Index: pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c
===================================================================
--- pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c	(revision 3171)
+++ pjproject/trunk/pjsip-apps/src/pjsua/pjsua_app.c	(revision 3172)
@@ -179,5 +179,6 @@
     puts  ("  --use-ims           Enable 3GPP/IMS related settings on this account");
 #if defined(PJMEDIA_HAS_SRTP) && (PJMEDIA_HAS_SRTP != 0)
-    puts  ("  --use-srtp=N        Use SRTP?  0:disabled, 1:optional, 2:mandatory (def:0)");
+    puts  ("  --use-srtp=N        Use SRTP?  0:disabled, 1:optional, 2:mandatory,");
+    puts  ("                      3:optional by duplicating media offer (def:0)");
     puts  ("  --srtp-secure=N     SRTP require secure SIP? 0:no, 1:tls, 1:sips (def:1)");
 #endif
@@ -1093,7 +1094,13 @@
 	case OPT_USE_SRTP:
 	    app_config.cfg.use_srtp = my_atoi(pj_optarg);
-	    if (!pj_isdigit(*pj_optarg) || app_config.cfg.use_srtp > 2) {
+	    if (!pj_isdigit(*pj_optarg) || app_config.cfg.use_srtp > 3) {
 		PJ_LOG(1,(THIS_FILE, "Invalid value for --use-srtp option"));
 		return -1;
+	    }
+	    if ((int)app_config.cfg.use_srtp == 3) {
+		/* SRTP optional mode with duplicated media offer */
+		app_config.cfg.use_srtp = PJMEDIA_SRTP_OPTIONAL;
+		app_config.cfg.srtp_optional_dup_offer = PJ_TRUE;
+		cur_acc->srtp_optional_dup_offer = PJ_TRUE;
 	    }
 	    cur_acc->use_srtp = app_config.cfg.use_srtp;
@@ -1504,6 +1511,18 @@
     /* SRTP */
     if (acc_cfg->use_srtp) {
-	pj_ansi_sprintf(line, "--use-srtp %i\n",
-			(int)acc_cfg->use_srtp);
+	int use_srtp = (int)acc_cfg->use_srtp;
+	if (use_srtp == PJMEDIA_SRTP_OPTIONAL && 
+	    acc_cfg->srtp_optional_dup_offer)
+	{
+	    use_srtp = 3;
+	}
+	pj_ansi_sprintf(line, "--use-srtp %i\n", use_srtp);
+	pj_strcat2(result, line);
+    }
+    if (acc_cfg->srtp_secure_signaling != 
+	PJSUA_DEFAULT_SRTP_SECURE_SIGNALING) 
+    {
+	pj_ansi_sprintf(line, "--srtp-secure %d\n",
+			acc_cfg->srtp_secure_signaling);
 	pj_strcat2(result, line);
     }
@@ -1737,6 +1756,11 @@
 #if PJMEDIA_HAS_SRTP
     if (app_config.cfg.use_srtp != PJSUA_DEFAULT_USE_SRTP) {
-	pj_ansi_sprintf(line, "--use-srtp %d\n",
-			app_config.cfg.use_srtp);
+	int use_srtp = (int)app_config.cfg.use_srtp;
+	if (use_srtp == PJMEDIA_SRTP_OPTIONAL && 
+	    app_config.cfg.srtp_optional_dup_offer)
+	{
+	    use_srtp = 3;
+	}
+	pj_ansi_sprintf(line, "--use-srtp %d\n", use_srtp);
 	pj_strcat2(&cfg, line);
     }
Index: pjproject/trunk/pjsip/include/pjsua-lib/pjsua.h
===================================================================
--- pjproject/trunk/pjsip/include/pjsua-lib/pjsua.h	(revision 3171)
+++ pjproject/trunk/pjsip/include/pjsua-lib/pjsua.h	(revision 3172)
@@ -1084,4 +1084,14 @@
      */
     int		     srtp_secure_signaling;
+
+    /**
+     * Specify whether SRTP in PJMEDIA_SRTP_OPTIONAL mode should compose 
+     * duplicated media in SDP offer, i.e: unsecured and secured version.
+     * Otherwise, the SDP media will be composed as unsecured media but 
+     * with SDP "crypto" attribute.
+     *
+     * Default: PJ_FALSE
+     */
+    pj_bool_t	     srtp_optional_dup_offer;
 #endif
 
