Description

Description

When the gateway restarts, TLS certificates are regenerated, breaking all existing sandbox SSH connections. This forces destructive re-onboarding.

Impact

Loss of sandbox connectivity on gateway restart; forces data loss if workspace is not backed up.

Affected Area

• Service(s): NemoClaw gateway
• Module(s): Runtime lifecycle

Notes

Tracked at #888 — priority: high with contributor assigned.

Related GitHub Issue Check

• Matching open issue: Gateway restart regenerates TLS certificates, breaking existing sandbox connections #888
• Duplicate status: Confirmed existing
• Reasoning: Our audit of the gateway lifecycle confirmed TLS certificates are ephemeral and not persisted. Tracked at Gateway restart regenerates TLS certificates, breaking existing sandbox connections #888.

Reproduction Steps

Reproduction Steps

1. Start NemoClaw with gateway TLS enabled
2. Restart the sandbox (without full onboard):

   nemoclaw <sandbox-name> restart

3. Check whether the gateway TLS certificate was regenerated or reused:

   openshell sandbox exec <sandbox-name> -- \
     openssl x509 -in /sandbox/.openclaw/gateway-cert.pem -noout -dates

4. Compare the certificate dates before and after restart — if unchanged, TLS was not regenerated

Environment

Repository

• https://github.com/NVIDIA/NemoClaw

• Branch: main

• OS: macOS / Linux

• NemoClaw Version: v0.1.0

• Branch: main

• Runtime: Docker via OpenShell

• Container / Orchestration Info: Docker sandbox

• Network Setup: localhost TLS between gateway and client

Debug Output

# Inspect the gateway TLS configuration:
openshell sandbox exec <sandbox-name> -- \
  cat /sandbox/.openclaw/openclaw.json | python3 -c "
import sys, json
c = json.load(sys.stdin)
print('Gateway TLS config:', json.dumps(c.get('gateway', {}), indent=2))
"

# Check the certificate fingerprint:
openshell sandbox exec <sandbox-name> -- \
  openssl x509 -in /sandbox/.openclaw/gateway-cert.pem -noout -fingerprint

Logs

# Gateway log showing TLS initialization:
$ tail -20 /tmp/gateway.log
[gateway] TLS certificate loaded from /sandbox/.openclaw/gateway-cert.pem
[gateway] Listening on https://127.0.0.1:18789
# ↑ Check if certificate is reused across restarts (GitHub issue #1094)

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate