This guide is for users who already have Trojan settings or a subscription from their own provider and want to check the configuration in Shadowrocket. First, distinguish the connection address, TLS identity, and authentication password, then review the Add Server fields. If you see a timeout, certificate error, or authentication failure, narrow down the issue by connection stage instead of changing every option at once.
The three layers of Trojan settings: connection, TLS, and authentication
A typical Trojan connection first reaches the server's specified port over TCP, then establishes a TLS session, and finally sends Trojan authentication details and proxy requests through the encrypted channel. So a reachable address doesn't mean TLS succeeded, and a successful TLS connection doesn't mean the password is correct. Check each of these three stages separately.
TLS protects data in transit and verifies the server's identity; the Trojan password is used for application-level authentication. They are not interchangeable. A valid server certificate doesn't mean the password is valid, and a correct password can't fix a certificate name mismatch. This guide covers common Trojan over TLS configurations. Follow your existing subscription or provider's instructions for any additional transport options.
Troubleshooting: identify the stage that failed first
If the certificate name is wrong, check the SNI and certificate before changing the password. If the connection keeps timing out, check the address, port, and current network first; leave TLS security options unchanged for now.
Add Server fields: how to enter the address, port, and password
From the top-right corner of Home, tap “+” to open Add Server, then set Type to Trojan and enter the details field by field. If an existing subscription has already created an entry, keep it for comparison. For manual checks, use a separate entry so subscription updates don't overwrite temporary changes. Field positions may change as the interface evolves; identify them by their English labels and purpose.
| Field | What to enter | Common mistakes |
|---|---|---|
| Type | Select Trojan to match the protocol in your existing configuration. | Checking only the entry name without confirming the actual protocol. |
| Address | The server domain name or IP address provided by your service provider. | Pasting the full subscription URL, or including https://, a path, and query parameters. |
| Port | The port the server is actually listening on, such as 443 or 8443. Use the value in your original settings. | Changing it to 443 just because TLS is enabled, or adding the port again in Address. |
| Password | The complete authentication password for this Trojan entry. | Using your provider account password, omitting symbols, or including leading or trailing spaces. |
| SNI | The TLS server name specified by your provider, usually a domain name. | Entering a URL, port, or an arbitrary website name. |
| Allow Insecure | Leave it off for normal use to keep certificate validation enabled. | Treating it as a universal fix for timeouts or incorrect passwords. |
For example, if your settings specify edge.example.com as the address and 8443 as the port, enter them in their respective fields. This domain is only an example of the field format, not a working server address. Don't replace the server's specified port just because HTTPS commonly uses 443 in browsers.
- Passwords are case-sensitive. Copy the complete value provided for this entry without shortening or changing it.
- When entering Password manually, use the original password. If you received an encoded share string, use the app's import feature rather than entering the encoded text as the password.
- A token in a subscription URL is used to retrieve subscription content; it isn't necessarily the Trojan password. Don't assume they are the same based on how they look.
SNI and TLS: why the connection address can be different
SNI is a server name extension in the TLS ClientHello. It lets a server hosting multiple sites at the same address select the appropriate certificate and site configuration. Address determines where the client connects; SNI helps select the name used during the TLS connection. In common setups, both are the same domain, but they can differ when Address is an IP or the server uses a specific entry point.
For example, if your existing settings specify an IP for Address and tls.example.com for SNI, keep them separate. Don't automatically change SNI to the IP or copy a domain from another entry because it “looks similar.” Certificate validation also checks the trust chain, expiration date, and name match. If the device clock is significantly off, a valid certificate may appear not yet valid or expired.
- Don't include a protocol prefix in SNI: enter a name such as
tls.example.com, nothttps://tls.example.com/path. - Don't include a port in SNI: enter the port in Port; don't use
tls.example.com:443. - Don't substitute an arbitrary name: changing it to a well-known website's domain won't give the server a matching certificate or guarantee a successful connection.
- If no separate SNI is provided, check the original settings first: don't assume that entering a domain in Address means every server accepts the same default behavior.
If your original settings include ALPN or other transport options, keep those consistent too. Don't apply an arbitrary combination from a troubleshooting guide to an existing entry. In particular, don't apply standard Trojan settings to a different protocol: the protocol determines authentication and transport, so changing Type alone doesn't convert a configuration.
