Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: bookworm-slim runtime missing ca-certificates → all HTTPS outbound fails (regression from 2cd23957c0) [1 pull requests, 3 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#72787•Fetched 2026-04-28 06:32:10
View on GitHub
Comments
3
Participants
3
Timeline
10
Reactions
0
Author
ryuhaneulryuhaneul
Participants
ryuhaneulryuhaneulsteipetesteipetevincentkocvincentkoc
Assignees
vincentkocvincentkoc
Timeline (top)
commented ×3closed ×2labeled ×2assigned ×1

After commit 2cd23957c0 (build: use slim docker runtime, Apr 26 2026), the Docker runtime image is built without the ca-certificates package, leaving /etc/ssl/certs/ empty and every HTTPS outbound from the gateway fails at TLS handshake with error setting certificate file: /etc/ssl/certs/ca-certificates.crt.

Error Message

After commit 2cd23957c0 (build: use slim docker runtime, Apr 26 2026), the Docker runtime image is built without the ca-certificates package, leaving /etc/ssl/certs/ empty and every HTTPS outbound from the gateway fails at TLS handshake with error setting certificate file: /etc/ssl/certs/ca-certificates.crt.

  • curl https://api.telegram.org/ → (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt
  • error setting certificate file: /etc/ssl/certs/ca-certificates.crt curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt

Root Cause

Root cause

Fix Action

Fixed

PR fix notes

PR #72788: fix(docker): install ca-certificates in slim runtime base

Description (problem / solution / changelog)

Summary

Fixes the regression introduced in 2cd23957c0 ("build: use slim docker runtime", PR-less direct push), which switched the runtime base to node:24-bookworm-slim without adding ca-certificates to the apt-install list. The result is an image with an empty /etc/ssl/certs/ and broken HTTPS for every outbound call from the gateway.

Closes #72787

Root cause

  • bookworm (full) ships with ca-certificates; bookworm-slim does not.
  • The runtime stage's apt-get install line was not updated when the base was swapped.
  • curl and openssl are present but no CA bundle exists — every HTTPS call dies at TLS handshake with error setting certificate file: /etc/ssl/certs/ca-certificates.crt.

Fix

Add ca-certificates to the apt-install list and call update-ca-certificates.

Verification (rebuilt runtime image, exec inside gateway container)

beforeafter
ls /etc/ssl/certs/ | wc -l0285
curl -4 https://api.telegram.org/(77) error setting certificate file302
curl -4 https://www.google.com/same200
telegram/discord/slack plugin registercrash-loop with Network request for 'deleteWebhook' failed!clean
gateway main-thread CPU~100% (retry loop)idle

Test plan

  • Build runtime image, verify /etc/ssl/certs/ populated
  • HTTPS outbound returns expected codes from inside the gateway
  • Channel plugins (telegram/discord/slack) register cleanly with no retry loop
  • Gateway main-thread CPU returns to idle
  • CI build / smoke pipeline passes (please run)

Changed files

  • Dockerfile (modified, +4/-0)

Code Example

$ docker compose exec -T openclaw-gateway curl -4 -v --max-time 5 https://www.google.com/
*   Trying 142.251.150.119:443...
* Connected to www.google.com (142.251.150.119) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error setting certificate file: /etc/ssl/certs/ca-certificates.crt
* Closing connection 0
curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt

---

$ docker exec --user root openclaw-gateway sh -c \
    'apt-get update && apt-get install -y --no-install-recommends ca-certificates && update-ca-certificates'
$ docker compose exec -T openclaw-gateway curl -4 -s -o /dev/null \
    -w '%{http_code}\n' https://api.telegram.org/
302

---

procps hostname curl git lsof openssl
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

After commit 2cd23957c0 (build: use slim docker runtime, Apr 26 2026), the Docker runtime image is built without the ca-certificates package, leaving /etc/ssl/certs/ empty and every HTTPS outbound from the gateway fails at TLS handshake with error setting certificate file: /etc/ssl/certs/ca-certificates.crt.

Steps to reproduce

  1. Clone openclaw/openclaw at any commit ≥ 2cd23957c0.
  2. Run ./scripts/docker/setup.sh to build openclaw:local.
  3. docker compose up -d openclaw-gateway
  4. Inside the container: curl -v https://api.telegram.org/

Expected behavior

The previous runtime image (built 2026-03-13 from the bookworm base) shipped with 285 cert symlinks under /etc/ssl/certs/ and HTTPS worked. Channel plugins that use node fetch (telegram/discord/slack) registered cleanly.

