How to Add a Trojan Server in Shadowrocket: Password, SNI, and TLS Settings

1. How Trojan works: TLS first, then password authentication

In Shadowrocket, Trojan is a proxy protocol. A typical connection first opens a TCP connection to the server address and port, then completes a TLS handshake. Authentication details and destination requests are sent through the encrypted tunnel. TLS protects traffic and verifies the server’s identity; the Trojan password verifies whether the user is authorized to access the service. These serve different purposes.

A correct password does not guarantee that TLS will succeed, and a successful TLS handshake does not guarantee that the account is still valid. Connection failures can result from an unresolved address, an unreachable port, a certificate name mismatch, or an incorrect password, each at a different stage. Troubleshoot in the order above rather than changing every setting at once.

Port 443 is common, but it is not required by the protocol and does not indicate whether a service is available. If your provider specifies another port, such as 8443, enter it exactly as given. This guide does not provide or recommend servers, subscriptions, or providers. Get any subscription URL from your own provider.

2. Gather your settings first: Address and SNI are different

Address tells the client where to connect. It can be a domain name or an IP address. SNI is the server name sent during the TLS handshake, commonly used to select the correct site and certificate. In typical client configurations, it also determines which server name to verify. If the interface has a separate certificate verification name, fill it in as your provider instructs. Do not treat the connection address, SNI, and a Host field for an additional transport layer as interchangeable.

For example, if the connection address is an IP but the certificate was issued for a domain, SNI should usually be the certificate domain specified by your provider. Conversely, an Address that is already a domain is not necessarily the correct SNI. Valid certificate names are determined by details such as the certificate’s Subject Alternative Name; you cannot simply enter the domain of any reachable website.

3. Home → Add Server: enter and save settings

Adding a server manually makes it easier to check a single entry and identify which field differs from a subscription import. The steps below use the English interface labels. Available fields can vary by platform and transport type, so fill in only fields that are visible and clearly specified by your provider.

1. Open Home, tap the add button in the top-right corner, and select Add Server. Set Type to Trojan, then check the protocol-specific fields shown.
2. In Address, enter the server hostname or IP. Remove any spaces, line breaks, or protocol prefix accidentally included when copying. Do not paste the entire share link into the address field.
3. Enter the specified port in Port. If your provider lists 443, enter 443; do not switch to 80 just because the connection times out. Changing the client setting cannot make a server listen on a port it does not use.
4. Paste the server’s authentication password into Password. Check for leading or trailing spaces, capitalization, and symbols. Do not mistake a token in the subscription URL for the password.
5. Check TLS and SNI. Enter only the hostname for SNI. If your provider specifies additional transport settings, check those too; do not reuse settings from another server.
6. Keep certificate verification enabled, save the server, and return to Home. Select the entry you just saved. On the first connection, follow the system prompt to allow a VPN configuration.

Do not change rules in Config before testing. First confirm that the individual server can connect on the current network, then check whether the rules send requests through the intended route. This keeps server setting issues separate from rule-matching issues.

4. After importing a subscription, check the server’s actual settings

If your provider has given you a subscription, import it using the Subscribe type in Add Server instead of rebuilding each entry manually. A subscription distributes server details in bulk, but it cannot guarantee that addresses, certificates, or account status remain valid. A successful import means the client retrieved and parsed the data; it does not mean every server has passed a connection test.

• Get the subscription URL from your provider and copy it in full into the subscription URL field. Do not remove query parameters or add spaces.
• After updating, expand the relevant group, find the Trojan entry you want to use, and open it for editing. Check Type, Address, Port, Password, and SNI.
• If a manually corrected entry works but reverts after the next update, ask your provider to fix the subscription source. Repeated local edits cannot correct upstream data.
• To keep a comparison entry, you can create a separate manual test entry and label its purpose. Remove it when you are done to avoid selecting an outdated entry by mistake.

Trojan, Shadowsocks, VMess, VLESS, Hysteria2, and WireGuard use different field definitions. Changing Type to Trojan does not make credentials from another protocol valid. If a subscription imports an unexpected protocol type, check the original details and import method instead of guessing from the port number.

5. Troubleshoot connection failures by stage: network, TLS, authentication, and routing

A latency result in Home reflects only the connection path covered by that test. A result does not necessarily mean the destination website will load completely, and a timeout alone does not prove the password is wrong. Check the connection log, try accessing the destination, and compare results on another network. The table below lists troubleshooting clues, not definitive causes for every failure.

A significantly incorrect device clock can affect certificate validity checks. On iPhone / iPad, go to system Settings → General → Date & Time and check Set Automatically. This is a system setting, not a menu in Shadowrocket. Reconnect after correcting the time; do not hide the cause by ignoring certificate errors.

6. Once the server works, check Global Routing and Config

The server settings determine how to connect to a proxy server; Global Routing and Config determine which requests use it. Temporarily selecting Proxy can help rule out routing as the cause, but it is not a universal long-term setting. Restore your original setup after the comparison and verify the result with actual requests.

• Proxy: Use this to test the overall proxy route, making sure the newly verified server is selected.
• Direct: Requests connect directly. Successful access does not prove the Trojan settings are correct.
• Config: Requests follow the rules and policies in the current configuration. Check which rule matches and which policy it targets.
• Scene: Applies the behavior configured for the current scene. When troubleshooting, check the active scene; it is not a fourth proxy protocol.

In Config, DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP uses IP geolocation categories, and FINAL is the fallback rule. Rules are matched from top to bottom. If a request matches an earlier DIRECT rule, selecting a working proxy later will not change that match. Back up your configuration before editing, and do not replace the entire file with isolated examples.

Settings → On Demand mainly controls automatic connections when specified conditions are met. It does not fix a Trojan password, certificate, or server port. If a manual connection fails, troubleshoot the server first. If manual connections work but automatic connections do not behave as expected, check the On Demand conditions separately.

7. Trojan settings: frequently asked questions