cleveragents/cleveragents-core

Fork 3

TEST-INFRA: [CI] Git clone fails with TLS handshake error #1659

New issue

Closed

opened 2026-04-02 23:24:53 +00:00 by freemo · 3 comments

freemo commented

2026-04-02 23:24:53 +00:00

Owner

Metadata

Branch: fix/ci-tls-handshake-git-clone-failure
Commit Message: fix(ci): resolve TLS handshake error blocking git clone on git.cleveragents.com
Milestone: v3.7.0
Parent Epic: #1630

⚠️ DUPLICATE WARNING: This issue describes the same root cause as several existing open issues: #1615, #1626, #1629, #1630, #1636, #1637. All track the gnutls_handshake() failed: The server name sent was not recognized error on git.cleveragents.com. A project maintainer should consolidate these into a single canonical issue and close the duplicates. This issue was created by an automated agent acting on an explicit request.

Description

The git clone command fails with a TLS handshake error, completely blocking all test infrastructure analysis. The server at git.cleveragents.com does not recognise the SNI name sent by the client during the TLS handshake.

Command:

git clone https://<FORGEJO_PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git

Error:

Cloning into '/tmp/ca-test-infra-7210-1775171717'...
fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

This error occurs even when SSL verification is disabled (GIT_SSL_NO_VERIFY=true), indicating a server-side SNI configuration problem rather than a certificate trust issue.

Impact

This issue completely blocks the Test Infrastructure agent from performing its duties — it cannot access the source code to analyse the test infrastructure.

Subtasks

Investigate TLS/SNI configuration on git.cleveragents.com — confirm whether the hostname is present as a valid SAN (Subject Alternative Name) in the TLS certificate
Investigate reverse proxy / load balancer SNI routing configuration for git.cleveragents.com
Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction)
Verify the fix by running curl -v https://git.cleveragents.com and a full git clone from the agent environment
Update CI pipeline configuration to use the correct host/protocol once resolved
Document the root cause and resolution in the relevant infrastructure runbook
Run nox (all default sessions) and fix any errors

Definition of Done

The cleveragents/cleveragents-core repository can be cloned successfully via HTTPS from git.cleveragents.com without TLS errors
curl -v https://git.cleveragents.com completes the TLS handshake successfully (no unrecognized name alert)
CI pipeline clone steps pass without SSL verification workarounds
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/ci-tls-handshake-git-clone-failure` - **Commit Message**: `fix(ci): resolve TLS handshake error blocking git clone on git.cleveragents.com` - **Milestone**: v3.7.0 - **Parent Epic**: #1630 > ⚠️ **DUPLICATE WARNING**: This issue describes the same root cause as several existing open issues: #1615, #1626, #1629, #1630, #1636, #1637. All track the `gnutls_handshake() failed: The server name sent was not recognized` error on `git.cleveragents.com`. A project maintainer should consolidate these into a single canonical issue and close the duplicates. This issue was created by an automated agent acting on an explicit request. ## Description The `git clone` command fails with a TLS handshake error, completely blocking all test infrastructure analysis. The server at `git.cleveragents.com` does not recognise the SNI name sent by the client during the TLS handshake. **Command:** ```bash git clone https://<FORGEJO_PAT>@git.cleveragents.com/cleveragents/cleveragents-core.git ``` **Error:** ``` Cloning into '/tmp/ca-test-infra-7210-1775171717'... fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` This error occurs even when SSL verification is disabled (`GIT_SSL_NO_VERIFY=true`), indicating a server-side SNI configuration problem rather than a certificate trust issue. ## Impact This issue completely blocks the Test Infrastructure agent from performing its duties — it cannot access the source code to analyse the test infrastructure. ## Subtasks - [ ] Investigate TLS/SNI configuration on `git.cleveragents.com` — confirm whether the hostname is present as a valid SAN (Subject Alternative Name) in the TLS certificate - [ ] Investigate reverse proxy / load balancer SNI routing configuration for `git.cleveragents.com` - [ ] Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction) - [ ] Verify the fix by running `curl -v https://git.cleveragents.com` and a full `git clone` from the agent environment - [ ] Update CI pipeline configuration to use the correct host/protocol once resolved - [ ] Document the root cause and resolution in the relevant infrastructure runbook - [ ] Run `nox` (all default sessions) and fix any errors ## Definition of Done - [ ] The `cleveragents/cleveragents-core` repository can be cloned successfully via HTTPS from `git.cleveragents.com` without TLS errors - [ ] `curl -v https://git.cleveragents.com` completes the TLS handshake successfully (no `unrecognized name` alert) - [ ] CI pipeline clone steps pass without SSL verification workarounds - [ ] A Git commit is created where the **first line** of the commit message matches the **Commit Message** in Metadata exactly - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done - All nox stages pass - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.7.0 milestone

2026-04-02 23:25:06 +00:00

freemo referenced this issue

2026-04-02 23:26:47 +00:00

GIT-INFRA: [BLOCKER] Git clone fails with TLS handshake error #1666

freemo added a new dependency

2026-04-02 23:28:00 +00:00

#1630 TEST-INFRA: [ci-pipeline-design] Unable to clone repository due to TLS/SNI issue

freemo referenced this issue

2026-04-02 23:28:19 +00:00

GIT-INFRA: [BLOCKER] Git clone fails with TLS handshake error #1666

freemo commented

2026-04-02 23:30:16 +00:00

Author

Owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:30:17 +00:00

closed this issue
added the
State
Duplicate
label

freemo referenced this issue

2026-04-02 23:30:48 +00:00

TEST-INFRA: [ci-execution-time] Unable to clone repository #1694

freemo commented

2026-04-02 23:33:44 +00:00

Author

Owner

Closing as duplicate of #1543. This issue already has the duplicate label. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure.

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1543. This issue already has the `duplicate` label. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo commented

2026-04-02 23:39:13 +00:00

Author

Owner

Closing as duplicate. This issue was marked State/Duplicate indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure).

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate. This issue was marked `State/Duplicate` indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure). --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo referenced this issue

2026-04-02 23:40:27 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463

freemo referenced this issue

2026-04-02 23:55:03 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463