From entry to verification: five checks in order
Before entering the details, have the original settings ready and note whether you're on Wi-Fi or cellular. For a meaningful test, use the same destination, network, and entry each time. If you change the password, SNI, and routing mode together, even a restored connection won't show which change fixed the issue.
-
Open the Add Server screen
Home → “+” in the top-right corner → Add Server → Type, then select Trojan. If you're using an existing subscription, compare its generated entry first to make sure the protocol is correct.
-
Enter the connection details
Enter Address, Port, and Password separately. After pasting, check for leading or trailing spaces, make sure Address has no URL path, and confirm Port matches the original settings.
-
Check TLS settings
Enter the SNI from the original settings, review the TLS options, and leave Allow Insecure off. Before saving, make sure the domain doesn't include a port.
-
Rule out routing effects
Return to Home and select the entry you just saved. For testing, you can temporarily set Global Routing to Proxy to make sure the test request uses that entry. Restore your original Config or Scene setting afterward.
-
Test actual access
Turn on the connection switch and complete any confirmation requested by the system. Then run Connectivity Test and visit an HTTPS page you normally use. Note the errors and what happens; don't rely only on whether the connection switch is on.
When Global Routing is set to Direct, requests may connect directly, so a webpage loading doesn't prove the Trojan settings are working. Config selects a policy based on the current rules, while Scene requires checking the settings for the active scene. Temporarily using Proxy reduces routing variables for testing; it doesn't mean you have to keep that mode for everyday use. See the Rules Manual for details on rule-based routing.
- A successful Connectivity Test reflects only the conditions of that test; it doesn't prove that every website or transport type will work.
- An enabled connection switch means the system has activated the relevant connection configuration; it doesn't mean remote authentication or every request has succeeded.
- When retesting on another network, keep the settings unchanged first. If only one network fails, check that network's connectivity before changing anything else.
Common symptoms: timeouts, certificate errors, and no access after connecting
Troubleshoot based on the actual error, not just the words “can't connect.” The steps below are checks, not definitive diagnoses: the same symptom can have several causes, so compare against the original settings and repeat the test to confirm.
The connection keeps timing out. Should I change the password first?
First check the selected entry's Address and Port on Home, then repeat the test on another available network. A domain that can't be resolved, an unreachable port, or an unresponsive server can all cause timeouts. Check the password only after confirming the server can be reached; a timeout alone doesn't show that the password is wrong.
I'm seeing a certificate error. How should I change SNI?
Open the entry for editing and compare the SNI spelling with the original settings. Then check the date, time, and time zone on your iPhone or iPad under Settings → General → Date & Time. If the certificate error persists, ask your own provider to investigate the error details instead of hiding the problem by turning on Allow Insecure.
Why won't webpages load even though a latency value appears?
The latency value depends on the test method and may not cover the full TLS handshake, Trojan authentication, and destination access. First make sure Global Routing isn't set to Direct, then run Connectivity Test. If the connection drops immediately after being established, also check the password and server status.
I fixed it manually, but the subscription update broke it again. Why?
A subscription update may regenerate entries and overwrite local changes. Compare the updated Address, Port, and SNI against the confirmed settings, and ask your own provider to correct the subscription. For temporary testing, use a separate manual entry rather than repeatedly editing the same subscription entry.
Save your findings and protect subscription details
When reporting an issue, record when it happened, the network type, the test method, and redacted error details. This is more useful for troubleshooting than sending the full configuration. Passwords and subscription URLs may contain credentials; in particular, don't share tokens in query parameters in public screenshots, group chats, or logs. Don't paste a real subscription URL into an unfamiliar website to test it.
- Note whether each field matches the original settings. Don't share the full password, subscription token, or an importable share string.
- Keep a private copy of a working configuration and note whether it was entered manually or created from an existing subscription, so you don't confuse entries.
- After testing, restore your usual Global Routing setting. If you changed Settings → On Demand while troubleshooting, restore it to suit your original needs.
- If your settings were exposed, use the management channel provided by your own service provider to replace the affected credentials, then update the local entry.
Shadowrocket is a closed-source commercial app. Purchasing the client and obtaining server access credentials are separate matters: a one-time app purchase does not include a service plan. This guide assumes you already have your own provider and subscription, and covers only how to check and use the settings.