Shadowrocket Trojan Setup Guide: Password, SNI, and TLS Settings

1. What TLS and the password do in a Trojan connection

Trojan uses TLS to protect communication between the client and server, then authenticates the protocol within the encrypted connection. These fields serve different purposes: TLS verifies the identity of the server you connect to, while Password lets the server authenticate the connection request. A correct password cannot compensate for a certificate identity mismatch, and disabling certificate verification cannot fix an incorrect password.

A connection typically proceeds through DNS resolution, a TCP connection, the TLS handshake, Trojan authentication, and finally access to the destination. If an earlier step fails, later steps cannot complete. For a timeout, check the address and port first. For a certificate error, check SNI, the certificate, and the device's date and time instead of repeatedly re-entering the password.

2. Add a Trojan server from Home → Add Server

Before entering the settings manually, gather the server address, port, password, certificate domain, and any transport parameters specified by the server. If you already imported a subscription, use that entry as a reference. Don't infer settings from a server name's location or protocol abbreviation alone.

1. Open Add Server

   Go to Home and tap “+” in the top-right corner to open Add Server. Create a clearly named test entry and keep the existing configuration so you don't lose the original settings while troubleshooting.

2. Choose the protocol

   Open Type, select Trojan, then return to Add Server. The protocol must match the server; don't enter a password or identifier from another protocol in a Trojan entry.

3. Enter the server details

   Enter Address and Port exactly as shown in the original configuration. Put only the hostname or IP address in Address, and enter the port number separately. Don't paste an entire share link into Address.

4. Check authentication

   Enter Password and SNI, and leave TLS certificate verification enabled. If the configuration specifies a transport or other TLS settings, check each one against the original instructions rather than guessing.

5. Save and test

   After saving, return to Home, select the new entry, and connect. First confirm that the entry connects, then check how Global Routing affects access.

Use Home to select a connection entry and control the connection, Config to manage routing rules, and Settings to configure the app. Changing routing rules in Config won't fix an incorrect password in a Home entry; test those issues separately.

3. What to enter in Address, Port, and Password

Address specifies the connection endpoint. A hostname must be resolved through DNS first; an IP address is used directly. Port specifies which service to reach at that endpoint. Even with the correct address, a wrong port can cause a timeout or connection refusal—or connect to a service that isn't Trojan.

Don't transform the Password value

Password is the authentication secret set on the server—not a note you can make up, or an identifier that must follow a particular format. When entering it manually, use the original password from your service provider; don't calculate a digest or encode it again. If you only have a share link, use an import method supported by the app instead of extracting a segment and guessing what to enter.

• After copying, check the beginning and end carefully, especially for line breaks, spaces, and easily confused characters.
• If the password contains special characters, distinguish escaped characters in the link from the actual field value. Don't treat them as interchangeable.
• Don't include full passwords, subscription tokens, or other sensitive data in screenshots, feedback, or public logs.

4. SNI and certificates: the endpoint can differ, but the server identity must be verifiable

SNI (Server Name Indication) is a TLS extension that tells the server which hostname the client wants to reach during the handshake. A single endpoint can host multiple TLS sites, so the server uses SNI to select the appropriate certificate or route. As a result, Address and SNI may match in some configurations and differ in others. Don't change them to the same value just because they differ.

For example, a configuration may use an IP address for Address and tls.example.com for SNI. This means the client connects to that IP and uses the specified hostname in the TLS handshake. The hostname must match the server configuration, and the certificate must pass the corresponding name and trust-chain checks. Replacing it with a popular website's domain won't make the certificate valid.

• Format: Enter a hostname for SNI. Don't include https://, :443, or /path.
• Hostname: Check whether the certificate's Subject Alternative Name covers the expected server name. Don't rely only on the organization name shown on the certificate.
• Date and time: On your iPhone, go to “Settings → General → Date & Time” and check that the time is correct. An incorrect date may cause a certificate to appear not yet valid or expired.
• Blank SNI: If the original configuration doesn't specify SNI, first confirm which name the server expects and how the app handles a blank value. Don't try unrelated domains.

SNI is not a password and cannot, on its own, prove that a server is trustworthy. Traditional TLS SNI is generally not confidential, so entering an SNI value does not add another layer of authentication. TLS verifies server identity through the complete certificate validation process. If the server certificate has expired or its chain is incomplete, the server operator must fix it.

5. TLS and Allow Insecure: keep verification enabled; don't use a toggle to hide errors

TLS is fundamental to Trojan's design. Don't treat it as an optional speed setting or turn it off just to test a connection. If the interface offers settings such as TLS version, ALPN, or transport, leave the defaults unless the original configuration explicitly specifies otherwise. The client and server must support compatible settings; adding more values doesn't necessarily improve compatibility.

Allow Insecure relaxes server certificate verification; it doesn't enable a compatibility protocol. Bypassing certificate checks weakens the client's ability to verify the server's identity, even if traffic remains encrypted. It won't fix an incorrect address, a blocked port, or a wrong password.

If the server also uses a transport wrapper such as WebSocket, check its associated settings as well. WebSocket Host and Path are separate from TLS SNI; don't copy the same value into all three fields by default. The basic settings in this guide don't replace explicit instructions from the server operator for these additional parameters.

6. Troubleshoot by symptom; latency alone isn't proof of a working connection

A latency test only shows whether the test method received a response. A successful TCP connection doesn't mean the Trojan password was accepted, and a latency value doesn't guarantee that a particular website will load. When troubleshooting, note the test method, network, error message, and stage of failure, then change one setting at a time.

If the underlying connection and TLS both succeed but authentication then fails or the connection closes immediately, check Password, the server account status, and whether the transport settings match. Exact errors depend on the server implementation; “disconnected” alone doesn't prove the password is invalid. When reporting an issue, include the error description but hide passwords, subscription links, the full endpoint, and other identifying details.

7. Final checks before and after saving

After checking the settings, test one connection before returning to your normal routing setup. Proxy, Direct, Config, and Scene in Global Routing are different routing modes, not different Trojan encryption methods; switching modes doesn't change the entry's SNI or password. If you use Scene, check its active settings too so you don't mistake a scene change for a protocol problem.

• Endpoint matches: Address has no extra prefix or path, and Port matches the original configuration exactly.
• Authentication matches: Password hasn't been re-encoded and contains no extra spaces or line breaks.
• TLS verifies: The source of SNI is clear, the certificate name and validity period are correct, and Allow Insecure is off.
• Correct entry selected: Home is set to the entry you just tested, not another one with a similar name.
• Routing restored: Restore Global Routing after temporary tests. If using Config, check which policy is actually matched.
• Subscription remains maintainable: If the settings come from an existing subscription, confirm that the next update will still provide the correct configuration.

Shadowrocket is a closed-source commercial app for Apple platforms, primarily used on iPhone and iPad. The App Store is the only way to get it, and the app is sold as a one-time purchase. Buying the app does not include a connection service. Check the App Store listing for system requirements and whether the purchase is universal. Before installing, use the authenticity check page to verify the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118.