openclaw - 💡(How to fix) Fix gateway install --force overwrites NODE_EXTRA_CA_CERTS, breaking TLS trust on update (macOS)

Summary

Running openclaw gateway install --force (required when updating via npm install -g openclaw@latest) regenerates the service env file at ~/.openclaw/service-env/ai.openclaw.gateway-env-wrapper.sh / ai.openclaw.gateway.env, resetting NODE_EXTRA_CA_CERTS back to /etc/ssl/cert.pem and wiping any custom CA configuration.

This breaks the gateway after every update for users running TLS with a self-signed cert on macOS.

Steps to Reproduce

1. Enable TLS with gateway.tls.autoGenerate: true on macOS
2. Add the self-signed cert to System keychain and create a combined CA bundle (required workaround for native-approvals — see related issue below)
3. Set NODE_EXTRA_CA_CERTS in the service env file to point to the combined bundle
4. Run npm install -g openclaw@latest && openclaw gateway install --force
5. Gateway comes back up with NODE_EXTRA_CA_CERTS reset to /etc/ssl/cert.pem
6. telegram/native-approvals subsystem immediately floods the log with: connect error: self-signed certificate; if the root CA is installed locally, try running Node.js with --use-system-ca

Expected Behavior

openclaw gateway install --force should either:

• Preserve a user-modified NODE_EXTRA_CA_CERTS value (detect it differs from the default and leave it), or
• Auto-detect the gateway's own self-signed cert and include it in the generated NODE_EXTRA_CA_CERTS, or
• Provide a config key (e.g. gateway.tls.extraCaCerts) that gets written into the service env at install time and survives reinstalls

Actual Behavior

The env file is fully regenerated on every install --force, silently dropping any customisation.

Environment

• macOS (arm64, Darwin 25.5.0)
• OpenClaw: 2026.5.7 → 2026.5.22 (reproduced on update)
• Node.js: v25.9.0
• Gateway bind: lan (0.0.0.0), TLS enabled via autoGenerate

Additional Context

• NODE_USE_SYSTEM_CA=1 is already written into the service env file, but it does not resolve the issue — Node.js 25.9 still rejects the self-signed cert even with that env var set and the cert trusted in System keychain
• The only working fix is NODE_EXTRA_CA_CERTS pointing to a bundle that includes the self-signed cert
• The error message itself suggests --use-system-ca, but that flag also does not resolve it in practice
• This is the second time an OpenClaw update has broken our gateway due to env file regeneration

Workaround

After every update:

cat /etc/ssl/cert.pem ~/.openclaw/gateway/tls/gateway-cert.pem > ~/.openclaw/gateway/tls/combined-ca.pem
sed -i '' "s|export NODE_EXTRA_CA_CERTS='.*'|export NODE_EXTRA_CA_CERTS='/Users/<you>/.openclaw/gateway/tls/combined-ca.pem'|" ~/.openclaw/service-env/ai.openclaw.gateway.env
openclaw gateway restart