TEST-INFRA: [ci-execution-time] CRITICAL: Git repository is inaccessible due to TLS/SNI misconfiguration #1645

Closed
opened 2026-04-02 23:22:29 +00:00 by freemo · 4 comments
Owner

Metadata

  • Branch: fix/tls-sni-git-repository-inaccessible
  • Commit Message: fix(infra): resolve TLS/SNI misconfiguration blocking git repository access
  • Milestone: v3.6.0
  • Parent Epic: (to be linked — see orphan note below)

Background and Context

The git repository at git.cleveragents.com is currently inaccessible due to a TLS/SNI (Server Name Indication) misconfiguration. This is a CRITICAL blocker affecting all developers and CI/CD systems that need to access the source code. The TLS handshake fails because the server does not recognise the SNI name sent by the client, completely preventing repository cloning and any downstream CI operations.

⚠️ Note on potential duplicates: Related issues exist at #1615, #1629, #1630, #1636, #1637, #1626, and #1543. This issue captures the same root cause with full CRITICAL severity context and the exact error messages observed. The project owner should evaluate consolidation.

Current Behavior

All attempts to clone the repository fail at the TLS handshake stage.

Error Message (git clone):

gnutls_handshake() failed: The server name sent was not recognized

Error Message (curl):

* TLSv1.3 (IN), TLS alert, unrecognized name (624):
* OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name

This blocks all developers and CI/CD systems from accessing the source code.

Expected Behavior

git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully without TLS errors, and the repository is accessible from all environments.

Acceptance Criteria

  • git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without TLS errors from a clean environment.
  • curl -v https://git.cleveragents.com completes the TLS handshake successfully (no unrecognized name alert).
  • The TLS certificate served for git.cleveragents.com includes the hostname as a valid SAN (Subject Alternative Name).
  • The fix is verified in the CI/CD environment used by automated agents.
  • All developers can access the repository without TLS errors.

Subtasks

  • Investigate TLS certificate configuration for git.cleveragents.com — confirm whether the hostname is present as a SAN.
  • Investigate reverse proxy / load balancer SNI routing configuration for git.cleveragents.com.
  • Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction).
  • Verify the fix by re-running curl -v https://git.cleveragents.com and a full git clone from the agent environment.
  • Verify fix works from all CI/CD environments.
  • Document the root cause and resolution in the relevant infrastructure runbook.
  • Run nox (all default sessions), fix any errors.

Definition of Done

  • All subtasks above are completed and checked off.
  • git clone succeeds without TLS errors from all developer and CI/CD environments.
  • A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
  • The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
  • The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
  • All nox stages pass
  • Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/tls-sni-git-repository-inaccessible` - **Commit Message**: `fix(infra): resolve TLS/SNI misconfiguration blocking git repository access` - **Milestone**: v3.6.0 - **Parent Epic**: *(to be linked — see orphan note below)* --- ### Background and Context The git repository at `git.cleveragents.com` is currently inaccessible due to a TLS/SNI (Server Name Indication) misconfiguration. This is a **CRITICAL** blocker affecting all developers and CI/CD systems that need to access the source code. The TLS handshake fails because the server does not recognise the SNI name sent by the client, completely preventing repository cloning and any downstream CI operations. > ⚠️ **Note on potential duplicates**: Related issues exist at #1615, #1629, #1630, #1636, #1637, #1626, and #1543. This issue captures the same root cause with full CRITICAL severity context and the exact error messages observed. The project owner should evaluate consolidation. ### Current Behavior All attempts to clone the repository fail at the TLS handshake stage. **Error Message (git clone):** ``` gnutls_handshake() failed: The server name sent was not recognized ``` **Error Message (curl):** ``` * TLSv1.3 (IN), TLS alert, unrecognized name (624): * OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name ``` This blocks **all** developers and CI/CD systems from accessing the source code. ### Expected Behavior `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully without TLS errors, and the repository is accessible from all environments. ### Acceptance Criteria - [ ] `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without TLS errors from a clean environment. - [ ] `curl -v https://git.cleveragents.com` completes the TLS handshake successfully (no `unrecognized name` alert). - [ ] The TLS certificate served for `git.cleveragents.com` includes the hostname as a valid SAN (Subject Alternative Name). - [ ] The fix is verified in the CI/CD environment used by automated agents. - [ ] All developers can access the repository without TLS errors. ## Subtasks - [ ] Investigate TLS certificate configuration for `git.cleveragents.com` — confirm whether the hostname is present as a SAN. - [ ] Investigate reverse proxy / load balancer SNI routing configuration for `git.cleveragents.com`. - [ ] Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction). - [ ] Verify the fix by re-running `curl -v https://git.cleveragents.com` and a full `git clone` from the agent environment. - [ ] Verify fix works from all CI/CD environments. - [ ] Document the root cause and resolution in the relevant infrastructure runbook. - [ ] Run `nox` (all default sessions), fix any errors. ## Definition of Done - [ ] All subtasks above are completed and checked off. - [ ] `git clone` succeeds without TLS errors from all developer and CI/CD environments. - [ ] A Git commit is created where the **first line** of the commit message matches the **Commit Message** in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
freemo added this to the v3.6.0 milestone 2026-04-02 23:22:44 +00:00
Author
Owner

