TEST-INFRA: [ci-config] Unable to clone repository due to TLS/SSL handshake failure #1637

Closed
opened 2026-04-02 23:20:45 +00:00 by freemo · 2 comments
Owner

Metadata

  • Branch: fix/ci-tls-ssl-handshake-failure
  • Commit Message: fix(ci): resolve TLS/SSL handshake failure preventing repository clone on git.cleveragents.com
  • Milestone: v3.7.0
  • Parent Epic: (orphan — no TEST-INFRA Epic currently exists; requires manual linking)

User Story

As a Test Infrastructure Improver, I need to be able to clone the cleveragents/cleveragents-core repository so that I can analyze the test infrastructure and identify areas for improvement.

Reproduction Steps

  1. Attempt to clone the repository using the HTTPS URL:
    git clone https://<FORGEJO_PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git
    
  2. The command fails with the following error:
    fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized
    
  3. Attempt to clone the repository with SSL verification disabled:
    GIT_SSL_NO_VERIFY=true git clone https://<FORGEJO_PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git
    
  4. The command fails with the same error.
  5. Resolve the IP address of git.cleveragents.com to 13.248.169.48.
  6. Attempt to clone the repository using the IP address and disabling SSL verification:
    git -c http.sslVerify=false clone https://<FORGEJO_PAT>@13.248.169.48/cleveragents/cleveragents-core.git
    
  7. The command fails with the same error.

Expected Behavior

The git clone command should successfully clone the repository.

Actual Behavior

The git clone command fails with a gnutls_handshake() failed: The server name sent was not recognized error, preventing access to the repository.

Impact

This issue completely blocks the Test Infrastructure Improver from performing its duties, as it cannot access the source code to analyze the test infrastructure.

Recommendation

Investigate the TLS/SSL configuration of the git.cleveragents.com server to ensure that it is correctly configured and that the server name is recognized.

⚠️ Note on Duplicates: Similar issues already exist: #1615, #1626, #1629, #1630. This issue was created by an automated agent and may warrant consolidation with one of the above.

Subtasks

  • Investigate the TLS/SSL (SNI) configuration on git.cleveragents.com to identify the root cause of the gnutls_handshake() failed: The server name sent was not recognized error
  • Verify that the server certificate includes the correct Subject Alternative Names (SANs) for git.cleveragents.com
  • Test repository clone via SSH as an alternative to HTTPS if TLS cannot be resolved quickly
  • Update CI pipeline configuration to use the correct host/protocol once resolved
  • Verify that the automated test infrastructure agent can successfully clone the repository after the fix

