VXVX Docs

TLS

TlsConfig and Certificate

Protos:

Set on TransportConfig.tls, MultiProxyInboundConfig.securityConfigs[].tls, Hysteria2 tlsConfig, and SplitHTTP downloadSettings.tls.

Mutually exclusive with reality (only one per transport block).

TlsConfig

certificates
Certificate[]

Server/client certificate chain

rootCas
bytes[]

Custom root CA PEM (each entry is a PEM byte blob)

issueCas
Certificate[]

CAs used to issue certificates to peers

serverName
string

SNI; defaults to the target domain when dialing

disableSystemRoot
bool

Do not use system root CAs

allowInsecure
bool

Skip certificate verification (client)

nextProtocol
string[]

ALPN list (e.g. h2, http/1.1)

enableSessionResumption
bool

Enable TLS session tickets / resumption

pinnedPeerCertificateChainSha256
bytes[]

Pinned peer certificate chain SHA-256 hashes (each entry is 32 bytes)

verifyClientCertificate
bool

Require a valid client certificate (server)

imitate
string

uTLS client fingerprint name (e.g. chrome)

noSNI
bool

Do not send SNI (uTLS)

forceAlpn
ForceALPN

ALPN behavior; see ForceALPN

masterKeyLog
string

NSS key log path (debugging)

echKey
bytes

Server ECH key

echConfig
bytes

Client ECH config blob

enableEch
bool

Client: enable ECH

ForceALPN

TRANSPORT_PREFERENCE_TAKE_PRIORITY
0

Use user-configured ALPN if set; otherwise transport default

NO_ALPN
1

Do not send ALPN extension

UTLS_PRESET
2

Use uTLS preset ALPN

Certificate

Certificates and private keys can be inline PEM bytes or loaded from file paths (paths take precedence over inline).

certificate
bytes

PEM certificate bytes

key
bytes

PEM private key bytes

certificateFilepath
string

Certificate file path

keyFilepath
string

Private key file path

{
  "transport": {
    "tcp": {},
    "tls": {
      "serverName": "example.com",
      "certificates": [
        {
          "certificateFilepath": "/etc/vx/fullchain.pem",
          "keyFilepath": "/etc/vx/privkey.pem"
        }
      ],
      "nextProtocol": ["h2", "http/1.1"]
    }
  }
}
  • REALITY — alternative security layer mutually exclusive with TLS
  • WebSocket / gRPC — commonly paired with TLS on port 443
  • VLESS Vision — flow with TLS or REALITY

Comments

On this page

TlsConfigForceALPNCertificateRelated