Steps
- Find profiles using allowInsecure or Skip certificate verification and list the affected servers before changing them.
- Prefer a certificate from a trusted CA with the correct hostname and validity dates; verify client and server clocks.
- For a controlled private deployment, use the certificate SHA-256 pinning described by v2rayN and compare the fingerprint through a separate trusted channel.
- Disable the bypass one server at a time, test TLS logs and plan secure pin updates when certificates renew.
Why this matters
Encryption without identity verification remains vulnerable to a man-in-the-middle. A trusted certificate or verified pin supplies both confidentiality and identity.
How to verify
Connections work with allowInsecure off, while a wrong hostname, expired certificate or substituted certificate is rejected.
Things to watch
v2rayNG announced removal of the related option from 2026-08-01; consult the latest release notes for current status.