cleveragents/cleveragents-core

Fork 3

fix(infra): resolve TLS handshake failure on git.cleveragents.com blocking repository clone #1590

New issue

Closed

opened 2026-04-02 23:00:46 +00:00 by freemo · 2 comments

freemo commented

2026-04-02 23:00:46 +00:00

Owner

Metadata

Branch: fix/infra-tls-handshake-failure-git-cleveragents
Commit Message: fix(infra): resolve TLS handshake failure on git.cleveragents.com
Milestone: v3.7.0
Parent Epic: (orphan — no Test Infrastructure Epic found; requires manual linking)

Background and Context

The ca-test-infra-improver agent is unable to clone the cleveragents/cleveragents-core repository via https://git.cleveragents.com, preventing any automated analysis of the test infrastructure. The error indicates the server's TLS certificate does not include git.cleveragents.com as a recognised Subject Alternative Name (SAN), or the virtual-host/SNI routing is misconfigured server-side.

A related issue exists at #1532 (bug-hunt report, unformatted) and #1543 (covers git.dev.cleveragents.com). This issue specifically tracks the git.cleveragents.com public hostname and the remediation work required.

Current Behavior

Attempting to clone the repository fails with a TLS handshake error:

fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

This error persists even when http.sslVerify is set to false (i.e., GIT_SSL_NO_VERIFY=true), confirming this is a server-side SNI rejection, not a client certificate trust issue.

Confirmed evidence:

$ curl -v https://git.cleveragents.com/cleveragents/cleveragents-core.git
*   Trying 13.248.169.48:443...
* Connected to git.cleveragents.com (13.248.169.48) port 443 (#0)
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, unrecognized name (624):
* OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name

Expected Behavior

git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully with a valid PAT and no SSL bypass flags.

Subtasks

Confirm the exact hostname(s) affected (git.cleveragents.com vs git.dev.cleveragents.com) and whether they share infrastructure
Inspect the TLS certificate currently served by git.cleveragents.com (check SANs via openssl s_client -connect git.cleveragents.com:443 -servername git.cleveragents.com)
Identify root cause: missing SAN in certificate, wrong SNI virtual-host binding, or expired/mismatched certificate
Renew or reissue the TLS certificate to include git.cleveragents.com as a SAN
Update server (nginx/caddy/traefik/etc.) virtual-host configuration to correctly route SNI for git.cleveragents.com
Verify fix: git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without GIT_SSL_NO_VERIFY
Verify fix: automated CI pipeline clone step succeeds end-to-end
Verify no regression on git.dev.cleveragents.com (related hostname)
Document the certificate renewal process and expiry monitoring in the ops runbook
Run nox (all default sessions), fix any errors
Verify coverage >= 97% via nox -s coverage_report

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully with a valid PAT and no SSL bypass flags.
TLS certificate for git.cleveragents.com includes the correct hostname as a SAN and is trusted by standard CA bundles.
No regression on git.dev.cleveragents.com (related hostname per #1543).
CI/CD pipeline clone step passes without GIT_SSL_NO_VERIFY.
Ops runbook updated with certificate renewal procedure and expiry alert threshold.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Supporting Information

Related issue (bug-hunt report, same hostname): #1532
Related issue (same error, git.dev.cleveragents.com): #1543
Related issue (CI push failure): #1541
Reported by: ca-test-infra-improver agent
Error class: Server-side SNI rejection (unrecognized_name TLS alert, code 624)

