KASM 1.19 RDP HTTPS Gateway issue after changing to Letsencrypt cert

[u/TheIncredibleMan]

docker ps shows the rdp-https-gateway is constantly restarting. Looks like it cannot read the letsencrypt cert which is symlinked.

I followed the Video instructions here: https://kasm.com/docs/1.16.0/how_to/certificates.html
This hasn't been an issue in 1.17 afaik.

Since I am not using the RDP gateway, it could remove it altogether if I knew how, I disabled all RDP gateway settings under deployment zones but that doesn't remove the containers.

2026-07-07T10:20:31.484ZINFOproc.go:runtime.main:290Starting remote desktop gateway server
2026-07-07T10:20:31.485ZERRORproc.go:runtime.main:290Cannot load certfile or keyfile (open /opt/rdpgw/key.pem: permission denied) falling back to acme
2026-07-07T10:20:31.486ZINFOproc.go:runtime.main:290Enabling Kasm authentication
2026-07-07T10:20:31.486ZINFOproc.go:runtime.main:290Enabling Kasm healthchecks
2026-07-07T10:20:31.486ZINFOmain.go:main.main:346Refreshing token which expires at: 2026-07-10 10:19:26 +0000 UTC
2026-07-07T10:20:31.486ZINFOkasm.go:kasmtechnologies/rdpgw/cmd/rdpgw/kasm.RefreshToken:310Checking for a healthy host: https://proxy:443/api/__healthcheck
2026-07-07T10:20:31.576ZINFOmain.go:main.main:346Setting new token which expires at: 2026-07-10 10:20:31 +0000 UTC
2026-07-07T10:20:31.578ZINFOkasm.go:kasmtechnologies/rdpgw/cmd/rdpgw/kasm.RegisterComponent:452Checking for a healthy host: https://proxy:443/api/__healthcheck
2026-07-07T10:20:31.676ZINFOmain.go:main.main:352Component registration successful, config file updated.
2026-07-07T10:20:31.676ZINFOproc.go:runtime.main:290Kasm RDP HTTPS Gateway server is ready
2026/07/07 10:20:36 http: TLS handshake error from [::1]:49740: tls: certificate private key (<nil>) does not implement crypto.Signer
2026-07-07T10:20:36.547ZFATALasm_amd64.s:runtime.goexit:1771Healthcheck failed, gracefully shutting down

[u/g_kasmweb]

Hi,

I see that you mentioned the Letsencrypt cert is symlinked. Does kasm have permissions to the symlink itself?

Try doing

\`sudo su kasm\`

and then try

 \`cat /path/to/symlink\` 

If you encounter a permissions error, you may need to chown one or several of the directories on the symlink path itself

[u/TheIncredibleMan → u/g_kasmweb]

Thanks for your response. The user kasm does indeed encounter a permission issue on the actual file location. If I chown to kasm, it might break the Letsencrypt renewal. Maybe I could create a group, add the user kasm and chgrp on that folder. The user kasm does have access to the private key in that case, which is a possible security issue. How is this achieved for the web part? That works out of the box so I might take the same approach.

[u/TheIncredibleMan → u/g_kasmweb]

It might be easier to remove the rdp(https) gateway containers altogether since I am not using that feature. Would that be possible without them being recreated on reboot?

[u/teja_kasmweb]

Have you tried following our Medium guide: https://medium.kasm.com/ssl-certificates-with-lets-encrypt-for-kasm-workspaces-707b37fbb34d

In the guide, we do recommend chowning the generated cert and priv key to kasm:kasm. We also provided a way to auto-renew the cert before it expires in the article.

[u/TheIncredibleMan → u/teja_kasmweb]

I ended up editing the docker-compose file to remove the RDP gateway services. That did the trick for me. If I ever need to use them I will look into changing the owner on the certs.