When the log says certificate and the node dies the moment you select it, the node is usually fine - the TLS handshake is failing over a name mismatch.

Read the log first

Set Log Level to debug, reconnect once, and read the actual line on the Logs page. An untrusted chain, an expired certificate and a name that does not match the host you dialled are three different problems with three different fixes. How to read those lines is covered in Common Error Messages Decoded.

Sponsored Where does the subscription link come from? Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click. Get high-speed nodes

Fix the SNI before touching verification

Two fields decide which hostname is announced during the handshake:

proxies:
  - name: "example"
    type: trojan
    server: 1.2.3.4
    port: 443
    password: "xxxx"
    sni: node.example.com
    skip-cert-verify: false

For vmess and vless over ws or grpc the equivalent field is servername. It should carry the domain printed on the certificate, not the node's IP address. Providers leaving the SNI out of a generated config is extremely common; filling it in fixes the error without weakening anything. Field placement is shown in The YAML Config, Section by Section.

The price of disabling verification

skip-cert-verify: true means "accept the certificate no matter who issued it or whose name is on it". A self-hosted node with a self-signed certificate genuinely needs it, but be clear about the cost: anyone in the middle can present their own self-signed certificate and impersonate your node, and the client will not warn you.

  • Self-hosted with a self-signed certificate - fine, though a free Let's Encrypt certificate costs nothing and removes the need.
  • A commercial provider telling you to enable it - ask what the SNI should be first. A properly configured service should not need the switch.
  • Everything times out rather than failing on a certificate - wrong track, see When Every Node Times Out.