Three messages you'll actually see

  • tls: handshake failure — usually a wrong SNI or disguise domain, or the node simply isn't running TLS.
  • x509: certificate signed by unknown authority — a self-signed certificate. Either put in the real domain, or tick skip certificate verification on that node.
  • certificate has expired — server side. Only the provider can fix it.
Sponsored Where does the subscription link come from? Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click. Get high-speed nodes

Your clock breaks handshakes too

A system clock off by more than a few minutes is enough to fail certificate validation. Hit "Sync now" once in Windows Date & time and a surprising number of handshake errors disappear.

Skipping verification isn't a fix

Ticking skip verification does get you connected, but it also drops your protection against a man in the middle. Fine while you diagnose; if you're going to keep using that node, ask for a real certificate.