There should be an option to ensure the media is encrypted, otherwise to warn the user and drop the call. 
If you see even soft phones (in addition to hard phones) like eyebeam for example, they have an option where if the user selects that media must be encrypted, they won't do the call and give an indicative error.
Snom for example is a very very respected phone and they have this option where SRTP if selected as required, won't do the call unless it is SRTP.

You can put an option but not make it on by default. The person using it can choose to enable it.

This is quite similar to the TLS option where you put connection type is fixed since if its not secure we don't want it to fall back.

Could you clarify how the certificates are being handled currently?

1 - on the GUI there is a distinct box for the server certificate and server private key, but only one for the client. So the client certificate must have the key built-in, but the server must be separate?

2 - If the transport is TLS, what does "check certificate from the remote site" do?

3 - What does "Load Windows CA" do? Without this it only accepts CACert and root certificates on the PhonerLite folder?

Thanks!

I'm trying to understand whether my SIP provider supports the TLS for SIP.

I tick the "check certificate from the remote site" and the "Load Windows CA" because I expect that provider to have an SSL certificate from a known root CA (like Thawte or Comodo).

I select the TLS in the "Network->Preferred connection type" tab.
Then I see PhonerLite registering successfully (the green button in the status field) and the notice: "...;transport=tcp registered".

Does that mean my SIP provider declines the TLS mode and falls back to plain unencrypted TCP?

Dear Heiko,

Thank you for the hint.

Alas, no. This time I get "...:5061;transport=tls not registered <Connectivity Checks Failed>".

Is that final and I cannot do anything about it?

BTW
My signature is outdated, I'm on PL v2.37 (on winXP-SP3)

Thank you again!

So, to finalise the question:
My understanding is that if a provider implements TLS with a cert from a well-known root CA - I would be able to enable it on PhonerLite without importing/installing any certificates - just by referencing to my OS's cert store.
Right?

Just noticed that the latest PhonerLite does not have the ZRTP "masquerade" capability any more.
Why is that?

OK, got it!
Thank you.

So you want to connect by TLS to a SIP server that uses self signed certificates? Take a look at the "Certificate" configuration page. There is an option called "check certificate from the remote site". If that option is not active, all certificates are accepted.