BUG-HUNT: [Security] Git clone fails with TLS/SSL handshake error #1408

New issue

Closed

opened 2026-04-02 17:32:02 +00:00 by freemo · 1 comment

freemo commented

2026-04-02 17:32:02 +00:00

Owner

Bug Report: [Security] — Git clone fails with TLS/SSL handshake error

Severity Assessment

Impact: Prevents all developers from cloning the repository, completely blocking all development.
Likelihood: 100% reproducible.
Priority: Critical

Location

File: N/A (Repository access issue)
Function/Class: N/A
Lines: N/A

Description

When attempting to clone the repository using the provided PAT, the operation fails with a TLS/SSL handshake error. The error message is: fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized.

This indicates a potential misconfiguration of the TLS/SSL certificate on the git.cleveragents.com server.

Evidence

git clone https://<FORGEJO_PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git /tmp/ca-bug-worker-core-1
Cloning into '/tmp/ca-bug-worker-core-1'...
fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

Expected Behavior

The git clone command should successfully clone the repository.

Actual Behavior

The git clone command fails with a TLS/SSL handshake error.

Suggested Fix

Investigate the TLS/SSL certificate configuration for git.cleveragents.com. Ensure that the certificate is valid, correctly installed, and that the server is configured to use the correct certificate for the domain name.

Metadata

Branch: fix/security-tls-ssl-handshake-git-clone
Commit Message: fix(security): resolve TLS/SSL handshake failure on git.cleveragents.com
Milestone: v3.3.0
Parent Epic: #400

Subtasks

Investigate TLS/SSL certificate configuration on git.cleveragents.com
Verify the certificate is valid and not expired
Verify the certificate's Subject Alternative Names (SANs) include git.cleveragents.com
Check server-side TLS/SSL configuration for SNI (Server Name Indication) support
Apply the necessary certificate or server configuration fix
Verify git clone succeeds from a clean environment after the fix

Definition of Done

All subtasks above are completed and checked off
git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without TLS/SSL errors
Fix is verified from at least one external environment
The fix commit is pushed to fix/security-tls-ssl-handshake-git-clone with the commit message fix(security): resolve TLS/SSL handshake failure on git.cleveragents.com
A PR is opened, reviewed, and merged
All nox stages pass
Coverage >= 97%

## Bug Report: [Security] — Git clone fails with TLS/SSL handshake error ### Severity Assessment - **Impact**: Prevents all developers from cloning the repository, completely blocking all development. - **Likelihood**: 100% reproducible. - **Priority**: Critical ### Location - **File**: N/A (Repository access issue) - **Function/Class**: N/A - **Lines**: N/A ### Description When attempting to clone the repository using the provided PAT, the operation fails with a TLS/SSL handshake error. The error message is: `fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized`. This indicates a potential misconfiguration of the TLS/SSL certificate on the `git.cleveragents.com` server. ### Evidence ```bash git clone https://<FORGEJO_PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git /tmp/ca-bug-worker-core-1 Cloning into '/tmp/ca-bug-worker-core-1'... fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` ### Expected Behavior The `git clone` command should successfully clone the repository. ### Actual Behavior The `git clone` command fails with a TLS/SSL handshake error. ### Suggested Fix Investigate the TLS/SSL certificate configuration for `git.cleveragents.com`. Ensure that the certificate is valid, correctly installed, and that the server is configured to use the correct certificate for the domain name. ### Category security --- ## Metadata - **Branch**: `fix/security-tls-ssl-handshake-git-clone` - **Commit Message**: `fix(security): resolve TLS/SSL handshake failure on git.cleveragents.com` - **Milestone**: v3.3.0 - **Parent Epic**: #400 ## Subtasks - [ ] Investigate TLS/SSL certificate configuration on `git.cleveragents.com` - [ ] Verify the certificate is valid and not expired - [ ] Verify the certificate's Subject Alternative Names (SANs) include `git.cleveragents.com` - [ ] Check server-side TLS/SSL configuration for SNI (Server Name Indication) support - [ ] Apply the necessary certificate or server configuration fix - [ ] Verify `git clone` succeeds from a clean environment after the fix ## Definition of Done - [ ] All subtasks above are completed and checked off - [ ] `git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without TLS/SSL errors - [ ] Fix is verified from at least one external environment - [ ] The fix commit is pushed to `fix/security-tls-ssl-handshake-git-clone` with the commit message `fix(security): resolve TLS/SSL handshake failure on git.cleveragents.com` - [ ] A PR is opened, reviewed, and merged - All nox stages pass - Coverage >= 97%

freemo commented

2026-04-02 17:32:22 +00:00

Author

Owner

Triage — human-liaison-1

Closing as invalid. This is a false positive from the bug hunter agent.

The bug report references git.cleveragents.com, which is not the correct Forgejo domain. The correct domain is git.cleverthis.com. The TLS/SSL handshake failure is expected when connecting to a non-existent or misconfigured domain.

The bug hunter agent (bug-worker-core-1) attempted to clone using the wrong URL. This is an agent configuration issue, not a product bug.

## Triage — human-liaison-1 **Closing as invalid.** This is a false positive from the bug hunter agent. The bug report references `git.cleveragents.com`, which is not the correct Forgejo domain. The correct domain is `git.cleverthis.com`. The TLS/SSL handshake failure is expected when connecting to a non-existent or misconfigured domain. The bug hunter agent (`bug-worker-core-1`) attempted to clone using the wrong URL. This is an agent configuration issue, not a product bug.

freemo added the

labels

2026-04-02 17:32:22 +00:00

freemo referenced this issue