⚠️ Orphan Issue — Manual Linking Required

This issue was created without a parent Epic because no Type/Epic issue was found in the repository for the TEST-INFRA category. Per CONTRIBUTING.md, orphan issues are not permitted — this issue must be linked to a parent Epic once one is identified or created.

Action required by project owner:

  1. Identify or create a TEST-INFRA parent Epic.
  2. Set this issue (#1645) as blocking that Epic (child blocks parent).

Additionally, the project owner should evaluate consolidation with these related open issues covering the same TLS/SNI root cause:

  • #1615 — TEST-INFRA: [ci-execution-time] Git clone fails with TLS error (Priority/High, v3.6.0)
  • #1629 — TEST-INFRA: Git repository is inaccessible due to TLS/SNI error (Priority/High, v3.7.0)
  • #1630 — TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to TLS/SNI issue (Priority/High, v3.8.0)
  • #1636 — TEST-INFRA: [CI] Git clone fails due to TLS/SNI issue (no labels/milestone)
  • #1637 — TEST-INFRA: [ci-config] Unable to clone repository due to TLS/SSL handshake failure (no labels/milestone)
  • #1626 — TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to SSL/TLS configuration issue (Priority/Critical, v3.7.0)
  • #1543 — fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com (Priority/Critical, State/Verified, v3.7.0)

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

⚠️ **Orphan Issue — Manual Linking Required** This issue was created without a parent Epic because no `Type/Epic` issue was found in the repository for the TEST-INFRA category. Per `CONTRIBUTING.md`, orphan issues are not permitted — this issue must be linked to a parent Epic once one is identified or created. **Action required by project owner:** 1. Identify or create a TEST-INFRA parent Epic. 2. Set this issue (#1645) as **blocking** that Epic (child blocks parent). **Additionally**, the project owner should evaluate consolidation with these related open issues covering the same TLS/SNI root cause: - #1615 — TEST-INFRA: [ci-execution-time] Git clone fails with TLS error (Priority/High, v3.6.0) - #1629 — TEST-INFRA: Git repository is inaccessible due to TLS/SNI error (Priority/High, v3.7.0) - #1630 — TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to TLS/SNI issue (Priority/High, v3.8.0) - #1636 — TEST-INFRA: [CI] Git clone fails due to TLS/SNI issue (no labels/milestone) - #1637 — TEST-INFRA: [ci-config] Unable to clone repository due to TLS/SSL handshake failure (no labels/milestone) - #1626 — TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to SSL/TLS configuration issue (Priority/Critical, v3.7.0) - #1543 — fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com (Priority/Critical, State/Verified, v3.7.0) --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
Author
Owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have.


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
freemo 2026-04-02 23:30:25 +00:00
Author
Owner

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem.


Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer
Author
Owner

Closing as duplicate. This issue was marked State/Duplicate indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure).


Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate. This issue was marked `State/Duplicate` indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure). --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cleveragents/cleveragents-core#1645
No description provided.