11 replies

Discord exec approval buttons not showing — self-signed TLS cert issue

✅Solved

Environment:
- OpenClaw: 2026.2.21-2
- OS: Linux (WSL2) —

6.6.87.2-microsoft-standard-WSL2 (x64)

6.6.87.2-microsoft-standard-WSL2 (x64)

- Node: v22.22.0
- Gateway bind:

lan

lan

- TLS: enabled, self-signed (auto-generated)

Background:
We have TLS enabled with a self-signed cert because

bind: "lan"

bind: "lan"

requires

wss://

wss://

— the CLI/subagents reject plaintext

ws://

ws://

to non-loopback hosts. This was working fine on 2.19-2.

Problem:
After updating to 2.21-2, Discord exec approval buttons stopped appearing entirely. Approvals show up fine on the webchat dashboard, but never reach Discord. Requests eventually time out and auto-deny.

What we found:
A subagent dug through logs and found repeated errors:

discord exec approvals: connect error: self-signed certificate

discord exec approvals: connect error: self-signed certificate

The Discord plugin's internal connection to the gateway approval stream is failing because it doesn't trust the self-signed cert.

What we tried:
Set

gateway.remote.tlsFingerprint

gateway.remote.tlsFingerprint

to our cert's SHA-256 fingerprint — Discord approval buttons still don't show

Expected behavior:
Discord exec approval buttons should work with self-signed TLS, same as webchat does. Or the internal Discord approval handler should respect

gateway.remote.tlsFingerprint

gateway.remote.tlsFingerprint

.

Config (relevant parts):

{
  "gateway": {
    "bind": "lan",
    "tls": {
      "enabled": true,
      "autoGenerate": true
    },
    "remote": {
      "tlsFingerprint": "<sha256 fingerprint>"
    }
  },
  "channels": {
    "discord": {
      "execApprovals": {
        "enabled": true,
        "approvers": ["<user_id>"],
        "cleanupAfterResolve": true
      }
    }
  }
}

{
  "gateway": {
    "bind": "lan",
    "tls": {
      "enabled": true,
      "autoGenerate": true
    },
    "remote": {
      "tlsFingerprint": "<sha256 fingerprint>"
    }
  },
  "channels": {
    "discord": {
      "execApprovals": {
        "enabled": true,
        "approvers": ["<user_id>"],
        "cleanupAfterResolve": true
      }
    }
  }
}

Solution

Solution: Discord exec approval buttons not showing with self-signed TLS

Following up on my earlier report — Discord exec approval components weren't appearing after updating to 2026.2.21-2. Webchat approvals worked fine, only Discord was affected.

Root cause:
The Discord plugin's internal connection to the gateway approval stream was failing with

self-signed certificate

self-signed certificate

error. We use

gateway.tls

gateway.tls

with

autoGenerate: true

autoGenerate: true

(self-signed) because

bind: "lan"

bind: "lan"

requires

wss://

wss://

.

Setting

gateway.remote.tlsFingerprint

gateway.remote.tlsFingerprint

fixed webchat/CLI but not the Discord handler — it doesn't read that config.

Fix:
Replace the self-signed cert with a locally-trusted one via

mkcert

mkcert

, then point Node at the CA:

# Install mkcert
curl -fsSL -o ~/.local/bin/mkcert https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64
chmod +x ~/.local/bin/mkcert

# Create & install local CA
mkcert -install

# Generate cert for localhost + LAN IPs
cd ~/.openclaw/gateway/tls
mkcert localhost 127.0.0.1 ::1 <WSL_IP> <LAN_IP>

# Install mkcert
curl -fsSL -o ~/.local/bin/mkcert https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64
chmod +x ~/.local/bin/mkcert

# Create & install local CA
mkcert -install

# Generate cert for localhost + LAN IPs
cd ~/.openclaw/gateway/tls
mkcert localhost 127.0.0.1 ::1 <WSL_IP> <LAN_IP>

Update

openclaw.json

openclaw.json

"gateway": {
  "tls": {
    "enabled": true,
    "autoGenerate": false,
    "certPath": "/home/<user>/.openclaw/gateway/tls/localhost+4.pem",
    "keyPath": "/home/<user>/.openclaw/gateway/tls/localhost+4-key.pem"
  }
}

"gateway": {
  "tls": {
    "enabled": true,
    "autoGenerate": false,
    "certPath": "/home/<user>/.openclaw/gateway/tls/localhost+4.pem",
    "keyPath": "/home/<user>/.openclaw/gateway/tls/localhost+4-key.pem"
  }
}

Key step — set

NODE_EXTRA_CA_CERTS

NODE_EXTRA_CA_CERTS

so Node trusts the mkcert CA:

NODE_EXTRA_CA_CERTS=~/.local/share/mkcert/rootCA.pem pm2 restart openclaw --update-env

NODE_EXTRA_CA_CERTS=~/.local/share/mkcert/rootCA.pem pm2 restart openclaw --update-env

Discord approval buttons came back immediately after this.

