This guide is for users who already have Trojan connection details from their provider and want to enter them manually in Shadowrocket. Check Address, Port, Password, SNI, and Allow Insecure one by one, then use the connection results to distinguish incorrect fields from TLS verification or routing issues. The sample address is for formatting only and cannot be used to connect.
How Trojan Connections Use TLS
Trojan establishes an encrypted connection using TLS. The client first connects to the specified server address and port, completes a TLS handshake with the server, then submits authentication details using the Trojan protocol. Address reachability, certificate validation, and password acceptance are separate checks. Seeing Shadowrocket's connection switch turned on does not confirm that all three have succeeded.
If you already have connection details from a provider, enter each field exactly as provided. Trojan is a protocol type; it does not mean every server uses the same domain, port, or SNI. In particular, don't confuse a display name or subscription link with the actual server Address.
For example, if your details specify server.example.com as the server and 443 as the port, the client must be able to reach port 443 at that address. The domain here is only a format example and does not point to a working service. If your actual port isn't 443, don't change it to 443. An incorrect port usually blocks the connection before authentication, while an incorrect password may come into play after the TLS handshake.
How to Fill In Each Add Server Field
To add a server from Home, set Type to Trojan, then enter the details you already have. Available options may vary by screen state. If your details include additional transport parameters, first confirm they belong to this Trojan configuration; don't apply parameters from another protocol.
| Field | What to Enter | Common Mix-Ups |
|---|---|---|
| Address | The server domain or IP address in your details, such as server.example.com. | Don't enter a subscription page URL or add https:// or a port here. |
| Port | The port the server actually listens on, such as 443 if specified in your details. | Don't assume the port must be 443 just because TLS is used. |
| Password | The authentication password for this Trojan server. | Check capitalization and leading or trailing spaces, and make sure no line break was copied along with the password. |
| SNI | The TLS server name specified in your details. If none is given, first check whether Address is the domain covered by the certificate. | SNI is the name used during the handshake, not a free-form label. |
| Allow Insecure | Controls whether TLS certificate verification is relaxed. Keep it off when performing normal verification. | Turning it on won't fix an incorrect Address, Port, or Password. |
The difference between using a domain and an IP for Address is especially important during TLS verification: certificates are usually issued for domain names. If your provider requires an IP address and supplies a separate SNI, enter the IP in Address and the specified domain in SNI. Don't substitute a similar-looking domain on your own; check your connection details to confirm which name the server accepts.
Add and Test a Trojan Server from Home
Manual entry works well when your connection details list each parameter separately. If you already have your own subscription link, you can also import it using the subscription option, but verify the resulting server against the original details. Don't use the subscription URL as the Trojan Address. The steps below cover manual entry and then check whether the connection works.
Add a Server
Open Home, tap “+” in the top-right corner to open Add Server, and set Type to Trojan. Confirm the protocol type before entering the other fields to avoid creating a server with the same name under the wrong type.
Enter the Address and Port
Enter the host name or IP from your details in Address, and the corresponding number in Port. For example, if your details say
server.example.com:443, enter the parts on either side of the colon in the two separate fields.Check the Authentication Details
Enter the password for this specific server in Password. If your details specify an SNI, enter it exactly as provided. Leave Allow Insecure off, save the server, then return to Home and select it.
Check the Connection
Turn on the connection from Home and run Connectivity Test. If it fails, check Address, Port, and Password first, then review SNI and certificate details. Don't judge whether the server is working by the switch alone.
Check the Routing Mode
Check Global Routing on Home. To troubleshoot a single server, you can temporarily select Proxy to test the proxy connection, then switch back to Config for everyday use with your configured rules. Direct does not send requests through the selected proxy server.
Before saving, compare each field side by side with the original details. Watch for full-width punctuation, spaces introduced when copying, and an extra slash at the end of a domain. If the same server is already imported from a subscription, there's no need to keep creating duplicates for troubleshooting. Compare the subscription entry with the manual entry—especially Address, Port, and TLS-related fields—to spot differences faster.
