Freeswitch -- Having TLS conversation but when a call starts, INVITE is send without encrypted - freeswitch

Question

Good morning,
I’m trying to configure SRTP with TLS on Freeswitch. I already have SRTP, and I can establish a conversation with TLS, but when I make a call, it says “encrypted alert” and the TLS conversation stops sending the INVITE in TCP. I have been looking for some solutions and it states that the problema may be that the certificate is not properly configured or that TLS is not properly configured. It is imposible that the certificate has any problems because I currently get TLS untill the call starts.
Here it is the configuration on my profile:
<param name='rtp_secure_media' value='mandatory: AES_CM_128_HMAC_SHA1_80'/>
<param name='bind-params" value="tls"/>
<param name='tls-version' value='tlsv1'/>
<param name='register-transport' value='tls'/>
<param name="register" value="false"/>
<param name="transport" value="tls"/>
<param name="tls" value="$${internal_ssl_enable}"/>
<param name="tls-only" value="true"/>
<param name="tls-bind-params" value="transport=tls"/>
<param name="tls-sip-port" value="$${internal_tls_port}"/>
<param name="tls-cert-dir" value="/usr/local/freeswitch/conf"/>
<param name="tls-verify-date" value="true"/>
<param name="tls-verify-policy" value="none"/>
<param name="tls-version" value="$${sip_tls_version}"/>
<param name="tls-ciphers" value="$${sip_tls_ciphers}"/>
<param name="contact-params" value="tport=tls"/>
<param name="ws-binding" value="XX.XX.XX.XX:5061"/>
Also, I would like to make another observation: when I configure the bridge has transport=TLS ( ) in the dialplan, the debug says “TLS not supported by profile”
Thank you for taking the time to deal with my queries
Kind regards.

Answer 1

i had no experience on tls for freeswitch, but for the projects i had, we usually deploy opensips or kamailio ahead of freeswitch as a SIP proxy, which can bring sip over tls functionality easily in the whole topology structure.
the network looks like this:
freeswitch (group) opensips/kamalio other equipment or service
| ----(sip)----> | -------(sip over tls)------> |
| <======================(srtp)==========================> |
Keep the simplicity in freeswitch, and let the proxy handles all the protocols.
Actually opensips/kamailio can handle multiple protocols than tls, it can bring the flexiblity in your topology.