Definition of Done

  • The cleveragents/cleveragents-core repository can be cloned successfully via HTTPS from git.cleveragents.com
  • No gnutls_handshake() or SSL/TLS errors occur during clone operations
  • CI pipeline clone steps pass without SSL verification workarounds
  • A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly
  • The commit is pushed to the remote on the branch matching the Branch in Metadata exactly
  • The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done
  • All nox stages pass
  • Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/ci-tls-ssl-handshake-failure` - **Commit Message**: `fix(ci): resolve TLS/SSL handshake failure preventing repository clone on git.cleveragents.com` - **Milestone**: v3.7.0 - **Parent Epic**: *(orphan — no TEST-INFRA Epic currently exists; requires manual linking)* --- ## User Story As a Test Infrastructure Improver, I need to be able to clone the `cleveragents/cleveragents-core` repository so that I can analyze the test infrastructure and identify areas for improvement. ## Reproduction Steps 1. Attempt to clone the repository using the HTTPS URL: ```bash git clone https://<FORGEJO_PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git ``` 2. The command fails with the following error: ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` 3. Attempt to clone the repository with SSL verification disabled: ```bash GIT_SSL_NO_VERIFY=true git clone https://<FORGEJO_PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git ``` 4. The command fails with the same error. 5. Resolve the IP address of `git.cleveragents.com` to `13.248.169.48`. 6. Attempt to clone the repository using the IP address and disabling SSL verification: ```bash git -c http.sslVerify=false clone https://<FORGEJO_PAT>@13.248.169.48/cleveragents/cleveragents-core.git ``` 7. The command fails with the same error. ## Expected Behavior The `git clone` command should successfully clone the repository. ## Actual Behavior The `git clone` command fails with a `gnutls_handshake() failed: The server name sent was not recognized` error, preventing access to the repository. ## Impact This issue completely blocks the Test Infrastructure Improver from performing its duties, as it cannot access the source code to analyze the test infrastructure. ## Recommendation Investigate the TLS/SSL configuration of the `git.cleveragents.com` server to ensure that it is correctly configured and that the server name is recognized. > ⚠️ **Note on Duplicates**: Similar issues already exist: #1615, #1626, #1629, #1630. This issue was created by an automated agent and may warrant consolidation with one of the above. ## Subtasks - [ ] Investigate the TLS/SSL (SNI) configuration on `git.cleveragents.com` to identify the root cause of the `gnutls_handshake() failed: The server name sent was not recognized` error - [ ] Verify that the server certificate includes the correct Subject Alternative Names (SANs) for `git.cleveragents.com` - [ ] Test repository clone via SSH as an alternative to HTTPS if TLS cannot be resolved quickly - [ ] Update CI pipeline configuration to use the correct host/protocol once resolved - [ ] Verify that the automated test infrastructure agent can successfully clone the repository after the fix ## Definition of Done - [ ] The `cleveragents/cleveragents-core` repository can be cloned successfully via HTTPS from `git.cleveragents.com` - [ ] No `gnutls_handshake()` or SSL/TLS errors occur during clone operations - [ ] CI pipeline clone steps pass without SSL verification workarounds - [ ] A Git commit is created where the **first line** of the commit message matches the **Commit Message** in Metadata exactly - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done - All nox stages pass - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
freemo added this to the v3.7.0 milestone 2026-04-02 23:21:06 +00:00
Author
Owner

⚠️ Orphan Issue — Manual Linking Required

This issue has no parent Epic to link to. Per CONTRIBUTING.md, orphan issues are not permitted when a parent exists. A TEST-INFRA Epic does not currently exist in the repository.

Action Required: A project owner should either:

  1. Create a TEST-INFRA Epic and link this issue as a child (this issue should block the parent Epic), or
  2. Link this issue to an existing relevant Epic.

Additionally, this issue may be a duplicate of one or more existing issues tracking the same TLS/SSL clone failure:

  • #1615 — TEST-INFRA: [ci-execution-time] Git clone fails with TLS error
  • #1626 — TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to SSL/TLS configuration issue
  • #1629 — TEST-INFRA: Git repository is inaccessible due to TLS/SNI error
  • #1630 — TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to TLS/SNI issue

Consider consolidating these issues to reduce noise.


Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

⚠️ **Orphan Issue — Manual Linking Required** This issue has no parent Epic to link to. Per `CONTRIBUTING.md`, orphan issues are not permitted when a parent exists. A TEST-INFRA Epic does not currently exist in the repository. **Action Required**: A project owner should either: 1. Create a TEST-INFRA Epic and link this issue as a child (this issue should **block** the parent Epic), or 2. Link this issue to an existing relevant Epic. Additionally, this issue may be a **duplicate** of one or more existing issues tracking the same TLS/SSL clone failure: - #1615 — TEST-INFRA: [ci-execution-time] Git clone fails with TLS error - #1626 — TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to SSL/TLS configuration issue - #1629 — TEST-INFRA: Git repository is inaccessible due to TLS/SNI error - #1630 — TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to TLS/SNI issue Consider consolidating these issues to reduce noise. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
Author
Owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have.


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
freemo 2026-04-02 23:30:29 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cleveragents/cleveragents-core#1637
No description provided.