# TLS certificates and secure SIP failures

Canonical: https://warmtransfer.net/knowledge/sip-oauth-and-tls

Last verified: 2026-09-16

Cisco states that the TLS versions supported for secure SIP in Webex Calling are TLS 1.2 and TLS 1.3[^7]. For secure media, Cisco gives AES_CM_128_HMAC_SHA1_80 as the only SRTP key supported in Webex Calling[^6].

## Supported TLS cipher suites

Cisco lists 14 TLS cipher suites supported for secure SIP in Webex Calling[^4]. Among these 14 suites, TLS_AES_256_GCM_SHA384 is the only suite at 256 bits[^4]. The remaining 13 suites are AES-128 suites spanning the TLS 1.3 AES_128_GCM form and the ECDHE, ECDH, and DHE key exchanges in GCM and CBC modes[^4].

## Authentication and scope boundaries

In the field, the Webex Calling security requirements article describes endpoint discovery, TLS versions and ciphers, SRTP keys, and mutual TLS certificates across 6889 characters and mentions OAuth 0 times, so the corpus holds no Webex Calling source describing SIP OAuth as an endpoint or trunk authentication method[^5].

The Webex Calling security requirements article carries an Out of scope section naming the network security material it does not cover, including F5 requirements for certificate authorities and ciphers[^3].

## See also

See also [Certificate lifecycle management for voice](https://warmtransfer.net/knowledge/certificate-lifecycle).

## Applicability

Applies to: Cisco Webex Calling. Sources checked 2026-09-16.

## What remains uncertain

What SIP OAuth is on Unified CM and whether Webex Calling has any equivalent is not covered by the sources below. Mutual TLS configuration on Unified CM SIP trunks rather than on the Local Gateway is not covered by the sources below. Whether the 14 cipher suites are listed in preference order and which is negotiated is not covered by the sources below. Whether the TLS 1.3 suites are offered only on TLS 1.3 connections is not covered by the sources below. The specific F5 certificate authority and cipher requirements the security article excludes are not covered by the sources below.

## Sources

[^1]: A Webex Calling endpoint must use the _sips._tcp service and protocol combination as the prefix for the DNS SRV lookup that obtains the host address for TLS-based communication, must honour the host port weight and priority advertised for each host address, and must create an affinity of host to port when opening the socket for SIP registration, with selection by priority and weight following RFC 2782. Source: [Security requirements for Webex Calling](https://help.webex.com/en-us/article/jwkbt2/Security-requirements-for-Webex-Calling), Requirements for endpoints, Resolution of host address from the DNS SRV address. Checked 2026-09-16.
[^2]: Cisco names AES-CM-128-HMAC-SHA1 as the cipher typically used to encrypt media to Webex services from endpoints using SRTP with SIP signalling and describes it as a mature cipher with proven interoperability between vendors, and the Webex Calling security requirements article gives AES_CM_128_HMAC_SHA1_80 as the only SRTP key supported for secure media. Source: [Network Requirements for Webex Services](https://help.webex.com/en-us/article/WBX000028782/Network-Requirements-for-Webex-Services), media encryption paragraph, against the Webex Calling security requirements SRTP row. Checked 2026-09-16.
[^3]: The Webex Calling security requirements article carries an Out of scope section naming the network security material it does not cover, including F5 requirements for certificate authorities and ciphers. Source: [Security requirements for Webex Calling](https://help.webex.com/en-us/article/jwkbt2/Security-requirements-for-Webex-Calling), Out of scope section. Checked 2026-09-16.
[^4]: Cisco lists 14 TLS cipher suites supported for secure SIP in Webex Calling, of which TLS_AES_256_GCM_SHA384 is the only one at 256 bits and the remaining 13 are AES-128 suites spanning the TLS 1.3 AES_128_GCM form and the ECDHE ECDH and DHE key exchanges in GCM and CBC modes. Source: [Security requirements for Webex Calling](https://help.webex.com/en-us/article/jwkbt2/Security-requirements-for-Webex-Calling), Requirements for SIP and media table, TLS ciphers row, read as cells. Checked 2026-09-16.
[^5]: The Webex Calling security requirements article describes endpoint discovery, TLS versions and ciphers, SRTP keys and mutual TLS certificates across 6889 characters and mentions OAuth 0 times, so the corpus holds no Webex Calling source describing SIP OAuth as an endpoint or trunk authentication method (field report). Source: [Security requirements for Webex Calling](https://help.webex.com/en-us/article/jwkbt2/Security-requirements-for-Webex-Calling), whole article, counted against the rendered text. Checked 2026-09-16.
[^6]: Cisco gives AES_CM_128_HMAC_SHA1_80 as the only SRTP key supported for secure media in Webex Calling. Source: [Security requirements for Webex Calling](https://help.webex.com/en-us/article/jwkbt2/Security-requirements-for-Webex-Calling), Requirements for SIP and media table, SRTP row. Checked 2026-09-16.
[^7]: Cisco states that the TLS versions supported for secure SIP in Webex Calling are TLS 1.2 and TLS 1.3. Source: [Security requirements for Webex Calling](https://help.webex.com/en-us/article/jwkbt2/Security-requirements-for-Webex-Calling), Requirements for SIP and media table, TLS version row. Checked 2026-09-16.
[^8]: Registration-based trunks authenticate with SIP digest credentials consisting of a shared username and password, while certificate-based trunks authenticate with mutual certificates plus verification of the Local Gateway fully qualified domain name. Source: [Get started with Local Gateway](https://help.webex.com/en-us/article/t9xctu/Get-started-with-Local-Gateway), Registration versus certificate comparison table. Checked 2026-09-04.