From 11bd52b6a53530bcf916f71d600837b8290fa4f0 Mon Sep 17 00:00:00 2001
From: DHR60 <192860629+DHR60@users.noreply.github.com>
Date: Wed, 19 Aug 2026 01:56:38 +0000
Subject: [PATCH] Fix (#9987)

---
 v2rayN/ServiceLib/Handler/Fmt/Hysteria2Fmt.cs | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/v2rayN/ServiceLib/Handler/Fmt/Hysteria2Fmt.cs b/v2rayN/ServiceLib/Handler/Fmt/Hysteria2Fmt.cs
index a3304938..8e12ecf4 100644
--- a/v2rayN/ServiceLib/Handler/Fmt/Hysteria2Fmt.cs
+++ b/v2rayN/ServiceLib/Handler/Fmt/Hysteria2Fmt.cs
@@ -166,15 +166,19 @@ public class Hysteria2Fmt : BaseFmt
         }
         if (item.CertSha.IsNullOrEmpty())
         {
-            item.CertSha = GetQueryDecoded(query, "pinSHA256");
-            // NOTE:
-            // To accommodate Xray changes,
-            // some providers issue self-signed cert links with `insecure = false` and a certificate fingerprint,
-            // breaking interoperability between Xray, official Hysteria 2 client, and sing-box.
-            // Since this won't compromise the overall security model,
-            // `insecure = true` is automatically set when a fingerprint is detected,
-            // and the value is restored when generating configurations.
-            item.AllowInsecure = Global.StringTrue;
+            var pinSHA256 = GetQueryDecoded(query, "pinSHA256");
+            item.CertSha = pinSHA256;
+            if (!pinSHA256.IsNullOrEmpty())
+            {
+                // NOTE:
+                // To accommodate Xray changes,
+                // some providers issue self-signed cert links with `insecure = false` and a certificate fingerprint,
+                // breaking interoperability between Xray, official Hysteria 2 client, and sing-box.
+                // Since this won't compromise the overall security model,
+                // `insecure = true` is automatically set when a fingerprint is detected,
+                // and the value is restored when generating configurations.
+                item.AllowInsecure = Global.StringTrue;
+            }
         }
         item.EchConfigList = GetQueryDecoded(query, "ech");
         item.SetProtocolExtra(item.GetProtocolExtra() with