ihciah/shadow-tls

Health v2 · maintenance only

Adoption not part of the score

2681 stars · 292 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ShadowTLS is a TLS camouflage proxy written in Rust that relays a real TLS handshake with a valid certificate of your choice to the firewall, then switches to relaying encrypted proxy traffic. It is deployed on both sides of a firewall and is designed to be paired with an encryption proxy such as Shadowsocks, which it does not include itself.

Use cases

• hide proxy traffic behind a real TLS handshake with a trusted certificate
• bypass DPI and active probing of proxy servers
• use someone else's valid TLS certificate without signing your own
• pair with shadowsocks to build a censorship-resistant tunnel
• deploy a trojan-like proxy without managing certificates

When to choose

• you need TLS-level obfuscation that survives active probing and shows a real valid certificate
• you already run an encrypted proxy like shadowsocks and want to wrap it in TLS camouflage
• you deploy on Linux or macOS servers and clients with Docker or prebuilt binaries

When to avoid

• you need Windows support, which is not available due to the monoio runtime
• you want an all-in-one proxy with built-in encryption and request encapsulation
• you need a simple setup without deploying components on both sides of the firewall

Facets

service · maturity active

proxy security networking privacy censorship-circumvention networking security self-hosted cli tls-obfuscation anti-censorship shadowsocks-companion trojan-alternative rust io-uring linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ihciah/shadow-tls")