VLESS-WebSocket

How it works

• WebSocket over TCP, wrapped in TLS (often self-signed).
• Subscription ships UUID, path and SNI; can share the same account UUID as Reality.
• Self-signed TLS needs skip-cert-verify / allowInsecure in Clash / sing-box.

When to use it

• You need a CDN hop (edge 443 → origin 8443) or only TCP remains usable.
• UDP/QUIC is blocked but TCP WebSocket still works.

When to skip it

If direct Reality works and you do not need CDN, skip WS.

Clients

sing-box, v2rayN, Clash Meta, Shadowrocket and other VLESS+WS clients.