...

If both proxies have enabled TLS and clients let you add the sips: "prefix" you don't need to add special routing logic to cfg. Even if client itself does'n use TLS it can work (EyeBeam - TCP – > OB SER – TLS – >SER – ?? - > client)
Remember that TLS is done only on hop by hop basis.
To be sure or to define tls peers you need to do following:

OpenSER proxy configuration:

...

        # check for requests targeted out of our domain
        if (!uri==myself) {
                # mark routing logic in request
                append_hf("P-hint: outbound\r\n");
                # destination DomainA
                if(uri=~"@domainA.net") {
                        t_relay("tls:sipserver.domainA.net:5061");
                        xlog("L_INFO", "Time [%Tf] Route to ces.net :%rm RURI:%ru  FROM:%fu TO:%tu \n buffer %mb \n flags \n %mf \n");
                        exit;
                }
                route(1);
        };

...

Validation, confirmation tests

• register a UA at the proxy of domainA
• register a UA at the proxy of domainB
• make a call from UA 'A' to UA 'B' and see if it succeeds
• check in the UA and proxy logging whether TLS was used (and there was no fallback to UDP)
  

OS specific help

Reminder: this example is based on a compiled version of openSER where the config is in /usr/local/etc/openser and the certificates are in /usr/local/etc/openser/tls/user, which might differ when installed from packages.