Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix CLI shows http:// and ws:// URLs when gateway.tls.enabled is true (bind: lan) [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#60458•Fetched 2026-04-08 02:50:57
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
lhtplutolhtpluto
Participants
lhtplutolhtpluto

When gateway.tls.enabled: true with custom cert/key and gateway.bind: "lan", the CLI (openclaw onboard, openclaw status) displays http:// and ws:// URLs instead of https:// and wss://.

Error Message

Control UI: +Web UI: http://192.168.2.117:18789/ +Gateway WS: ws://192.168.2.117:18789 +Gateway: not detected (SECURITY ERROR: plaintext ws:// to non-loopback)

Root Cause

When gateway.tls.enabled: true with custom cert/key and gateway.bind: "lan", the CLI (openclaw onboard, openclaw status) displays http:// and ws:// URLs instead of https:// and wss://.

Code Example

+gateway:
++port: 18789
++bind: lan
++tls:
+++enabled: true
+++autoGenerate: false
+++certPath: /Users/.../.openclaw/tls-cert.pem
+++keyPath: /Users/.../.openclaw/tls-key.pem
+

---

Control UI:
+Web UI: http://192.168.2.117:18789/
+Gateway WS: ws://192.168.2.117:18789
+Gateway: not detected (SECURITY ERROR: plaintext ws:// to non-loopback)

---

Control UI:
+Web UI: https://192.168.2.117:18789/
+Gateway WS: wss://192.168.2.117:18789

---

curl -sk https://192.168.2.117:18789/ -o /dev/null -w "%{http_code}"
200
RAW_BUFFERClick to expand / collapse

Description

When gateway.tls.enabled: true with custom cert/key and gateway.bind: "lan", the CLI (openclaw onboard, openclaw status) displays http:// and ws:// URLs instead of https:// and wss://.

Environment

  • OpenClaw: 2026.4.2
  • OS: macOS (arm64)
  • Config: +Yyaml +gateway: ++port: 18789 ++bind: lan ++tls: +++enabled: true +++autoGenerate: false +++certPath: /Users/.../.openclaw/tls-cert.pem +++keyPath: /Users/.../.openclaw/tls-key.pem +

What happens

Control UI:
+Web UI: http://192.168.2.117:18789/
+Gateway WS: ws://192.168.2.117:18789
+Gateway: not detected (SECURITY ERROR: plaintext ws:// to non-loopback)

What should happen

Control UI:
+Web UI: https://192.168.2.117:18789/
+Gateway WS: wss://192.168.2.117:18789

Verification

curl -sk https://192.168.2.117:18789/ -o /dev/null -w "%{http_code}"
200

TLS is working. CLI URL generation ignores gateway.tls.enabled for non-loopback display URLs.

Impact

  • openclaw onboard health check false SECURITY ERROR
  • Control UI URLs wrong (http vs https)
  • Users think TLS broken when it works

extent analysis

TL;DR

The CLI may need to be updated to correctly generate HTTPS and WSS URLs when gateway.tls.enabled is true and the bind address is not loopback.

Guidance

  • Verify that the gateway.tls.enabled configuration is correctly applied by checking the TLS connection using the provided curl command.
  • Check the OpenClaw documentation to see if there are any known issues or workarounds for the CLI not generating correct HTTPS and WSS URLs.
  • Consider filing an issue or feature request with the OpenClaw project to update the CLI to handle non-loopback addresses with TLS enabled.
  • Test the Control UI URLs manually to confirm that they are correct and functional.

Example

No code snippet is provided as the issue seems to be related to the OpenClaw CLI configuration and behavior.

Notes

The issue seems to be specific to the OpenClaw CLI and its handling of non-loopback addresses with TLS enabled. The provided curl command verifies that TLS is working correctly, but the CLI is not generating the correct URLs.

Recommendation

Apply workaround: manually update the Control UI URLs to use HTTPS and WSS until the OpenClaw CLI is updated to handle this case correctly. This is because the TLS connection is working as expected, but the CLI is not generating the correct URLs.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#GPU setup#container setup#orchestration issue#cache issue#memory leak

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix CLI shows http:// and ws:// URLs when gateway.tls.enabled is true (bind: lan) [1 participants]