When setting up Trojan in Shadowrocket, first check the Address, Port, Password, and SNI provided by your service provider, then review TLS certificate verification and transport settings. This guide is for users with server details who need to add or correct an entry manually. Follow the steps in order to distinguish address, authentication, certificate, and routing issues without repeatedly toggling settings.
Trojan and TLS: Connection vs. authentication
Trojan typically carries proxy requests over a TLS connection. The client first connects to the server address and port, completes the TLS handshake and certificate verification, then authenticates Trojan with the Password. Certificate verification and Password authentication are separate steps: a correct password cannot fix a certificate name mismatch, and a valid certificate does not guarantee that the password is correct.
Use the server details you already have for manual setup. Get subscription links from your service provider. If you already have a subscription, check the imported entry first rather than guessing the protocol from the server name. A name containing “TLS” or “443” alone does not mean you should select Trojan as the Type.
Add Server: Enter the server details in order
Have the complete server details ready, including the required transport method. The steps below show manual setup; labels may vary by interface language, so English interface terms are retained here. If your provider gave you a subscription link, import it through Subscribe rather than entering the entire link as the Address.
-
Open the add-server screen
Go to Home, tap “+” in the upper-right corner to open Add Server, and select Trojan under Type. Choose the Type first, then fill in its fields to avoid entering authentication details for another protocol in this form.
-
Enter the connection destination
Enter the hostname or IP address from your provider in Address, and the corresponding port in Port. For example, Address could be
edge.example.comand Port443. These are format examples only, not a working server. -
Enter the authentication details
Enter the Trojan password exactly as provided in Password, checking capitalization, symbols, and any leading or trailing spaces. Do not use a token from a subscription URL, a server label, or your website login password as the Trojan password.
-
Check TLS settings
Set SNI to the value provided by your service provider and leave Allow Insecure off. If transport-related fields are also provided, check each one; do not skip them just because the port is 443.
-
Save and test
Use the page’s save action to return to Home, select the new entry, and enable the connection. First test the connection and a known accessible webpage, then check how your everyday Config routes traffic.
How to enter Address, Port, Password, and SNI
Address specifies where to connect; SNI declares the server name during the TLS handshake. They are often the same, but do not have to be. In particular, if Address is an IP address, do not assume SNI should be that IP. Use the certificate name and other details explicitly provided by your service provider.
| Field | What to enter | Common mistakes |
|---|---|---|
| Address | The server hostname or IP address, such as edge.example.com |
Including https://, a path, or query parameters, or pasting the entire share link |
| Port | The port the server actually listens on, such as 443 or another value specified by your provider |
Changing it to 443 just because TLS is used, or entering full-width digits |
| Password | The Trojan authentication password, entered exactly as provided | Adding a line break, omitting a symbol, or using credentials for another protocol |
| SNI | The TLS server name provided by your service provider, such as tls.example.com |
Entering a URL, port, or path, or using a domain unrelated to the certificate |
SNI is not a field for arbitrarily substituting a destination website name, and it is not the same as the HTTP Host. With transports such as WebSocket, Host, Path, and SNI belong to different layers. Even when they look like domains or paths, enter each according to the provided settings. A basic Trojan setup does not necessarily require WebSocket; do not enable extra transport options on your own.
Troubleshooting order: check the fields before changing connection settings
An IP address for Address and a domain for SNI can be a valid configuration. If you see a certificate error, first check SNI, the device’s date and time, and the server certificate. Do not start by changing Address to a domain you guessed.
Allow Insecure: Keep certificate verification enabled
Allow Insecure affects TLS certificate verification; it does not fix passwords, ports, or network connectivity. When off, the client verifies the server certificate. Turning it on skips related checks and weakens assurance that you are connecting to the intended server. It is not a speed setting or a general fix for connection failures.
Allow Insecure off
RecommendedKeep TLS certificate verification enabled. If a certificate error occurs, check the certificate’s validity period, trust chain, name match, and device time, and ask your service provider to confirm the server configuration.
Best for: Everyday use and Trojan connections with valid certificates
Allow Insecure on
This skips certificate verification checks, so you cannot confirm that the connection reaches the intended server. Even if the connection then succeeds, that only suggests the verification step needs investigation; it does not mean the issue has been properly fixed.
Best for: Briefly diagnosing certificate verification issues in a controlled environment, after understanding the risks
If the connection works with this setting on but fails with it off, turn it off again and report the specific certificate error to your service provider. Do not send your full Password or subscription link when troubleshooting; provide only the error text, when it occurred, and redacted field details.
Saved but can’t connect: Check the connection layer by layer
A successful save only means the form was accepted; it does not confirm that the remote server is reachable. Change one setting at a time and note the result. Do not change the port, password, SNI, and Global Routing all at once; otherwise, even if the connection starts working, you will not know what fixed it.
- Connection timed out: First confirm that your current network can load regular webpages, then check whether Address resolves and whether Port matches the value from your provider. A timeout does not automatically mean the Password is wrong—the connection may not have reached the authentication stage.
- TLS handshake or certificate error: Check the spelling of SNI, the device’s date and time, and whether the server certificate covers that name. An expired certificate or a problem with the trust chain must be fixed on the server side.
- Authentication failed or the connection drops quickly: Recheck Password, Type, and transport settings. A disconnection alone does not prove the password is wrong; use the error information shown in the app to narrow it down.
- Connected, but some webpages fail to load: Check Home → Global Routing. Direct bypasses the proxy, so it is not suitable for testing the Trojan proxy. Temporarily use Proxy to rule out routing rules, then restore your everyday Config.
Config processes traffic according to its current configuration and policies, so check which policy the relevant rules actually point to rather than looking only at the selected entry on Home. Scene depends on the selected scene settings; it is not another name for Proxy. During troubleshooting, identify the active mode first to avoid mistaking a policy selection issue for a Trojan field error.
Common questions about manual Trojan setup
My provider gave me a link. Should I split it into fields?
First, tell apart a subscription link and a link for a single server. Get subscription links from your service provider, then add them through Home → “+” → Type → Subscribe. Do not enter a subscription URL as the Trojan Address or use a token from the link as the Password.
No SNI was provided. Can I enter any domain?
No. Check the original server details for a specified server name. If none is provided, ask your service provider whether to use the name corresponding to Address and which name the certificate requires. Do not try a popular website domain or turn on Allow Insecure instead of confirming the correct value.
I changed an entry from my subscription, but it reverted after an update. Why?
A subscription update may replace settings with the values supplied by your provider. First check whether the subscription source contains the incorrect value. For comparison, you can create a separate entry manually while keeping the original subscription entry; this avoids mistaking a temporary local change for a server-side fix.
I bought Shadowrocket. Why do I still need a password?
Buying the app does not include a server plan. Password is the Trojan authentication credential from your existing service provider, not your App Store purchase information. Shadowrocket is a closed-source commercial app sold as a one-time purchase through the App Store; access to a server and the app purchase are managed separately.
Final check: Type is Trojan; Address has no protocol prefix or path; Port matches the server; Password is unchanged; SNI matches your provider’s requirements; and Allow Insecure is off. Once these are checked, return to Config to review rules and policies, avoiding repeated changes to unrelated settings.