TEST-INFRA: [BLOCKER] Unable to clone repository due to TLS/SNI issue on git.cleveragents.com #1593

Closed
opened 2026-04-02 23:01:46 +00:00 by freemo · 3 comments
Owner

Metadata

  • Branch: fix/infra-tls-sni-git-cleveragents-com
  • Commit Message: fix(infra): resolve TLS/SNI handshake failure on git.cleveragents.com
  • Milestone: v3.7.0
  • Parent Epic: (orphan — no CI/Infrastructure Epic currently exists; needs manual linking by project owner)

Background and Context

The Test Infrastructure Improver agent is unable to clone the cleveragents/cleveragents-core repository because the git server at git.cleveragents.com is rejecting TLS handshakes with an SNI "unrecognized name" error. This is a server-side misconfiguration: the TLS certificate served does not include git.cleveragents.com as a recognised Subject Alternative Name (SAN), or the virtual-host/SNI routing is incorrectly configured.

This issue is the actionable remediation ticket for the bug-hunt report at #1532. A related fix for git.dev.cleveragents.com is tracked at #1543.

Current Behavior

Any attempt to clone the repository via https://git.cleveragents.com/ fails immediately during the TLS handshake:

fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/':
gnutls_handshake() failed: The server name sent was not recognized

Diagnostic evidence collected:

  1. git clone with PAT — fails with the error above.

  2. curl -v — confirms server-side SNI rejection:

    * TLSv1.3 (IN), TLS alert, unrecognized name (624):
    * OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name
    
  3. openssl s_client — same failure:

    40A7C06B517F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:
    ../ssl/record/rec_layer_s3.c:1605:SSL alert number 112
    
  4. GIT_SSL_NO_VERIFY=true git clone — still fails. This confirms the root cause is not a client-side certificate trust issue but a server-side SNI rejection occurring before the certificate is even presented.

Expected Behavior

git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully with a valid PAT and no SSL bypass flags. The TLS handshake succeeds and the server presents a valid certificate that includes git.cleveragents.com as a SAN.

Acceptance Criteria

  • git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without GIT_SSL_NO_VERIFY
  • TLS certificate for git.cleveragents.com includes the correct hostname as a SAN and is trusted by standard CA bundles
  • curl -v https://git.cleveragents.com completes the TLS handshake without "unrecognized name" alert
  • No regression on any other hostname served by the same infrastructure
  • CI/CD pipeline clone step passes without GIT_SSL_NO_VERIFY

Supporting Information

  • Related bug-hunt report: #1532 — BUG-HUNT: [Infrastructure] TLS Configuration Error on git.cleveragents.com
  • Related fix (different hostname): #1543 — fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com
  • Impact: Critical — blocks all automated agents, CI/CD pipelines, and any workflow requiring repository access via git.cleveragents.com
  • Note on Priority/Highest: This label does not exist in the repository label set. Priority/Critical has been applied as the closest equivalent.
  • Note on BLOCKER label: No BLOCKER label exists in the repository label set. The blocking nature of this issue is described in the title and body.

Subtasks

  • Confirm exact hostname(s) affected and whether git.cleveragents.com and git.dev.cleveragents.com share the same infrastructure/reverse proxy
  • Inspect the TLS certificate currently served by git.cleveragents.com (check SANs via openssl s_client -connect git.cleveragents.com:443 -servername git.cleveragents.com)
  • Identify root cause: missing SAN in certificate, wrong SNI virtual-host binding, or expired/mismatched certificate
  • Renew or reissue the TLS certificate to include git.cleveragents.com as a SAN
  • Update server (nginx/caddy/traefik/etc.) virtual-host configuration to correctly route SNI for git.cleveragents.com
  • Verify fix: git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without GIT_SSL_NO_VERIFY
  • Verify fix: curl -v https://git.cleveragents.com completes TLS handshake cleanly
  • Verify no regression on other hostnames on the same infrastructure
  • Document the certificate renewal process and expiry monitoring in the ops runbook

Definition of Done

This issue is complete when:

