cleveragents/cleveragents-core

Fork 3

CRITICAL: Git clone fails in automated environment due to TLS/SNI issue #1640

New issue

Closed

opened 2026-04-02 23:21:57 +00:00 by freemo · 2 comments

freemo commented

2026-04-02 23:21:57 +00:00

Owner

Metadata

Branch: fix/v3.6.0-tls-sni-git-clone-automated-env
Commit Message: fix(infra): resolve TLS/SNI handshake failure blocking git clone in automated environments
Milestone: v3.6.0
Parent Epic: #376

Background and Context

The ca-test-infra-improver agent is unable to clone the cleveragents/cleveragents-core repository in its automated environment. All attempts to clone the repository fail with a consistent TLS handshake error:

fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

This is a critical infrastructure issue that completely prevents any automated analysis of the codebase, including coverage analysis, CI pipeline checks, and other quality gates. The root cause is an SNI (Server Name Indication) misconfiguration on the git.cleveragents.com server — the server's TLS certificate does not include git.cleveragents.com as a recognised Subject Alternative Name (SAN), or the virtual-host/SNI routing is misconfigured server-side.

Note: Related issues already exist: #1532, #1543, #1615, #1629, #1630. This issue captures the full troubleshooting context from the ca-test-infra-improver agent including all failed workaround attempts.

Current Behavior

All attempts to clone the repository fail at the TLS handshake stage. The following workarounds were attempted and all failed with the same error:

1. Standard Clone:

git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git

2. Clone with SSL Verification Disabled:

git -c http.sslVerify=false clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git

3. Clone using Direct IP Address (to bypass SNI):

SERVER_IP=$(getent hosts git.cleveragents.com | awk '{ print $1 }' | head -n 1)
git -c http.sslVerify=false clone https://<PAT>@${SERVER_IP}/cleveragents/cleveragents-core.git \
  --config "http.https://${SERVER_IP}.extraheader=Host: git.cleveragents.com"

4. Clone with Global Git Config:
Setting http.sslVerify and http.extraheader globally before cloning.

All four approaches fail with the same gnutls_handshake() failed: The server name sent was not recognized error.

Expected Behavior

git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git should succeed without TLS errors. The server's TLS certificate must include git.cleveragents.com as a valid SAN, and SNI routing must be correctly configured.

Acceptance Criteria

git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without TLS errors
The server certificate includes git.cleveragents.com as a valid Subject Alternative Name (SAN)
SNI routing is correctly configured on the git.cleveragents.com server
Automated agents (e.g., ca-test-infra-improver) can successfully clone the repository
CI/CD pipelines that depend on cloning this repository are unblocked

Supporting Information

Related issue (different subdomain): #1543 — fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com
Related issue (same domain, less detail): #1615 — TEST-INFRA: [ci-execution-time] Git clone fails with TLS error
Related issue (BUG-HUNT): #1532 — BUG-HUNT: [Infrastructure] TLS Configuration Error on git.cleveragents.com
Related issues (recent duplicates): #1629, #1630
Recommendation: Investigate the TLS/SSL configuration of the git.cleveragents.com server. Check server logs for SNI routing errors. Ensure the certificate covers all required hostnames.

Subtasks

Investigate TLS/SSL configuration on git.cleveragents.com server
Verify server certificate SANs include git.cleveragents.com
Fix SNI routing configuration or renew/reissue certificate with correct SANs
Verify fix: git clone succeeds from automated environment
Verify fix: all related issues (#1532, #1543, #1615, #1629, #1630) are resolved or closed as duplicates
Run nox (all default sessions), fix any errors
Verify coverage >= 97% via nox -s coverage_report

