cleveragents/cleveragents-core

Fork 3

TEST-INFRA: [ci-execution-time] Blocking issue: Unable to clone repository due to TLS/SNI issue #1663

New issue

Closed

opened 2026-04-02 23:25:26 +00:00 by freemo · 3 comments

freemo commented

2026-04-02 23:25:26 +00:00

Owner

Metadata

Branch: fix/ci-execution-time-tls-sni-clone-failure
Commit Message: fix(infra): resolve TLS SNI handshake failure blocking repository clone on git.cleveragents.com
Milestone: v3.6.0
Parent Epic: #376

Background and Context

While investigating CI execution time improvements (see #1620), automated analysis was blocked entirely because the repository at git.cleveragents.com cannot be cloned due to a TLS/SNI (Server Name Indication) handshake failure. The server does not recognise the hostname sent during the TLS handshake, causing all HTTPS-based git operations to fail.

This is a blocking issue — no CI execution time analysis, parallelism investigation, or pipeline improvements can proceed until the repository is accessible.

⚠️ Possible duplicate notice: This issue may overlap with #1615 ("TEST-INFRA: [ci-execution-time] Git clone fails with TLS error"). Please review both issues and close one as a duplicate if appropriate.

Current Behavior

All attempts to clone the repository fail at the TLS handshake stage with an SNI error.

Error from git clone:

Cloning into '/tmp/ca-test-infra-...'...
fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized

Error from curl:

*   Trying 13.248.169.48:443...
* Connected to git.cleveragents.com (13.248.169.48) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, unrecognized name (624):
* OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name
* Closing connection 0
curl: (35) OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name

This is a server-side configuration issue with the TLS/SNI setup for git.cleveragents.com. The server is not recognising the hostname during the TLS handshake.

Expected Behavior

git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully without TLS errors, and the repository is cloned to the local filesystem. All automated CI agents and tooling can access the repository over HTTPS.

Acceptance Criteria

git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git succeeds without TLS errors from a clean environment.
curl -v https://git.cleveragents.com completes the TLS handshake successfully (no unrecognized name alert).
The TLS certificate served for git.cleveragents.com includes the hostname as a valid Subject Alternative Name (SAN).
The fix is verified in the CI/CD environment used by automated agents.
Downstream CI execution time analysis (see #1620) is unblocked.

Subtasks

Investigate TLS certificate configuration for git.cleveragents.com — confirm whether the hostname is present as a SAN.
Investigate reverse proxy / load balancer SNI routing configuration for git.cleveragents.com.
Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction).
Verify the fix by re-running curl -v https://git.cleveragents.com and a full git clone from the agent environment.
Document the root cause and resolution in the relevant infrastructure runbook.
Run nox (all default sessions), fix any errors.
Verify coverage >= 97% via nox -s coverage_report.