@@ -2127,4 +2137,14 @@
      */
     int		     srtp_secure_signaling;
+
+    /**
+     * Specify whether SRTP in PJMEDIA_SRTP_OPTIONAL mode should compose 
+     * duplicated media in SDP offer, i.e: unsecured and secured version.
+     * Otherwise, the SDP media will be composed as unsecured media but 
+     * with SDP "crypto" attribute.
+     *
+     * Default: PJ_FALSE
+     */
+    pj_bool_t	     srtp_optional_dup_offer;
 #endif
 
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_acc.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_acc.c	(revision 3171)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_acc.c	(revision 3172)
@@ -752,4 +752,5 @@
     acc->cfg.use_srtp = cfg->use_srtp;
     acc->cfg.srtp_secure_signaling = cfg->srtp_secure_signaling;
+    acc->cfg.srtp_optional_dup_offer = cfg->srtp_optional_dup_offer;    
 #endif
 
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c	(revision 3171)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_core.c	(revision 3172)
@@ -176,4 +176,5 @@
     cfg->use_srtp = pjsua_var.ua_cfg.use_srtp;
     cfg->srtp_secure_signaling = pjsua_var.ua_cfg.srtp_secure_signaling;
+    cfg->srtp_optional_dup_offer = pjsua_var.ua_cfg.srtp_optional_dup_offer;
 #endif
     cfg->reg_retry_interval = PJSUA_REG_RETRY_INTERVAL;
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_media.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_media.c	(revision 3171)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_media.c	(revision 3172)
@@ -1369,4 +1369,44 @@
 	return status;
     }
+
+#if defined(PJMEDIA_HAS_SRTP) && (PJMEDIA_HAS_SRTP != 0)
+    /* Check if SRTP is in optional mode and configured to use duplicated
+     * media, i.e: secured and unsecured version, in the SDP offer.
+     */
+    if (!rem_sdp &&
+	pjsua_var.acc[call->acc_id].cfg.use_srtp == PJMEDIA_SRTP_OPTIONAL &&
+	pjsua_var.acc[call->acc_id].cfg.srtp_optional_dup_offer)
+    {
+	unsigned i;
+
+	for (i = 0; i < sdp->media_count; ++i) {
+	    pjmedia_sdp_media *m = sdp->media[i];
+
+	    /* Check if this media is unsecured but has SDP "crypto" 
+	     * attribute.
+	     */
+	    if (pj_stricmp2(&m->desc.transport, "RTP/AVP") == 0 &&
+		pjmedia_sdp_media_find_attr2(m, "crypto", NULL) != NULL)
+	    {
+		pjmedia_sdp_media *new_m;
+
+		/* Duplicate this media and apply secured transport */
+		new_m = pjmedia_sdp_media_clone(pool, m);
+		pj_strdup2(pool, &new_m->desc.transport, "RTP/SAVP");
+
+		/* Remove the "crypto" attribute in the unsecured media */
+		pjmedia_sdp_media_remove_all_attr(m, "crypto");
+
+		/* Insert the new media before the unsecured media */
+		if (sdp->media_count < PJMEDIA_MAX_SDP_MEDIA) {
+		    pj_array_insert(sdp->media, sizeof(new_m), 
+				    sdp->media_count, i, &new_m);
+		    ++sdp->media_count;
+		    ++i;
+		}
+	    }
+	}
+    }
+#endif
 
     /* Update currently advertised RTP source address */
