SIPS — the same SIP signalling as 5060, wrapped in TLS.
RFC 3261 assigns 5061 to SIP over TLS, and the sips: URI scheme implies it. The handshake is ordinary TLS, so the server presents a certificate before any SIP message is exchanged, which hides headers, extensions and credentials from the path. Carriers and hosted PBX providers offer it as the secure trunk option, usually paired with SRTP for the media. Signalling encryption does not encrypt the audio: without SRTP the RTP streams are still in the clear.
Fine to expose
This is the port to expose if SIP must face the internet. Use a valid certificate, disable old TLS versions, and still rate-limit registrations — TLS protects the wire, not weak extension passwords.
$ openssl s_client -connect TARGET:5061 -servername TARGET </dev/null 2>/dev/null | head -20Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.