Shadowrocket Trojan Setup: Password, SNI, and TLS

Why Trojan parameters need to be checked separately

Trojan uses TLS to protect communications between the client and server, then handles protocol authentication and forwarding over that connection. Standard Trojan usually runs over TCP. A successful TLS handshake does not mean the Password has been authenticated or that the destination website is reachable. Check each of these three stages separately.

The server address determines where the connection goes; the port identifies which service on the server to connect to; SNI supplies the server name during the TLS handshake; and Password is used for Trojan authentication. These values may come from the same parameter list, but they are not interchangeable. In particular, do not use a token from a subscription link, an account login password, or a UUID for another protocol as the Trojan Password.

Enter each field in Add Server

The steps below use the manual setup flow from Home. Form layouts may vary by platform, but the fields serve the same purposes. If your subscription already provides all these parameters, use the supplied values. Change a field manually only when your service provider specifically asks you to add or correct it.

1. Open the form

   Go to Home → tap “+” in the top-right corner → Add Server, then select Trojan under Type. Confirm the protocol type first; do not infer it just because the server name contains “TLS.”

2. Enter the address

   Enter the hostname or IP supplied by your service provider in Address, and the specified port in Port. For example, if the port is 443, enter only 443 in Port. Do not include https://, a path, or a trailing slash in Address.

3. Enter the password

   Paste the password for this Trojan server into Password. Check capitalization, leading or trailing spaces, and line breaks. Do not alter the characters or convert the raw password to URL-encoded text in advance.

4. Check TLS settings

   Open the TLS settings in the form and check SNI and certificate verification against your provider’s instructions. If they also specify ALPN, a transport method, or WebSocket parameters, match each value exactly; do not copy settings from another server.

5. Save and test

   After saving, return to Home and select the server you just added. To rule out routing rules, temporarily set Global Routing to Proxy, turn on the connection, and visit a known-working HTTPS page. Restore your usual routing settings when the test is complete.

How to enter Address, Password, and SNI

The examples below use reserved example domains to show the field formats. gateway.example.com and tls.example.com are not service addresses provided by this guide. Address and SNI do not have to match: some deployments use a separate connection endpoint but require the TLS handshake to specify another name covered by the certificate.

SNI and HTTP Host are separate fields. If your service provider uses WebSocket transport, they may also provide a Host and Path. Path may start with /, while SNI does not include a path. For standard Trojan, do not enable WebSocket or add a guessed Path unless the provider specifies additional transport settings.

• Password contains special characters: When entering it directly in Password, use the original value. If importing from a share link, let the import process handle decoding; do not decode or encode it again manually.
• Address is an IP: You may still need to enter a domain name as SNI to match the server certificate. Do not change SNI to the IP just because Address is an IP.
• SNI not provided: Do not enter a well-known website domain at random. Check the complete original subscription parameters or ask your provider whether the address domain should be used as the server name.

Changing the password will not fix TLS verification

TLS certificate verification confirms the identity of the remote server and typically checks the certificate’s trust chain, validity period, and name. Reaching the server does not mean its certificate matches the current SNI. An incorrect device date or time zone can also make a valid certificate appear not yet valid or expired.

SNI usually influences which certificate the server presents, while the client checks whether that certificate covers the expected name. The two are related, but entering any domain does not simply “enable encryption.” An incorrect Password is a later authentication issue; repeatedly changing it will not fix a certificate name mismatch.

ALPN negotiates the application-layer protocol; it is not a general-purpose speed boost. If your provider has not specified it, leave the default setting unchanged. Do not force h2 or http/1.1. Likewise, do not weaken TLS settings just to clear an error. Check the server’s requirements first.

After connecting, check routing and the server separately

Turning on the connection switch on Home starts the client’s connection process; it does not guarantee that every request goes through the selected Trojan server. Under Global Routing, Direct sends requests directly; Config routes them according to the enabled configuration; Proxy can temporarily rule out the effects of routing rules. Scene settings should also be checked when relevant, but avoid introducing them as an extra variable during initial troubleshooting.

1. First select the Trojan server you want to test on Home. Then temporarily choose Global Routing → Proxy, reconnect, and visit a fixed test page.
2. If the page works under Proxy but behaves differently under Config, open Config and inspect the active configuration and its [Rule] section. Do not change SNI right away.
3. Check whether a rule matches DIRECT, and which server or policy group is actually selected for requests routed to PROXY.
4. To rule out automatic reconnection, check the current Settings → On Demand settings. On Demand controls connection triggers; it does not fix Trojan authentication parameters.

For example, the rules below send only the example domain and its subdomains through PROXY; unmatched requests go through DIRECT. This illustrates rule syntax only—it is not a set of connection parameters or a complete configuration. Rules are matched in order, and FINAL should be placed last. Before using the rules, confirm that the active configuration selects the intended proxy policy.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

With this configuration, it is expected that you will not see Trojan traffic when visiting other websites. Certificate errors should usually be investigated through TLS settings, while a specific website bypassing the proxy should be investigated through rule matching. Confusing the two can lead you to repeatedly break parameters that were already correct.

Common errors and subscription overrides

During troubleshooting, note when the error occurred, the current network, the selected server, and the Global Routing setting. Then review any available connection diagnostics. The symptoms below are troubleshooting branches, not definitive diagnoses based on a single error message; the same “timeout” can occur at different stages.

If your service provider gave you a subscription rather than a single server, go to Home → “+” → Type → Subscribe to import your own link, then return to Home and update the subscription. The example link https://example.com/sub?token=xxxx shows the format only and cannot be used to connect. Before sharing troubleshooting screenshots, hide Password, the subscription token, and the full subscription URL. When reporting an issue, include only field names, the error type, and the necessary redacted context.

Checklist before asking for troubleshooting help

Complete one controlled test before deciding whether to contact your service provider. Do not change the network, server, SNI, and rules all at once, or the problem will be difficult to reproduce. Keep the test page the same for comparisons, and confirm that you have not selected a similarly named server from a subscription.

• Connection endpoint: Address and Port match the original details; no webpage URL was pasted into the address field.
• Authentication: Type is Trojan, Password belongs to this server, and contains no extra spaces or line breaks.
• TLS settings: SNI and certificate verification match the provider’s requirements, the device date is correct, and no ALPN was added without instruction.
• Transport settings: WebSocket, Host, and Path are configured only when explicitly required by the original parameters.
• Test conditions: Compare actual behavior under Proxy and Config, and confirm whether requests match the intended policy.
• Update source: Distinguish manual entries from subscription entries, and check whether the next subscription update will overwrite local changes.

Once the parameters are confirmed, restore Global Routing to your usual setting and recheck the active configuration in Config. For details on field structure, see the configuration fields guide; to understand routing modes, see the proxy modes guide. Correct protocol parameters, a trusted certificate identity, and requests matching the intended rules are three separate requirements.