Proxy Protocols · Clash documentation

Trojan

Configure Trojan outbound proxies in the Clash ecosystem using current Mihomo fields, and verify passwords, mandatory TLS, SNI, certificates, Reality, UDP, and transport settings.

Read the articleBack to documentation home
  • password
  • TLS
  • SNI
  • Reality
  • UDP
Proxy Protocols

Trojan outbound fields

This page describes clients in the Clash ecosystem proxies Trojan outbound fields in the array. Trojan uses password authentication and requires TLS, so the client must match the server address, port, password, and TLS name.

The minimum configuration consists of four common required fields plus password . SNI may be left blank and fall back to the server address, but it usually needs to be specified when using a domain certificate, CDN, or Reality.

nameRequired
The node name, which must be unique within the configuration.
typeRequired
Set this to trojan。
serverRequired
The domain name or IP address of the Trojan server.
portRequired
The server listening port, commonly 443, but always use the server configuration.
passwordRequired
The Trojan server password. It must exactly match the value assigned by the server.

TLS, SNI, and certificate validation

Trojan always enables TLS in the current core; it does not depend on tls: true to become a TLS node. The fields below control the handshake name, ALPN, client fingerprint, and certificate validation.

sniOptional
The TLS server name. When left blank, it uses the server address. Domain certificates and CDN deployments usually require an explicit match.
alpnOptional
The TLS application protocol list. It must be compatible with both the server and the selected transport.
client-fingerprintOptional
A uTLS client fingerprint, such as chrome or random, not a certificate fingerprint.
fingerprintOptional
The SHA-256 fingerprint of the server certificate, which differs from client-fingerprint .
skip-cert-verifyUse with caution
Set to true skips certificate validation and should not be used as a long-term troubleshooting measure.
name-cert-verifyOptional
changes only the certificate DNSName validation target; it does not change the SNI that is sent.
certificate / private-keyOptional
Providing both enables client mTLS. Standard Trojan nodes usually do not need them.

Reality and other TLS wrappers

Reality, ShadowTLS, Restls, and JLS are all TLS connection-layer extensions. Add one only when the server explicitly supports it, and do not enable conflicting connection-layer configurations together.

reality-opts.public-keyReality
The public key corresponding to the server's Reality private key.
reality-opts.short-idReality
Provide one of the short IDs allowed by the server.
reality-opts.support-x25519mlkem768Optional
Declares support for X25519-MLKEM768 key exchange; the server must support it as well.
shadow-tls-optsFollow the server
Set the version and password only when the server uses ShadowTLS, and continue using sni as the handshake name.
restls-optsFollow the server
Set the password and TLS version hint only when the server uses Restls.
jls-optsFollow the server
Set the username and password only when the server uses JLS.

Choose a Trojan transport

Trojan currently lists only WebSocket and gRPC as optional transports. If network is omitted or set to another value, TCP is used.

Current Trojan transport values
networkRelated fieldsWhen to use it
tcpNo dedicated optsDefault transport
wsws-optsWebSocket path, Host, and Early Data
grpcgrpc-optsgRPC service name and connection parameters
networkOptional
Use only ws or grpc; all other values are handled as TCP.
ws-optsWebSocket
The path, Host, and Early Data fields must match the server or reverse proxy.
grpc-optsgRPC
grpc-service-name and the connection parameters must match the server.
smuxTCP only
Generic sing-mux applies only to TCP transport; do not confuse it with gRPC's own multiplexing.

UDP and the trojan-go AEAD extension

The UDP switch and trojan-go's Shadowsocks AEAD extension are independent. A standard Trojan node does not need ss-opts。

udpOptional
Common field; the default is false. Set it to true, and you must confirm that the server supports it.
ss-opts.enabledOptional
When the trojan-go server enables the Shadowsocks AEAD extension, set this to true。
ss-opts.methodDefault: aes-128-gcm
Available aes-128-gcm、aes-256-gcm or chacha20-ietf-poly1305。
ss-opts.passwordRequired when enabled
The trojan-go AEAD extension password must not be empty and does not replace the top-level password。

Base configuration and error checks

This example shows a standard Trojan over TLS node. If the server does not enable WebSocket, gRPC, Reality, or ss-opts , do not add those fields yourself.

  • Writing network as h2, assuming it is the same setting as alpn: [h2] .
  • The SNI, certificate validation name, and reverse-proxy domain do not match, causing the TLS handshake to fail.
  • Only ss-opts.passwordis provided, while omitting the required top-level Trojan password。
  • The server uses gRPC, but the client still connects over the default TCP transport, or grpc-service-name does not match.
YAML
proxies:
  - name: trojan-tls
    type: trojan
    server: edge.example.com
    port: 443
    password: your-trojan-password
    sni: origin.example.com
    alpn:
      - h2
      - http/1.1
    client-fingerprint: chrome
    udp: true
    network: tcp
Previous articleVLESSNext articleSnell