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
git clone succeeds without TLS errors from the automated agent environment.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/ci-execution-time-tls-sni-clone-failure` - **Commit Message**: `fix(infra): resolve TLS SNI handshake failure blocking repository clone on git.cleveragents.com` - **Milestone**: v3.6.0 - **Parent Epic**: #376 ## Background and Context While investigating CI execution time improvements (see #1620), automated analysis was blocked entirely because the repository at `git.cleveragents.com` cannot be cloned due to a TLS/SNI (Server Name Indication) handshake failure. The server does not recognise the hostname sent during the TLS handshake, causing all HTTPS-based git operations to fail. This is a **blocking issue** — no CI execution time analysis, parallelism investigation, or pipeline improvements can proceed until the repository is accessible. > ⚠️ **Possible duplicate notice**: This issue may overlap with #1615 ("TEST-INFRA: [ci-execution-time] Git clone fails with TLS error"). Please review both issues and close one as a duplicate if appropriate. ## Current Behavior All attempts to clone the repository fail at the TLS handshake stage with an SNI error. **Error from git clone:** ``` Cloning into '/tmp/ca-test-infra-...'... fatal: unable to access 'https://git.cleveragents.com/cleveragents/cleveragents-core.git/': gnutls_handshake() failed: The server name sent was not recognized ``` **Error from curl:** ``` * Trying 13.248.169.48:443... * Connected to git.cleveragents.com (13.248.169.48) port 443 (#0) * ALPN: offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS alert, unrecognized name (624): * OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name * Closing connection 0 curl: (35) OpenSSL/3.0.18: error:0A000458:SSL routines::tlsv1 unrecognized name ``` This is a server-side configuration issue with the TLS/SNI setup for `git.cleveragents.com`. The server is not recognising the hostname during the TLS handshake. ## Expected Behavior `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully without TLS errors, and the repository is cloned to the local filesystem. All automated CI agents and tooling can access the repository over HTTPS. ## Acceptance Criteria - [ ] `git clone https://<token>@git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds without TLS errors from a clean environment. - [ ] `curl -v https://git.cleveragents.com` completes the TLS handshake successfully (no `unrecognized name` alert). - [ ] The TLS certificate served for `git.cleveragents.com` includes the hostname as a valid Subject Alternative Name (SAN). - [ ] The fix is verified in the CI/CD environment used by automated agents. - [ ] Downstream CI execution time analysis (see #1620) is unblocked. ## Subtasks - [ ] Investigate TLS certificate configuration for `git.cleveragents.com` — confirm whether the hostname is present as a SAN. - [ ] Investigate reverse proxy / load balancer SNI routing configuration for `git.cleveragents.com`. - [ ] Apply the necessary fix (certificate reissue, SNI passthrough config, or virtual host correction). - [ ] Verify the fix by re-running `curl -v https://git.cleveragents.com` and a full `git clone` from the agent environment. - [ ] Document the root cause and resolution in the relevant infrastructure runbook. - [ ] Run `nox` (all default sessions), fix any errors. - [ ] Verify coverage >= 97% via `nox -s coverage_report`. ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - `git clone` succeeds without TLS errors from the automated agent environment. - A Git commit is created where the **first line** of the commit message matches the **Commit Message** in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.6.0 milestone

2026-04-02 23:25:34 +00:00

freemo referenced this issue

2026-04-02 23:26:47 +00:00

GIT-INFRA: [BLOCKER] Git clone fails with TLS handshake error #1666

freemo referenced this issue

2026-04-02 23:28:19 +00:00

GIT-INFRA: [BLOCKER] Git clone fails with TLS handshake error #1666

freemo commented

2026-04-02 23:30:14 +00:00

Author

Owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543. This TLS/clone failure is already tracked as Priority/Critical, MoSCoW/Must Have. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo

2026-04-02 23:30:14 +00:00

closed this issue
added the
State
Duplicate
label

freemo referenced this issue

2026-04-02 23:30:48 +00:00

TEST-INFRA: [ci-execution-time] Unable to clone repository #1694

freemo added a new dependency

2026-04-02 23:32:53 +00:00

#376 Legendary: Hardening, Testing & Security

freemo added a new dependency

2026-04-02 23:33:29 +00:00

#1620 TEST-INFRA: [ci-execution-time] Investigate increasing parallelism for unit and integration tests

freemo commented

2026-04-02 23:33:46 +00:00

Author

Owner

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem.

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1543. Issue #1543 is the canonical tracking issue for the TLS/git-clone failure. Multiple issues have been filed about the same underlying TLS configuration problem. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo commented

2026-04-02 23:39:12 +00:00

Author

Owner

Closing as duplicate. This issue was marked State/Duplicate indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure).

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate. This issue was marked `State/Duplicate` indicating it duplicates an existing TLS/repository clone failure issue. The canonical issue tracking this problem is #1532 (BUG-HUNT: TLS Configuration Error on git.cleveragents.com) and/or #1543 (fix(infra): resolve TLS handshake failure). --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo referenced this issue

2026-04-02 23:40:27 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463

freemo referenced this issue

2026-04-02 23:55:03 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463