{
  "port": 5061,
  "protocol": "both",
  "service": "SIP over TLS",
  "oneLiner": "SIPS — the same SIP signalling as 5060, wrapped in TLS.",
  "whatItIs": "RFC 3261 assigns 5061 to SIP over TLS, and the sips: URI scheme implies it. The handshake is ordinary TLS, so the server presents a certificate before any SIP message is exchanged, which hides headers, extensions and credentials from the path. Carriers and hosted PBX providers offer it as the secure trunk option, usually paired with SRTP for the media. Signalling encryption does not encrypt the audio: without SRTP the RTP streams are still in the clear.",
  "exposure": {
    "verdict": "fine",
    "note": "This is the port to expose if SIP must face the internet. Use a valid certificate, disable old TLS versions, and still rate-limit registrations — TLS protects the wire, not weak extension passwords."
  },
  "checkCommand": "openssl s_client -connect TARGET:5061 -servername TARGET </dev/null 2>/dev/null | head -20",
  "links": [
    {
      "title": "RFC 3261 — SIP: Session Initiation Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc3261.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 5061 (sips)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5061",
      "kind": "iana"
    }
  ]
}