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/v3.6.0-tls-sni-git-clone-automated-env` - **Commit Message**: `fix(infra): resolve TLS/SNI handshake failure blocking git clone in automated environments` - **Milestone**: v3.6.0 - **Parent Epic**: #376 ## Background and Context The `ca-test-infra-improver` agent is unable to clone the `cleveragents/cleveragents-core` repository in its automated environment. All attempts to clone the repository fail with a consistent TLS handshake error: ``` fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` This is a critical infrastructure issue that completely prevents any automated analysis of the codebase, including coverage analysis, CI pipeline checks, and other quality gates. The root cause is an SNI (Server Name Indication) misconfiguration on the `git.cleveragents.com` server — the server's TLS certificate does not include `git.cleveragents.com` as a recognised Subject Alternative Name (SAN), or the virtual-host/SNI routing is misconfigured server-side. > **Note:** Related issues already exist: #1532, #1543, #1615, #1629, #1630. This issue captures the full troubleshooting context from the `ca-test-infra-improver` agent including all failed workaround attempts. ## Current Behavior All attempts to clone the repository fail at the TLS handshake stage. The following workarounds were attempted and all failed with the same error: **1. Standard Clone:** ```bash git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git ``` **2. Clone with SSL Verification Disabled:** ```bash git -c http.sslVerify=false clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git ``` **3. Clone using Direct IP Address (to bypass SNI):** ```bash SERVER_IP=$(getent hosts git.cleveragents.com | awk '{ print $1 }' | head -n 1) git -c http.sslVerify=false clone https://<PAT>@${SERVER_IP}/cleveragents/cleveragents-core.git \ --config "http.https://${SERVER_IP}.extraheader=Host: git.cleveragents.com" ``` **4. Clone with Global Git Config:** Setting `http.sslVerify` and `http.extraheader` globally before cloning. All four approaches fail with the same `gnutls_handshake() failed: The server name sent was not recognized` error. ## Expected Behavior `git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git` should succeed without TLS errors. The server's TLS certificate must include `git.cleveragents.com` as a valid SAN, and SNI routing must be correctly configured. ## Acceptance Criteria - [ ] `git clone https://<PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without TLS errors - [ ] The server certificate includes `git.cleveragents.com` as a valid Subject Alternative Name (SAN) - [ ] SNI routing is correctly configured on the `git.cleveragents.com` server - [ ] Automated agents (e.g., `ca-test-infra-improver`) can successfully clone the repository - [ ] CI/CD pipelines that depend on cloning this repository are unblocked ## Supporting Information - Related issue (different subdomain): #1543 — `fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com` - Related issue (same domain, less detail): #1615 — `TEST-INFRA: [ci-execution-time] Git clone fails with TLS error` - Related issue (BUG-HUNT): #1532 — `BUG-HUNT: [Infrastructure] TLS Configuration Error on git.cleveragents.com` - Related issues (recent duplicates): #1629, #1630 - **Recommendation**: Investigate the TLS/SSL configuration of the `git.cleveragents.com` server. Check server logs for SNI routing errors. Ensure the certificate covers all required hostnames. ## Subtasks - [ ] Investigate TLS/SSL configuration on `git.cleveragents.com` server - [ ] Verify server certificate SANs include `git.cleveragents.com` - [ ] Fix SNI routing configuration or renew/reissue certificate with correct SANs - [ ] Verify fix: `git clone` succeeds from automated environment - [ ] Verify fix: all related issues (#1532, #1543, #1615, #1629, #1630) are resolved or closed as duplicates - [ ] Run `nox` (all default sessions), fix any errors - [ ] Verify coverage >= 97% via `nox -s coverage_report` ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.6.0 milestone

2026-04-02 23:24:05 +00:00

freemo referenced this issue

2026-04-02 23:26:47 +00:00

GIT-INFRA: [BLOCKER] Git clone fails with TLS handshake error #1666

freemo added a new dependency

2026-04-02 23:27:58 +00:00

#376 Legendary: Hardening, Testing & Security

freemo referenced this issue

2026-04-02 23:28:19 +00:00

GIT-INFRA: [BLOCKER] Git clone fails with TLS handshake error #1666

freemo referenced this issue

2026-04-02 23:29:38 +00:00

CRITICAL: Unable to clone repository cleveragents/cleveragents-core #1686

freemo commented

2026-04-02 23:30:26 +00:00

Author

Owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:30:27 +00:00

closed this issue
added the
State
Duplicate
label

freemo commented

2026-04-02 23:33:38 +00:00

Author

Owner

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem.

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo referenced this issue

2026-04-02 23:40:27 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463