Actual behavior

  • ls /etc/ssl/certs/ | wc -l → 0
  • dpkg -l ca-certificates → un (not installed)
  • update-ca-certificates not present in $PATH (exit code 127)
  • curl https://api.telegram.org/ → (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt
  • curl http://1.1.1.1/ → 301 (HTTP path works; only TLS is broken)
  • All channel plugins (telegram/discord/slack) crash-loop with Network request for 'deleteWebhook' failed! and pin the gateway main thread at ~100% CPU on retry.

OpenClaw version

2026.4.25 (built from main HEAD c1d827844c)

Operating system

Rocky Linux 9.7 (kernel 5.14.0-611.16.1.el9_7), x86_64

Install method

docker (./scripts/docker/setup.sh)

Model

google/gemini-3.1-pro-preview (irrelevant — problem is at the TLS transport layer)

Provider / routing chain

openclaw → external HTTPS APIs (telegram, discord, slack, openai-codex, anthropic, google) — every chain blocked at TLS handshake.

Additional provider/model setup details

NOT_ENOUGH_INFO

Logs, screenshots, and evidence

$ docker compose exec -T openclaw-gateway curl -4 -v --max-time 5 https://www.google.com/
*   Trying 142.251.150.119:443...
* Connected to www.google.com (142.251.150.119) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error setting certificate file: /etc/ssl/certs/ca-certificates.crt
* Closing connection 0
curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt

Comparison:

imagebase/etc/ssl/certs/ countHTTPS
openclaw:local (built from c1d827844c, after 2cd23957c0)node:24-bookworm-slim0fails
openclaw:rollback-2026-04-27 (built from earlier commit, 2026-03-13)node:24-bookworm (full)285works

Manual verification of the fix inside the broken container:

$ docker exec --user root openclaw-gateway sh -c \
    'apt-get update && apt-get install -y --no-install-recommends ca-certificates && update-ca-certificates'
$ docker compose exec -T openclaw-gateway curl -4 -s -o /dev/null \
    -w '%{http_code}\n' https://api.telegram.org/
302

Impact and severity

High. Affects every Docker user on main ≥ 2cd23957c0. All HTTPS outbound (telegram/discord/slack/openai-codex/anthropic/google) is broken; channel plugins crash-loop; gateway main thread hits ~100% CPU on retry.

Additional information

Root cause

Commit 2cd23957c0 switched the runtime base from node:24-bookworm (full) to node:24-bookworm-slim. The bookworm-slim base does not ship ca-certificates by default. The runtime stage's apt-get install line installs:

procps hostname curl git lsof openssl

but ca-certificates is missing. With curl and openssl present but no CA bundle, every HTTPS call dies at TLS handshake.

Suggested fix

Add ca-certificates to the apt-install list and call update-ca-certificates. PR follows shortly.

extent analysis

TL;DR

Add ca-certificates to the apt-get install list and run update-ca-certificates to fix the TLS handshake issue.

Guidance

  • The issue is caused by the missing ca-certificates package in the Docker runtime image, which is built from the node:24-bookworm-slim base.
  • To verify the fix, run docker exec --user root openclaw-gateway sh -c 'apt-get update && apt-get install -y --no-install-recommends ca-certificates && update-ca-certificates' and then test HTTPS connectivity using curl.
  • The ca-certificates package should be added to the apt-get install line in the runtime stage, along with the existing packages (procps hostname curl git lsof openssl).
  • After applying the fix, verify that the /etc/ssl/certs/ directory is populated with the expected certificate symlinks.

Example

# Add ca-certificates to the apt-install list and call update-ca-certificates
docker exec --user root openclaw-gateway sh -c \
    'apt-get update && apt-get install -y --no-install-recommends ca-certificates && update-ca-certificates'

# Test HTTPS connectivity using curl
docker compose exec -T openclaw-gateway curl -4 -s -o /dev/null \
    -w '%{http_code}\n' https://api.telegram.org/

Notes

The fix assumes that the node:24-bookworm-slim base image does not include ca-certificates by default. If this is not the case, further investigation may be necessary.

Recommendation

Apply the suggested fix by adding ca-certificates to the apt-get install list and running update-ca-certificates, as this directly addresses the root cause of the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

The previous runtime image (built 2026-03-13 from the bookworm base) shipped with 285 cert symlinks under /etc/ssl/certs/ and HTTPS worked. Channel plugins that use node fetch (telegram/discord/slack) registered cleanly.

#api#ssr#installation#API versioning#request timeout

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: bookworm-slim runtime missing ca-certificates → all HTTPS outbound fails (regression from 2cd23957c0) [1 pull requests, 3 comments, 3 participants]