk phone manually](https://kb.voipcloud.online/phones-and-apps/yealink/manual-setup-desk-phones/)