Shadowrocket · WLOC setup tutorial

Set up WLOC on Shadowrocket, step by step, with certificate trust explained

Shadowrocket is the first client we test against at WLOC, and honestly, its module format is the most finicky of the bunch. Commas have to be tight — no spaces allowed. Miss one and the whole thing silently breaks. This guide walks you through the real order: module first, then the certificate dance (it is a two-step, and most people stop halfway), then scoping HTTPS to exactly two hosts, then proving it works, then cleaning up.

Before you start

WLOC installed from the App Store (needs a non-mainland-China Apple ID).
Shadowrocket installed from the App Store ($2.99, one-time purchase).
A secondary iPhone is ideal — not your daily driver with banking apps.
Stable Wi-Fi for the first setup. Cellular works too but Wi-Fi is more predictable.

Step 1: Import the WLOC module into Shadowrocket

Open WLOC and copy the module URL: https://wloc.app/modules/wloc.module. In Shadowrocket, tap the + button (top-right), choose Module, and paste the URL. Shadowrocket downloads and activates it immediately. You should see WLOC Control Center in the Module list with a green checkmark.

Three scripts included: settings bridge, route control, response patch. Plus the MitM host list. No manual editing needed.
Shadowrocket uses comma-tight syntax. WLOC handles this. If editing manually, keep commas tight with no extra spaces.

Step 2: Enable HTTPS Decryption and set the host scope

Shadowrocket Settings → HTTPS Decryption → toggle ON. First time: tap Generate CA. Under Domains, add: gs-loc.apple.com and gs-loc-cn.apple.com (one per line).

Never use * or leave the list empty. This limits decryption to exactly Apple WPS servers.
After CA generation, iOS shows a Profile Downloaded notification. Do not tap it yet.

Step 3: Install and trust the CA certificate — two steps, both required

This is the step everyone messages support about. Generating the CA is step one. Step two: iOS does not trust it yet. Settings → General → VPN & Device Management → find the profile → Install → enter passcode. Then — critical — Settings → General → About → Certificate Trust Settings → find the Shadowrocket CA → toggle ON. iOS warns you. That is normal.

Step A: Settings → General → VPN & Device Management → Install profile.
Step B: Settings → General → About → Certificate Trust Settings → toggle ON.
Skip step B and diagnostics will say HTTPS not found. Every single time.

Step 4: Verify with a test target

Back in WLOC, pick a test target. A park. A plaza. Somewhere obviously not your house. Run diagnostics. Patch count above zero? Congratulations — it works. Zero? The CA trust is almost certainly the culprit. Go back to Step 3.

Patch count > 0 is your proof. Mode: active means the bridge is functional.
VPN icon showing but patch count is zero? Check the CA trust first. Always.

Step 5: Restore: clear target, disable HTTPS, revoke CA

WLOC: clear target, confirm passthrough. Shadowrocket: toggle HTTPS Decryption OFF. iOS Settings: General → VPN & Device Management → Remove Profile. Then About → Certificate Trust Settings → confirm CA is gone. Reopen your target app and verify real location is back.

Order matters: clear target first, then disable HTTPS, then remove profile.
Forgetting the CA profile means your device keeps trusting a certificate you generated.

Common gotchas

VPN icon shows but diagnostics say HTTPS not found

CA generated but not trusted. Settings → General → About → Certificate Trust Settings → toggle ON. This is the #1 support request.

Module imported but scripts not running

Force-close Shadowrocket, reopen, toggle the module OFF and ON. If still broken, delete and re-import from the URL.

FAQ

Do I need to regenerate the CA every time?

No. Once generated, installed, and trusted, it stays until you remove the profile or switch devices.

Why does Shadowrocket need a CA certificate?

Apple WPS traffic is HTTPS-encrypted. To inspect and modify the location response, Shadowrocket must decrypt and re-encrypt it locally. The CA is the cryptographic key. Scoping it to exactly two hosts keeps it safe.