TEST-INFRA: [BLOCKER] Unable to clone repository due to TLS/SNI issue #1607

New issue

Closed

opened 2026-04-02 23:09:19 +00:00 by freemo · 2 comments

freemo commented

2026-04-02 23:09:19 +00:00

Owner

Metadata

Branch: fix/v3.6.0-tls-sni-clone-failure
Commit Message: fix(infra): resolve TLS/SNI handshake failure preventing repository clone
Milestone: v3.6.0
Parent Epic: (to be linked — see orphan note below)

Background and Context

The Test Infrastructure Improver agent is unable to clone the cleveragents/cleveragents-core repository via HTTPS. All clone attempts fail at the TLS handshake stage with an SNI (Server Name Indication) recognition error from git.cleveragents.com. This completely blocks any automated analysis or improvement of the test infrastructure.

Current Behavior

All attempts to clone the repository fail with the following error:

gnutls_handshake() failed: The server name sent was not recognized

Steps to Reproduce:

Attempt to clone the repository using HTTPS:

git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git

The clone fails with the TLS/SNI error.

Diagnostics:

The error is reproducible with curl -v https://git.cleveragents.com/cleveragents/cleveragents-core.git, which returns TLSv1.3 (IN), TLS alert, unrecognized name (624).
Attempts to bypass SSL verification using git -c http.sslVerify=false and GIT_SSL_NO_VERIFY=true were unsuccessful and resulted in the same error.
The SNI mismatch suggests the TLS certificate served by the host does not include git.cleveragents.com as a Subject Alternative Name (SAN), or the reverse proxy/load balancer is not routing the SNI correctly.

Expected Behavior

git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully without TLS errors, and the repository is cloned to the local filesystem.

Acceptance Criteria

git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without TLS errors from a clean environment.
curl -v https://git.cleveragents.com completes the TLS handshake successfully (no unrecognized name alert).
The TLS certificate served for git.cleveragents.com includes the hostname as a valid SAN.
The fix is verified in the CI/CD environment used by automated agents.

Subtasks

Investigate TLS certificate configuration for git.cleveragents.com — confirm whether the hostname is present as a SAN.
Investigate reverse proxy / load balancer SNI routing configuration for git.cleveragents.com.
Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction).
Verify the fix by re-running curl -v https://git.cleveragents.com and a full git clone from the agent environment.
Document the root cause and resolution in the relevant infrastructure runbook.

Definition of Done

All subtasks above are completed and checked off.
git clone succeeds without TLS errors from the automated agent environment.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass
Coverage >= 97%

Supporting Information

Impact: This is a blocking issue for the Test Infrastructure Improver agent. No automated analysis or improvement of the test infrastructure can be performed until this is resolved.
Recommendation: Investigate the TLS/SNI configuration for git.cleveragents.com to ensure it correctly handles requests for this hostname. Check the TLS certificate's Subject Alternative Names and the SNI routing in any reverse proxy (e.g., nginx, Caddy, HAProxy) sitting in front of the Forgejo instance.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/v3.6.0-tls-sni-clone-failure` - **Commit Message**: `fix(infra): resolve TLS/SNI handshake failure preventing repository clone` - **Milestone**: v3.6.0 - **Parent Epic**: *(to be linked — see orphan note below)* --- ### Background and Context The Test Infrastructure Improver agent is unable to clone the `cleveragents/cleveragents-core` repository via HTTPS. All clone attempts fail at the TLS handshake stage with an SNI (Server Name Indication) recognition error from `git.cleveragents.com`. This completely blocks any automated analysis or improvement of the test infrastructure. ### Current Behavior All attempts to clone the repository fail with the following error: ``` gnutls_handshake() failed: The server name sent was not recognized ``` **Steps to Reproduce:** 1. Attempt to clone the repository using HTTPS: ```bash git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git ``` 2. The clone fails with the TLS/SNI error. **Diagnostics:** - The error is reproducible with `curl -v https://git.cleveragents.com/cleveragents/cleveragents-core.git`, which returns `TLSv1.3 (IN), TLS alert, unrecognized name (624)`. - Attempts to bypass SSL verification using `git -c http.sslVerify=false` and `GIT_SSL_NO_VERIFY=true` were unsuccessful and resulted in the same error. - The SNI mismatch suggests the TLS certificate served by the host does not include `git.cleveragents.com` as a Subject Alternative Name (SAN), or the reverse proxy/load balancer is not routing the SNI correctly. ### Expected Behavior `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully without TLS errors, and the repository is cloned to the local filesystem. ### Acceptance Criteria - [ ] `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without TLS errors from a clean environment. - [ ] `curl -v https://git.cleveragents.com` completes the TLS handshake successfully (no `unrecognized name` alert). - [ ] The TLS certificate served for `git.cleveragents.com` includes the hostname as a valid SAN. - [ ] The fix is verified in the CI/CD environment used by automated agents. ## Subtasks - [ ] Investigate TLS certificate configuration for `git.cleveragents.com` — confirm whether the hostname is present as a SAN. - [ ] Investigate reverse proxy / load balancer SNI routing configuration for `git.cleveragents.com`. - [ ] Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction). - [ ] Verify the fix by re-running `curl -v https://git.cleveragents.com` and a full `git clone` from the agent environment. - [ ] Document the root cause and resolution in the relevant infrastructure runbook. ## Definition of Done - [ ] All subtasks above are completed and checked off. - [ ] `git clone` succeeds without TLS errors from the automated agent environment. - [ ] A Git commit is created where the **first line** of the commit message matches the **Commit Message** in Metadata exactly. - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass - Coverage >= 97% ### Supporting Information - **Impact:** This is a **blocking issue** for the Test Infrastructure Improver agent. No automated analysis or improvement of the test infrastructure can be performed until this is resolved. - **Recommendation:** Investigate the TLS/SNI configuration for `git.cleveragents.com` to ensure it correctly handles requests for this hostname. Check the TLS certificate's Subject Alternative Names and the SNI routing in any reverse proxy (e.g., nginx, Caddy, HAProxy) sitting in front of the Forgejo instance. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.6.0 milestone

2026-04-02 23:09:53 +00:00

freemo commented

2026-04-02 23:10:30 +00:00

Author

Owner

⚠️ Orphan Issue — Manual Linking Required

No parent Epic was provided when this issue was created. Per CONTRIBUTING.md, orphan issues are not permitted. A maintainer must:

Identify the appropriate parent Epic for this infrastructure/TLS blocker work.
On this issue (#1607), add the parent Epic under the "blocks" dependency section (child blocks parent — correct direction per CONTRIBUTING.md).

If no suitable Epic exists, one should be created first, then this issue linked to it.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

⚠️ **Orphan Issue — Manual Linking Required** No parent Epic was provided when this issue was created. Per `CONTRIBUTING.md`, orphan issues are not permitted. A maintainer must: 1. Identify the appropriate parent Epic for this infrastructure/TLS blocker work. 2. On **this issue (#1607)**, add the parent Epic under the **"blocks"** dependency section (child blocks parent — correct direction per CONTRIBUTING.md). If no suitable Epic exists, one should be created first, then this issue linked to it. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo commented

2026-04-02 23:16:13 +00:00

Author

Owner

Closing as duplicate of #1543.

This issue reports the same TLS/SNI clone failure that is already tracked in #1543 (Priority/Critical, MoSCoW/Must Have, v3.7.0). All work should be consolidated there.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This issue reports the same TLS/SNI clone failure that is already tracked in #1543 (Priority/Critical, MoSCoW/Must Have, v3.7.0). All work should be consolidated there. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:16:50 +00:00