TEST-INFRA: [ci-execution-time] Git clone fails with TLS error #1615

Closed
opened 2026-04-02 23:13:36 +00:00 by freemo · 2 comments
Owner

Metadata

  • Branch: fix/v3.6.0-tls-sni-git-clone-failure
  • Commit Message: fix(infra): resolve TLS SNI error preventing git clone on git.cleveragents.com
  • Milestone: v3.6.0
  • Parent Epic: (to be linked — see orphan note below)

Background and Context

The git clone command is failing with a TLS error, preventing any analysis of the test infrastructure. This appears to be an SNI (Server Name Indication) issue with the git server at git.cleveragents.com. The TLS handshake fails because the server does not recognise the SNI name sent by the client, which completely blocks automated agents from cloning the repository.

Current Behavior

All attempts to clone the repository fail at the TLS handshake stage.

Error from git clone:

fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

Error from curl:

* TLSv1.3 (IN), TLS alert, unrecognized name (624):
* OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name

This needs to be resolved before any test infrastructure analysis can be performed.

Expected Behavior

git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully without TLS errors, and the repository is cloned to the local filesystem.

Acceptance Criteria

  • git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without TLS errors from a clean environment.
  • curl -v https://git.cleveragents.com completes the TLS handshake successfully (no unrecognized name alert).
  • The TLS certificate served for git.cleveragents.com includes the hostname as a valid SAN (Subject Alternative Name).
  • The fix is verified in the CI/CD environment used by automated agents.

Subtasks

  • Investigate TLS certificate configuration for git.cleveragents.com — confirm whether the hostname is present as a SAN.
  • Investigate reverse proxy / load balancer SNI routing configuration for git.cleveragents.com.
  • Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction).
  • Verify the fix by re-running curl -v https://git.cleveragents.com and a full git clone from the agent environment.
  • Document the root cause and resolution in the relevant infrastructure runbook.
  • Run nox (all default sessions), fix any errors.

Definition of Done

  • All subtasks above are completed and checked off.
  • git clone succeeds without TLS errors from the automated agent environment.
  • A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
  • The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
  • The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
  • All nox stages pass
  • Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/v3.6.0-tls-sni-git-clone-failure` - **Commit Message**: `fix(infra): resolve TLS SNI error preventing git clone on git.cleveragents.com` - **Milestone**: v3.6.0 - **Parent Epic**: *(to be linked — see orphan note below)* --- ### Background and Context The git clone command is failing with a TLS error, preventing any analysis of the test infrastructure. This appears to be an SNI (Server Name Indication) issue with the git server at `git.cleveragents.com`. The TLS handshake fails because the server does not recognise the SNI name sent by the client, which completely blocks automated agents from cloning the repository. ### Current Behavior All attempts to clone the repository fail at the TLS handshake stage. **Error from git clone:** ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` **Error from curl:** ``` * TLSv1.3 (IN), TLS alert, unrecognized name (624): * OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name ``` This needs to be resolved before any test infrastructure analysis can be performed. ### Expected Behavior `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully without TLS errors, and the repository is cloned to the local filesystem. ### Acceptance Criteria - [ ] `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without TLS errors from a clean environment. - [ ] `curl -v https://git.cleveragents.com` completes the TLS handshake successfully (no `unrecognized name` alert). - [ ] The TLS certificate served for `git.cleveragents.com` includes the hostname as a valid SAN (Subject Alternative Name). - [ ] The fix is verified in the CI/CD environment used by automated agents. ## Subtasks - [ ] Investigate TLS certificate configuration for `git.cleveragents.com` — confirm whether the hostname is present as a SAN. - [ ] Investigate reverse proxy / load balancer SNI routing configuration for `git.cleveragents.com`. - [ ] Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction). - [ ] Verify the fix by re-running `curl -v https://git.cleveragents.com` and a full `git clone` from the agent environment. - [ ] Document the root cause and resolution in the relevant infrastructure runbook. - [ ] Run `nox` (all default sessions), fix any errors. ## Definition of Done - [ ] All subtasks above are completed and checked off. - [ ] `git clone` succeeds without TLS errors from the automated agent environment. - [ ] A Git commit is created where the **first line** of the commit message matches the **Commit Message** in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
freemo added this to the v3.6.0 milestone 2026-04-02 23:14:01 +00:00
Author
Owner

⚠️ Orphan Issue — Manual Linking Required

This issue could not be automatically linked to a parent Epic because no open Type/Epic issues currently exist in the cleveragents/cleveragents-core repository.

Per CONTRIBUTING.md, orphan issues are not permitted. A project owner must:

  1. Identify or create the appropriate parent Epic for this TEST-INFRA TLS/SNI work.
  2. Link this issue as a dependency of that Epic (this issue blocks the parent Epic).

Until this is resolved, this issue is flagged as an orphan.


Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

⚠️ **Orphan Issue — Manual Linking Required** This issue could not be automatically linked to a parent Epic because no open `Type/Epic` issues currently exist in the `cleveragents/cleveragents-core` repository. Per `CONTRIBUTING.md`, orphan issues are **not permitted**. A project owner must: 1. Identify or create the appropriate parent Epic for this TEST-INFRA TLS/SNI work. 2. Link this issue as a dependency of that Epic (this issue **blocks** the parent Epic). Until this is resolved, this issue is flagged as an orphan. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
Author
Owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have.


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
freemo 2026-04-02 23:30:38 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cleveragents/cleveragents-core#1615
No description provided.