  • All subtasks above are completed and checked off.
  • A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly (fix(infra): resolve TLS/SNI handshake failure on git.cleveragents.com), followed by a blank line, then additional lines providing relevant details about the fix.
  • The commit is pushed to the remote on the branch matching the Branch in Metadata exactly (fix/infra-tls-sni-git-cleveragents-com).
  • The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
  • All acceptance criteria above are verified and checked off.
  • All nox stages pass
  • Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/infra-tls-sni-git-cleveragents-com` - **Commit Message**: `fix(infra): resolve TLS/SNI handshake failure on git.cleveragents.com` - **Milestone**: v3.7.0 - **Parent Epic**: *(orphan — no CI/Infrastructure Epic currently exists; needs manual linking by project owner)* ## Background and Context The Test Infrastructure Improver agent is unable to clone the `cleveragents/cleveragents-core` repository because the git server at `git.cleveragents.com` is rejecting TLS handshakes with an SNI "unrecognized name" error. This is a server-side misconfiguration: the TLS certificate served does not include `git.cleveragents.com` as a recognised Subject Alternative Name (SAN), or the virtual-host/SNI routing is incorrectly configured. This issue is the actionable remediation ticket for the bug-hunt report at #1532. A related fix for `git.dev.cleveragents.com` is tracked at #1543. ## Current Behavior Any attempt to clone the repository via `https://git.cleveragents.com/` fails immediately during the TLS handshake: ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` **Diagnostic evidence collected:** 1. **`git clone` with PAT** — fails with the error above. 2. **`curl -v`** — confirms server-side SNI rejection: ``` * TLSv1.3 (IN), TLS alert, unrecognized name (624): * OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name ``` 3. **`openssl s_client`** — same failure: ``` 40A7C06B517F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name: ../ssl/record/rec_layer_s3.c:1605:SSL alert number 112 ``` 4. **`GIT_SSL_NO_VERIFY=true git clone`** — still fails. This confirms the root cause is **not** a client-side certificate trust issue but a server-side SNI rejection occurring before the certificate is even presented. ## Expected Behavior `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully with a valid PAT and no SSL bypass flags. The TLS handshake succeeds and the server presents a valid certificate that includes `git.cleveragents.com` as a SAN. ## Acceptance Criteria - [ ] `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without `GIT_SSL_NO_VERIFY` - [ ] TLS certificate for `git.cleveragents.com` includes the correct hostname as a SAN and is trusted by standard CA bundles - [ ] `curl -v https://git.cleveragents.com` completes the TLS handshake without "unrecognized name" alert - [ ] No regression on any other hostname served by the same infrastructure - [ ] CI/CD pipeline clone step passes without `GIT_SSL_NO_VERIFY` ## Supporting Information - **Related bug-hunt report**: #1532 — BUG-HUNT: [Infrastructure] TLS Configuration Error on git.cleveragents.com - **Related fix (different hostname)**: #1543 — fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com - **Impact**: Critical — blocks all automated agents, CI/CD pipelines, and any workflow requiring repository access via `git.cleveragents.com` - **Note on `Priority/Highest`**: This label does not exist in the repository label set. `Priority/Critical` has been applied as the closest equivalent. - **Note on `BLOCKER` label**: No `BLOCKER` label exists in the repository label set. The blocking nature of this issue is described in the title and body. ## Subtasks - [ ] Confirm exact hostname(s) affected and whether `git.cleveragents.com` and `git.dev.cleveragents.com` share the same infrastructure/reverse proxy - [ ] Inspect the TLS certificate currently served by `git.cleveragents.com` (check SANs via `openssl s_client -connect git.cleveragents.com:443 -servername git.cleveragents.com`) - [ ] Identify root cause: missing SAN in certificate, wrong SNI virtual-host binding, or expired/mismatched certificate - [ ] Renew or reissue the TLS certificate to include `git.cleveragents.com` as a SAN - [ ] Update server (nginx/caddy/traefik/etc.) virtual-host configuration to correctly route SNI for `git.cleveragents.com` - [ ] Verify fix: `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without `GIT_SSL_NO_VERIFY` - [ ] Verify fix: `curl -v https://git.cleveragents.com` completes TLS handshake cleanly - [ ] Verify no regression on other hostnames on the same infrastructure - [ ] Document the certificate renewal process and expiry monitoring in the ops runbook ## Definition of Done This issue is complete when: - [ ] All subtasks above are completed and checked off. - [ ] A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly (`fix(infra): resolve TLS/SNI handshake failure on git.cleveragents.com`), followed by a blank line, then additional lines providing relevant details about the fix. - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly (`fix/infra-tls-sni-git-cleveragents-com`). - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - [ ] All acceptance criteria above are verified and checked off. - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
freemo added this to the v3.7.0 milestone 2026-04-02 23:02:00 +00:00
Author
Owner

⚠️ Orphan Issue — Manual Linking Required

This issue has no parent Epic because no CI/Infrastructure or Test Infrastructure Epic currently exists in the repository. Per CONTRIBUTING.md, all non-Epic issues must be linked to a parent Epic.

Action required for project owner: Please either:

  1. Create a CI/Infrastructure or Test Infrastructure Epic and link this issue as a child (this issue should block the parent Epic), or
  2. Link this issue to an existing Epic that covers infrastructure/server operations work.

Related orphan issues in the same TEST-INFRA cluster that also need parent Epic linking:


Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

⚠️ **Orphan Issue — Manual Linking Required** This issue has no parent Epic because no CI/Infrastructure or Test Infrastructure Epic currently exists in the repository. Per `CONTRIBUTING.md`, all non-Epic issues must be linked to a parent Epic. **Action required for project owner:** Please either: 1. Create a CI/Infrastructure or Test Infrastructure Epic and link this issue as a child (this issue should **block** the parent Epic), or 2. Link this issue to an existing Epic that covers infrastructure/server operations work. Related orphan issues in the same TEST-INFRA cluster that also need parent Epic linking: - #1535, #1536, #1537, #1538, #1539, #1540, #1541, #1542, #1543, #1544, #1549 --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
Author
Owner

Closing as duplicate of #1543.

This issue reports the same TLS/SNI clone failure on git.cleveragents.com that is already tracked in #1543 (Priority/Critical, MoSCoW/Must Have, v3.7.0). All work should be consolidated there.


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This issue reports the same TLS/SNI clone failure on `git.cleveragents.com` that is already tracked in #1543 (Priority/Critical, MoSCoW/Must Have, v3.7.0). All work should be consolidated there. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
freemo 2026-04-02 23:16:51 +00:00
Author
Owner

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem.


Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cleveragents/cleveragents-core#1593
No description provided.