Skip to content

# ShadowTLS

Changes in sing-box 1.12.0

wildcard_sni

### Structure

    {
      "type": "shadowtls",
      "tag": "st-in",

      ... // Listen Fields

      "version": 3,
      "password": "fuck me till the daylight",
      "users": [
        {
          "name": "sekai",
          "password": "8JCsPssfgS8tiRwiMlhARg=="
        }
      ],
      "handshake": {
        "server": "google.com",
        "server_port": 443,

        ... // Dial Fields
      },
      "handshake_for_server_name": {
        "example.com": {
          "server": "example.com",
          "server_port": 443,

          ... // Dial Fields
        }
      },
      "strict_mode": false,
      "wildcard_sni": ""
    }

### Listen Fields

See Listen Fields for details.

### Fields

#### version

ShadowTLS protocol version.

Value | Protocol Version
--- | ---
`1` (default) | ShadowTLS v1
`2` | ShadowTLS v2
`3` | ShadowTLS v3

#### password

ShadowTLS password.

Only available in the ShadowTLS protocol 2.

#### users

ShadowTLS users.

Only available in the ShadowTLS protocol 3.

#### handshake

Required

When `wildcard_sni` is configured to `all`, the server address is optional.

Handshake server address and Dial Fields.

#### handshake_for_server_name

Handshake server address and Dial Fields for specific server name.

Only available in the ShadowTLS protocol 2/3.

#### strict_mode

ShadowTLS strict mode.

Only available in the ShadowTLS protocol 3.

#### wildcard_sni

Since sing-box 1.12.0

ShadowTLS wildcard SNI mode.

Available values are:

- `off`: (default) Disabled.
- `authed`: Authenticated connections will have their destination overwritten to `(servername):443`
- `all`: All connections will have their destination overwritten to `(servername):443`

Additionally, connections matching `handshake_for_server_name` are not affected.

Only available in the ShadowTLS protocol 3.