I tried to use TLS encryption, so I edited SIP profile "default" (Switch -> SIP Profiles -> default) and changed the value "tls" to "true". Then I restarted freeswitch service and could see that it listened for port 5061 TCP. But that port remained unavailable from outside the server, so TLS auth didn't work.
I found that it was due to firewall rules which were set up by ASTPP installation script. They denied all the ports except 5060, 80, 443 and some other. Port 5061 left closed.
Solution for that is
firewall-cmd --permanent --zone=public —add-port=5061/tcp
firewall-cmd --reload
I hope developers will add this in further releases.