Jump to solution

FotC�

Friends of the Crustacean 🦞🤝•2w ago•

11 replies

Qearl

Discord exec approval buttons not showing — self-signed TLS cert issue

✅Solved

Environment:
- OpenClaw: 2026.2.21-2
- OS: Linux (WSL2) —

6.6.87.2-microsoft-standard-WSL2 (x64)

6.6.87.2-microsoft-standard-WSL2 (x64)

- Node: v22.22.0
- Gateway bind:

lan

lan

- TLS: enabled, self-signed (auto-generated)

Background:
We have TLS enabled with a self-signed cert because

bind: "lan"

bind: "lan"

requires

wss://

wss://

— the CLI/subagents reject plaintext

ws://

ws://

discord exec approvals: connect error: self-signed certificate

discord exec approvals: connect error: self-signed certificate

The Discord plugin's internal connection to the gateway approval stream is failing because it doesn't trust the self-signed cert.

What we tried:
Set

gateway.remote.tlsFingerprint

gateway.remote.tlsFingerprint

gateway.remote.tlsFingerprint

gateway.remote.tlsFingerprint

.

Config (relevant parts):

{
  "gateway": {
    "bind": "lan",
    "tls": {
      "enabled": true,
      "autoGenerate": true
    },
    "remote": {
      "tlsFingerprint": "<sha256 fingerprint>"
    }
  },
  "channels": {
    "discord": {
      "execApprovals": {
        "enabled": true,
        "approvers": ["<user_id>"],
        "cleanupAfterResolve": true
      }
    }
  }
}

{
  "gateway": {
    "bind": "lan",
    "tls": {
      "enabled": true,
      "autoGenerate": true
    },
    "remote": {
      "tlsFingerprint": "<sha256 fingerprint>"
    }
  },
  "channels": {
    "discord": {
      "execApprovals": {
        "enabled": true,
        "approvers": ["<user_id>"],
        "cleanupAfterResolve": true
      }
    }
  }
}

Solution

self-signed certificate

self-signed certificate

error. We use

gateway.tls

gateway.tls

with

autoGenerate: true

autoGenerate: true

(self-signed) because

bind: "lan"

bind: "lan"

requires

wss://

wss://

.

Setting

gateway.remote.tlsFingerprint

gateway.remote.tlsFingerprint

fixed webchat/CLI but not the Discord handler — it doesn't read that config.

Fix:
Replace the self-signed cert with a locally-trusted one via

mkcert

mkcert

, then point Node at the CA:

# Install mkcert
curl -fsSL -o ~/.local/bin/mkcert https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64
chmod +x ~/.local/bin/mkcert

# Create & install local CA
mkcert -install

# Generate cert for localhost + LAN IPs
cd ~/.openclaw/gateway/tls
mkcert localhost 127.0.0.1 ::1 <WSL_IP> <LAN_IP>

# Install mkcert
curl -fsSL -o ~/.local/bin/mkcert https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64
chmod +x ~/.local/bin/mkcert

# Create & install local CA
mkcert -install

# Generate cert for localhost + LAN IPs
cd ~/.openclaw/gateway/tls
mkcert localhost 127.0.0.1 ::1 <WSL_IP> <LAN_IP>

Update

openclaw.json

openclaw.json

"gateway": {
  "tls": {
    "enabled": true,
    "autoGenerate": false,
    "certPath": "/home/<user>/.openclaw/gateway/tls/localhost+4.pem",
    "keyPath": "/home/<user>/.openclaw/gateway/tls/localhost+4-key.pem"
  }
}

"gateway": {
  "tls": {
    "enabled": true,
    "autoGenerate": false,
    "certPath": "/home/<user>/.openclaw/gateway/tls/localhost+4.pem",
    "keyPath": "/home/<user>/.openclaw/gateway/tls/localhost+4-key.pem"
  }
}

Key step — set

NODE_EXTRA_CA_CERTS

NODE_EXTRA_CA_CERTS

so Node trusts the mkcert CA:

NODE_EXTRA_CA_CERTS=~/.local/share/mkcert/rootCA.pem pm2 restart openclaw --update-env

NODE_EXTRA_CA_CERTS=~/.local/share/mkcert/rootCA.pem pm2 restart openclaw --update-env

Discord approval buttons came back immediately after this.

Jump to solution

Discord exec approval buttons not showing — self-signed TLS cert issue

Discord exec approval buttons not showing — self-signed TLS cert issue

Similar Threads

Similar Threads

Similar Threads