SNI and Allow Insecure: Understanding Certificate Verification
SNI is the server name sent during the TLS handshake, which lets the server select the right certificate. The client must also verify that the certificate is trusted and matches the expected name. Connecting to the correct IP does not automatically mean certificate verification will pass. Incorrect SNI, an expired certificate, or a server-side certificate configuration issue can all cause TLS errors.
Allow Insecure controls how strictly certificates are verified; it's not a general-purpose connection fix. If the connection works only when it's enabled, investigate whether the certificate and server name match—don't assume the original settings were correct. First ask your existing provider to confirm the SNI and certificate configuration, then decide what to do. Don't leave an unverified setting enabled just to bypass an error.
Allow Insecure Off
RecommendedVerifies the TLS certificate and corresponding name as usual. If verification fails, check Address, SNI, the device's date and time, and the server's certificate configuration.
Best for: Everyday connections and checking settings for the first time
Allow Insecure On
Relaxes certificate verification and may hide a name mismatch or certificate issue. It does not change the server address or replace the Trojan password.
Best for: Briefly comparing results when you understand the risk and have a specific troubleshooting goal
Troubleshooting order: Check the name before changing the switch
If you see a TLS verification error, first confirm that Address matches your connection details, check whether SNI is the specified domain, and verify the device's date and time. If the problem persists, check the server certificate rather than changing Allow Insecure first.
Keep the roles of SNI and Password distinct: SNI is used for the TLS connection and certificate name check, while Password is used for Trojan authentication. Changing SNI won't fix an incorrect password, and re-entering the password won't fix an expired certificate. Troubleshooting the relevant step is more effective than changing several fields at once.
Troubleshoot by Symptom
Change only one field at a time and note the Connectivity Test result before and after each change. First make sure the device can access the network, then check that the details for this server are still valid. If the server is managed through a subscription you already have, its parameters may change after an update. Compare the updated entry and avoid mixing old manual settings with new details.
Connection times out right after setup?
First check whether Address was mistakenly set to a subscription URL and whether Port matches your details. Then confirm that your current network can reach the server. If the timeout occurs while connecting, repeatedly changing Password usually won't fix an unreachable address or port.
Seeing a certificate or TLS error?
Check the device's date and time, SNI spelling, and the domain associated with Address. If connecting by IP, check whether your details specify a separate SNI. Keep Allow Insecure off and ask your existing provider to confirm the server's certificate status.
TLS connects, but the server still doesn't work?
Paste Password again, checking for capitalization, leading or trailing spaces, and line breaks. Then select the correct Trojan entry on Home and run Connectivity Test; don't rely on the connection switch alone.
Server selected, but websites still connect directly?
Check whether Global Routing on Home is set to Direct. You can temporarily switch to Proxy to test the server, then return to Config and check which rules apply. DIRECT and REJECT rules can also affect individual requests.
Why don't manual settings match after a subscription update?
Fields saved manually won't update automatically when a separate subscription entry changes. Compare the updated server's Address, Port, Password, and SNI, and confirm which entry you're testing. Import or update a subscription only with a link you already have.
If only some websites are inaccessible while Connectivity Test passes, the issue may not be with the Trojan settings. With Global Routing set to Config, rules such as DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL may route different requests through PROXY, DIRECT, or REJECT. Check the matching rules and policies. Switching to Proxy can help distinguish a routing issue from a server connection issue, but it shouldn't replace reviewing your rules for regular use.
Shadowrocket is a one-time purchase available through the App Store, developed by Shadow Launch Technology Limited. Buying the app and obtaining a connection service are separate matters. For system requirements on devices such as iPhone and iPad, refer to the App Store listing. To learn the basics of Home, Config, and Settings, start with the site's getting-started guide, then return here to review each Trojan field.
Check Where to Get Shadowrocket
First review how to verify the official App Store listing, then use the getting-started guide to learn the basics of adding a server and checking its connection.
Open the App Store Verification Guide View the Guide