PhonerLite uses built-in certificates. But if you want to use your own certificates you can load them with PhonerLite. The above mentioned certificates are from "certificate authorities". You need such certificates to validate other certificates.
You don't need to configure any certificate to use PhonerLite. Only if you want to ensure that special certificates are valid you can configure such stuff.

Quote:

If you don't use TLS, and someone is wiretap you, he/she can see who you are calling. The options "SRTP" and "ZRTP" only refer to the audio data - that will be encrypted. If only SRTP is used, the key for encryption is exchanged unencrypted, so the wiretapper can decode the encrypted data with that. Only if both parties use ZRTP, that key is exchanged in a secure way.
Let's assume, you are using a VoIP provider - that is your man in the middle. If you are using TLS and SRTP, that provider has all knowledge to decode the audio data too. You have to trust that provider
Same scenario with that provider and both SIP endpoints support ZRTP. If a ZRTP based key exchanged succeeds, the audio data is encrypted end-to-end - that means your provider has no way to decode the encrypted voice (audio) data.
In theory your provider could support ZRTP too and handles that ZRTP key exchange as man in the middle. You would detect this if you compare that id ("ZRTP:xxxxx - xxxxx is that id). Both parties should tell that id each other. If the id is the same, there is no man-in-the-middle decoding possible.

Quote:

See above at 1).
ZRTP works independently from TLS. If both parties has that "ZRTP:xxxxx" tooltip for that encryption icon, and that id is the same - there is no way to decode the voice in the middle.

Quote:

As long as you don't hold the connection or do any other transfer functionality it shouldn't happen. If only at one side the ZRTP-id changes, both parties wouldn't hear each other any more.

Maybe a special sound would be fine if ZRTP is established or destroyed. Any suggestions to that are welcome.

Can you send me the content of the debug window after such call when ZRTP code changes? Please send them per email. Thanks.
If you have suitable sound files for such encryption status changes?

ZRTP uses Diffie-Hellman key exchange. They keys are generated randomly for each session - no key will be saved.

OK, I installed CSipSimple on my Android phone. I can initiate calls to PhonerLite and I can be called by PhonerLite. But I can't find any settings for Security (TLS, SRTP, ZRTP) in CSipSimple...

OK, I installed that version and now I could test with encryption.
As soon as I enable SRTP in CSipSimple that app doesn't answer any ZRTP requests. All ZRTP requests send by CSipSimple use incorrect checksums. I can verify this with Wireshark.
When SRTP is disabled in CSipSimple the checksums are correct. So I assume an error in CSipSimple.

If you fully trust your VoIP provider, TLS+SRTP is secure. But that server in the middle (VoIP provider) has to decrypt TLS to be able to route the call. So that server has access to the SRTP keys and therefore that server is able to decode the voice data (SRTP) too.
If you need end-to-end encryption of the voice data, you have to use ZRTP.