VoIP.infoThe independent guide to business communications.
VoIP.info Guide

SIP over WebSocket and WSS

Separate the browser signaling transport from the media transport when connecting a web softphone.

Reviewed 2026-10-16RFC 7118 and Asterisk documentation reviewed October 5, 2026; no browser, proxy, PBX or call laboratory validationIntermediateDocumentation based · not lab tested

What travels over the socket

RFC 7118 defines the sip WebSocket subprotocol for SIP requests and responses. The client handshake requests sip in Sec-WebSocket-Protocol and the server’s successful 101 response selects it. One SIP message occupies one WebSocket message; SIP can use text or binary frames, so a binary frame alone is not evidence of audio.

This SIP socket does not carry ordinary voice packets. Browser WebRTC media has a separate path. Other WebSocket applications can carry media: Asterisk’s chan_websocket is a separate application-media driver, rather than a SIP endpoint transport. Use the Asterisk integration guide to distinguish SIP, ARI control and application-media sockets.

A successful handshake proves the selected transport and subprotocol, not registration, route authorization, negotiated media or audible conversation.

WebRTC signaling and media take different paths
The browser exchanges signaling with an application or SIP service. Its media peer is a PBX or other endpoint. ICE can select a direct media path or a path through a TURN relay.

Logical connections, shown in one direction for clarity. Media and signaling are bidirectional. TURN relays encrypted packets; the negotiated media peer terminates DTLS-SRTP.

Check the web boundary

Confirm the expected hostname, path, certificate chain and WebSocket upgrade behavior. A reverse proxy must pass the upgrade correctly and keep long-lived connections usable. Its idle timeout can cause apparently random registration or incoming-call failures even when a short HTTP request works. Avoid embedding a shared administrator or trunk credential in downloaded JavaScript. The application needs an endpoint identity with limited permissions and a deliberate session-expiry strategy. Browser application authentication and SIP digest authentication may be separate exchanges.

Retain the selected subprotocol and response headers alongside the requested URL. A generic WebSocket tester connecting without the intended sip negotiation is not a complete SIP client acceptance test.

Isolate a failed call

  • WSS never opens: inspect DNS, certificate validation, upgrade response and proxy policy.
  • WSS opens but REGISTER fails: inspect SIP challenge handling and endpoint authorization.
  • Registration works but calls fail: inspect INVITE responses, routing and SDP.
  • Call answers without sound: inspect ICE, DTLS and media statistics.
  • Keep those results in one timeline. Reloading the page may recover a socket while erasing the evidence of why it failed. Capture the state before reconnecting, then verify an incoming call after the connection has been idle for the period that previously triggered the problem.

A SIP WebSocket is not a chan_websocket media pipe

SIP over WSS carries SIP messages with the sip subprotocol. The Asterisk media WebSocket guide covers a different WebSocket/... channel whose binary frames carry application media and whose text frames carry driver control events.

Place the Asterisk HTTP listener before SIP-over-WebSocket evidence

The built-in HTTP service guide keeps HTTPS identity and WebSocket route registration separate from SIP authentication, SDP and media.

Watch the explanation

Can I use SIP for WebRTC signaling?Tsahi Levent-Levi · 1:03 · Conceptual

Answers one common question quickly: WebRTC does not choose your application signaling, and browser-based SIP uses a browser-compatible transport such as WebSocket.

Read applicability and editorial notes →
Watch this video here

A conceptual explanation published in 2025; pair it with the SIP-over-WebSocket reference. Review used the available transcript and primary references; audio and screen readability remain unverified.

Open on YouTube ↗

The player loads only when you choose Watch here. Playback uses YouTube’s privacy-enhanced embed; YouTube processes playback data.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Examples require adaptation to your topology. No live PBX or hardware testing is claimed.

Continue your research

Guide · WebRTC standards; browser and server behavior must be checked by version

ICE: candidate gathering, checks and the selected path

Understand how WebRTC finds a usable media route and what an ICE failure actually narrows down.

Read guide →
Guide · Asterisk 22 documentation and RFC 7118 reviewed October 5, 2026; installed patch version and modules must be checked; no PBX or call laboratory validation

Asterisk WebRTC: distinguish SIP, ARI and media WebSockets

Identify the correct WebSocket service, certificate owner and PJSIP media settings before accepting a browser call.

Read guide →
Reference · SIP standards; extension support depends on both peers

SIP digest authentication: challenges, realms and algorithms

Investigate repeated authentication challenges while keeping credentials out of traces and configuration examples.

Read guide →
Guide · Current Asterisk WebSocket channel-driver, branch-22 module, WebSocket-client, Dial, ARI and official example records reviewed October 9, 2026; the release archive lists Asterisk 22.11.0 as the latest final 22-series release and 22.12.0-rc2 as a pre-release, and no host, module, socket, application, channel, frame, media stream, protected session, performance result, compatibility claim or call was inspected or tested

Asterisk media over WebSocket: channel, control and flow boundaries

Use chan_websocket without confusing application media with SIP-over-WebSocket or ARI control, and preserve version, framing and backpressure evidence.

Read guide →
Diagnostic · Current Asterisk WebSocket channel-driver, branch-22 module, WebSocket-client, Dial, ARI and official example records reviewed October 9, 2026; the release archive lists Asterisk 22.11.0 as the latest final 22-series release and 22.12.0-rc2 as a pre-release, and no host, module, socket, application, channel, frame, media stream, protected session, performance result, compatibility claim or call was inspected or tested

Asterisk WebSocket media is silent, one-way or disconnected

Trace one chan_websocket call through version, connection, channel, frame type, codec sizing and flow control before changing SIP or ARI.

Read guide →
Asterisk · Current Asterisk built-in HTTP-server, ARI, AMI and network-security documentation plus the maintained http.conf, ari.conf and manager.conf samples reviewed October 16, 2026; the reviewed sources establish listener, prefix, TLS, URI, authentication and access-control boundaries but do not establish one installed Asterisk version, loaded module set, certificate chain, reverse proxy, firewall, client, application or successful request, and no PBX, configuration, listener, socket, certificate, credential, HTTP request, WebSocket, channel, packet, media stream or live call was inspected or tested

Asterisk built-in HTTP and HTTPS server: binding, TLS and service evidence

Operate Asterisk’s built-in web service by separating the listener, TLS identity, URI registration, dependent module, authentication and application result.

Read guide →
Troubleshooting · Current Asterisk built-in HTTP-server, ARI, AMI and network-security documentation plus the maintained http.conf, ari.conf and manager.conf samples reviewed October 16, 2026; the reviewed sources establish listener, prefix, TLS, URI, authentication and access-control boundaries but do not establish one installed Asterisk version, loaded module set, certificate chain, reverse proxy, firewall, client, application or successful request, and no PBX, configuration, listener, socket, certificate, credential, HTTP request, WebSocket, channel, packet, media stream or live call was inspected or tested

Asterisk HTTP or HTTPS endpoint is unreachable or returns the wrong service

Trace the exact Asterisk web endpoint from effective configuration and listener state through TCP, TLS, prefix, URI ownership, authentication and application response.

Read guide →