Adapted community discussion: Paraphrased and condensed from an anonymized public OpenClaw Discord support conversation from August 2026. Technical guidance was reviewed for OpenClaw 2026.9.3.
My Windows setup with the WSL2 and Tailscale option fails at finalize-tailscale-serve. The outer error says Windows cannot reach the HTTPS Gateway endpoint because the SSL connection could not be established.
The SSL message is a wrapper around the final Windows-side reachability check. Confirm the Gateway, Tailscale state, MagicDNS, HTTPS certificates, and the exact setup log before changing routes. Redact auth URLs, keys, tokens, and private hostnames.
Windows Tailscale is connected, but its Serve status is empty.
In this setup, Tailscale Serve belongs to the app-owned WSL environment, not the Windows Tailscale client. An empty Windows Serve configuration is expected. The setup may also roll back and remove the temporary distro after failure. Search the Companion log directory for the newest setup-engine JSONL file and inspect the first WSL or Tailscale failure, not only the final SSL wrapper.
The setup-engine log says the WSL-side Tailscale service timed out before reaching Running and prints a one-time authentication URL. The SSL error appears afterward.
That makes the service startup or authentication failure the root cause. A separate Windows Tailscale session does not authenticate the WSL node. Keep the one-time URL private, approve the WSL node if the tailnet requires it, and wait for the daemon to report healthy before Serve or certificates are configured. If setup cannot reach that state, finish local-only setup and configure remote access later rather than looping on the SSL symptom.
One more thing to check is whether the WSL environment has systemd enabled and tailscaled is supervised. If the daemon dies when its launching shell exits, setup will time out before the Serve step. After any WSL configuration change, shut WSL down cleanly, reopen it, and verify the daemon and node status before requesting a certificate.
That ordering matches the evidence: establish a supervised WSL Tailscale service, confirm the node is authenticated and online, then configure Serve and test HTTPS.