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/infra-tls-handshake-failure-git-cleveragents` - **Commit Message**: `fix(infra): resolve TLS handshake failure on git.cleveragents.com` - **Milestone**: v3.7.0 - **Parent Epic**: *(orphan — no Test Infrastructure Epic found; requires manual linking)* ## Background and Context The `ca-test-infra-improver` agent is unable to clone the `cleveragents/cleveragents-core` repository via `https://git.cleveragents.com`, preventing any automated analysis of the test infrastructure. The error indicates the server's TLS certificate does not include `git.cleveragents.com` as a recognised Subject Alternative Name (SAN), or the virtual-host/SNI routing is misconfigured server-side. A related issue exists at #1532 (bug-hunt report, unformatted) and #1543 (covers `git.dev.cleveragents.com`). This issue specifically tracks the `git.cleveragents.com` public hostname and the remediation work required. ## Current Behavior Attempting to clone the repository fails with a TLS handshake error: ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` This error persists even when `http.sslVerify` is set to `false` (i.e., `GIT_SSL_NO_VERIFY=true`), confirming this is a **server-side SNI rejection**, not a client certificate trust issue. **Confirmed evidence:** ```bash $ curl -v https://git.cleveragents.com/cleveragents/cleveragents-core.git * Trying 13.248.169.48:443... * Connected to git.cleveragents.com (13.248.169.48) port 443 (#0) * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS alert, unrecognized name (624): * OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name ``` ## Expected Behavior `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully with a valid PAT and no SSL bypass flags. ## Subtasks - [ ] Confirm the exact hostname(s) affected (`git.cleveragents.com` vs `git.dev.cleveragents.com`) and whether they share infrastructure - [ ] Inspect the TLS certificate currently served by `git.cleveragents.com` (check SANs via `openssl s_client -connect git.cleveragents.com:443 -servername git.cleveragents.com`) - [ ] Identify root cause: missing SAN in certificate, wrong SNI virtual-host binding, or expired/mismatched certificate - [ ] Renew or reissue the TLS certificate to include `git.cleveragents.com` as a SAN - [ ] Update server (nginx/caddy/traefik/etc.) virtual-host configuration to correctly route SNI for `git.cleveragents.com` - [ ] Verify fix: `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without `GIT_SSL_NO_VERIFY` - [ ] Verify fix: automated CI pipeline clone step succeeds end-to-end - [ ] Verify no regression on `git.dev.cleveragents.com` (related hostname) - [ ] Document the certificate renewal process and expiry monitoring in the ops runbook - [ ] Run `nox` (all default sessions), fix any errors - [ ] Verify coverage >= 97% via `nox -s coverage_report` ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully with a valid PAT and no SSL bypass flags. - TLS certificate for `git.cleveragents.com` includes the correct hostname as a SAN and is trusted by standard CA bundles. - No regression on `git.dev.cleveragents.com` (related hostname per #1543). - CI/CD pipeline clone step passes without `GIT_SSL_NO_VERIFY`. - Ops runbook updated with certificate renewal procedure and expiry alert threshold. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. ## Supporting Information - Related issue (bug-hunt report, same hostname): #1532 - Related issue (same error, `git.dev.cleveragents.com`): #1543 - Related issue (CI push failure): #1541 - Reported by: `ca-test-infra-improver` agent - Error class: Server-side SNI rejection (`unrecognized_name` TLS alert, code 624) --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.7.0 milestone

2026-04-02 23:00:59 +00:00

freemo commented

2026-04-02 23:01:23 +00:00

Author

Owner

⚠️ Orphan Issue — Manual Linking Required

No Test Infrastructure Epic was found in the open issues for cleveragents/cleveragents-core. This issue cannot be automatically linked to a parent Epic.

Action required: A project maintainer should either:

Create a [Epic] Test Infrastructure / CI Pipeline Epic and link this issue as a child (this issue should block the Epic), or
Link this issue to an existing relevant Epic.

Per CONTRIBUTING.md, orphan issues are not permitted. This issue needs a parent Epic before it can be considered properly tracked.

Related issues on the same TLS problem:

#1532 — Bug-hunt report (same hostname git.cleveragents.com, unformatted)
#1543 — Fix issue for git.dev.cleveragents.com (same root cause)
#1541 — CI push failure (related infrastructure issue)

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

⚠️ **Orphan Issue — Manual Linking Required** No Test Infrastructure Epic was found in the open issues for `cleveragents/cleveragents-core`. This issue cannot be automatically linked to a parent Epic. **Action required:** A project maintainer should either: 1. Create a `[Epic] Test Infrastructure / CI Pipeline` Epic and link this issue as a child (this issue should **block** the Epic), or 2. Link this issue to an existing relevant Epic. Per CONTRIBUTING.md, orphan issues are not permitted. This issue needs a parent Epic before it can be considered properly tracked. **Related issues on the same TLS problem:** - #1532 — Bug-hunt report (same hostname `git.cleveragents.com`, unformatted) - #1543 — Fix issue for `git.dev.cleveragents.com` (same root cause) - #1541 — CI push failure (related infrastructure issue) --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added a new dependency

2026-04-02 23:03:34 +00:00

#1532 BUG-HUNT: [Infrastructure] TLS Configuration Error on git.cleveragents.com

freemo referenced this issue

2026-04-02 23:07:50 +00:00

TEST-INFRA: [ci-environment] Unable to clone repository due to TLS/SSL handshake failure #1601

freemo commented

2026-04-02 23:16:20 +00:00

Author

Owner

Closing as duplicate of #1543.

This issue reports the same TLS handshake failure on git.cleveragents.com that is already tracked in #1543 (Priority/Critical, MoSCoW/Must Have, v3.7.0). All work should be consolidated there.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This issue reports the same TLS handshake failure on `git.cleveragents.com` that is already tracked in #1543 (Priority/Critical, MoSCoW/Must Have, v3.7.0). All work should be consolidated there. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:16:52 +00:00