AnyTLS

Protocol scope and minimum configuration

AnyTLS is a TLS over TCP outbound type provided by the current Mihomo core. It does not use QUIC and has no port-hopping fields. A minimum node consists of the common name, type, server, port, and server password.

password must match the server's user configuration.udp When true, the client carries UDP requests through UDP over TCP; it does not change the underlying connection to UDP.

nameRequired

The node name used to identify this outbound in policy groups and rules.

type: anytlsRequired

Selects Mihomo's AnyTLS outbound implementation. Original Clash does not recognize this type.

server / portRequired

Enter the server host and listening port; the port must be a single integer.

passwordAuthentication

Enter the password configured for this user on the server. An empty value works only if the server explicitly permits it.

udpOptional

Enables UDP request support, carried through UDP over TCP within the AnyTLS connection.

TLS, SNI, and certificate validation

AnyTLS always establishes a TLS connection. If sni is omitted, the client uses server as the TLS Server Name. If server is an IP address, you generally need a domain-form SNI that matches the server certificate.

sniTLS

Sets the server name used in the handshake; when omitted, it falls back to server.

alpnTLS

Enter the ALPN list supported by the server, such as h2 and http/1.1. Do not change it based solely on client preference.

client-fingerprintTLS

Select a client TLS fingerprint, such as chrome. This is not the same as certificate fingerprint validation.

skip-cert-verifyRisk

When true, skips standard certificate validation. Use it only when you understand the risks.

name-cert-verifyTLS

Specifies a separate certificate-name validation target; it does not change the connection address.

fingerprintTLS

Pins the server certificate fingerprint.

certificate / private-keymTLS

Provide both when the server requires a client certificate.

ech-optsOptional

Uses ECH to hide the real SNI in ClientHello; the exact fields follow the current core's common TLS configuration.

Scope of Reality and security wrappers

AnyTLS can use ECH, ShadowTLS, ResTLS, or JLS to reduce exposed TLS characteristics, but these features are not aliases for Reality.

shadow-tls-optsWrapper

Enter the ShadowTLS version and password. They must match the server.

restls-optsWrapper

Enter the ResTLS password and, if supplied by the server, version-hint.

jls-optsWrapper

Enter the JLS username and password.

Mutual-exclusion ruleImportant

The current implementation allows only one of ShadowTLS, ResTLS, and JLS. Selecting more than one prevents the node from being created.

Idle-session parameters

AnyTLS multiplexes streams over one or more TLS connections. These three session parameters, measured in seconds, control inspection and cleanup; they are not QUIC windows and do not affect TLS certificate validation.

idle-session-check-intervalDefault: 30 seconds

The interval between idle-session checks.

idle-session-timeoutDefault: 30 seconds

During each check, closes sessions idle longer than this value.

min-idle-sessionDefault: 0

The minimum number of idle sessions retained during a check; increasing it keeps more connections open.

Minimum working example

Start with the password, SNI, and ALPN actually provided by the server. Then add ECH or one security wrapper only if needed. The session fields already have defaults and usually do not need to be repeated.

proxies:
  - name: anytls-node
    type: anytls
    server: server.example.com
    port: 443
    password: replace-with-server-password
    udp: true
    sni: server.example.com
    client-fingerprint: chrome
    alpn:
      - h2
      - http/1.1

Common misconfigurations

A configuration that parses as YAML does not mean its protocol parameters are interchangeable. If AnyTLS cannot connect, reduce it to the minimum configuration first.

• Copying from a VLESS node reality-optsproduces a combination that the current core explicitly does not support.
• server Entering an IP address without also setting the certificate's snicauses certificate-name validation to fail.
• Enabling two or more of ShadowTLS, ResTLS, and JLS causes an error while the node is being created.
• Blindly increasing session-check parameters as a performance multiplier instead retains more idle connections.