TEST-INFRA: [ci-execution-time] Unable to clone repository due to TLS/SNI issue #1699

Closed
opened 2026-04-02 23:31:18 +00:00 by freemo · 1 comment
Owner

Metadata

  • Branch: fix/ci-tls-sni-clone-failure
  • Commit Message: fix(ci): resolve TLS/SNI handshake failure preventing repository clone
  • Milestone: v3.8.0
  • Parent Epic: #1678

Background and Context

The git server at git.cleveragents.com is not configured correctly for TLS/SNI. This prevents cloning the repository and performing any analysis in CI.

Current Behavior

Attempting to clone the repository fails with a TLS/SNI handshake error. The server name sent during the TLS handshake is not recognized by the server, causing the connection to be rejected.

Error message:
gnutls_handshake() failed: The server name sent was not recognized

Steps to reproduce:

  1. Try to clone the repository using git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git
  2. The clone fails with the error message above.

Debugging steps taken:

  • Verified that the host is reachable using ping.
  • Used curl -v to inspect the TLS handshake, which confirmed the "unrecognized name" error.
  • Tried to clone using the IP address and disabling SSL verification (GIT_SSL_NO_VERIFY=true and http.sslVerify=false).
  • Tried to download the repository as a zip file using wget --no-check-certificate.
  • All attempts failed with the same TLS error.

Expected Behavior

The repository should be cloneable via HTTPS without TLS/SNI errors. CI pipelines and local development workflows that depend on cloning the repository should succeed.

Acceptance Criteria

  • git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git completes successfully without TLS errors.
  • The TLS/SNI configuration on the git server is corrected so that the server name is recognized during the handshake.
  • CI pipelines that clone the repository pass without TLS-related failures.
  • No workarounds (e.g., GIT_SSL_NO_VERIFY, http.sslVerify=false) are required.

Supporting Information

This issue is blocking all work that requires access to the repository code, including CI execution time optimization work tracked under Epic #1678.

Subtasks

  • Investigate and identify the root cause of the TLS/SNI misconfiguration on git.cleveragents.com
  • Apply the correct TLS/SNI server configuration fix (e.g., correct virtual host / SNI binding)
  • Verify that git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git succeeds
  • Verify that CI pipelines that depend on cloning the repository pass end-to-end
  • Run nox (all default sessions), fix any errors
  • Verify coverage >= 97% via nox -s coverage_report

Definition of Done

This issue is complete when:

  • All subtasks above are completed and checked off.
  • A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly (fix(ci): resolve TLS/SNI handshake failure preventing repository clone), followed by a blank line, then additional lines providing relevant details about the implementation.
  • The commit is pushed to the remote on the branch matching the Branch in Metadata exactly (fix/ci-tls-sni-clone-failure).
  • The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
  • All nox stages pass.
  • Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/ci-tls-sni-clone-failure` - **Commit Message**: `fix(ci): resolve TLS/SNI handshake failure preventing repository clone` - **Milestone**: v3.8.0 - **Parent Epic**: #1678 ## Background and Context The git server at `git.cleveragents.com` is not configured correctly for TLS/SNI. This prevents cloning the repository and performing any analysis in CI. ## Current Behavior Attempting to clone the repository fails with a TLS/SNI handshake error. The server name sent during the TLS handshake is not recognized by the server, causing the connection to be rejected. **Error message:** `gnutls_handshake() failed: The server name sent was not recognized` **Steps to reproduce:** 1. Try to clone the repository using `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` 2. The clone fails with the error message above. **Debugging steps taken:** * Verified that the host is reachable using `ping`. * Used `curl -v` to inspect the TLS handshake, which confirmed the "unrecognized name" error. * Tried to clone using the IP address and disabling SSL verification (`GIT_SSL_NO_VERIFY=true` and `http.sslVerify=false`). * Tried to download the repository as a zip file using `wget --no-check-certificate`. * All attempts failed with the same TLS error. ## Expected Behavior The repository should be cloneable via HTTPS without TLS/SNI errors. CI pipelines and local development workflows that depend on cloning the repository should succeed. ## Acceptance Criteria - [ ] `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` completes successfully without TLS errors. - [ ] The TLS/SNI configuration on the git server is corrected so that the server name is recognized during the handshake. - [ ] CI pipelines that clone the repository pass without TLS-related failures. - [ ] No workarounds (e.g., `GIT_SSL_NO_VERIFY`, `http.sslVerify=false`) are required. ## Supporting Information This issue is blocking all work that requires access to the repository code, including CI execution time optimization work tracked under Epic #1678. ## Subtasks - [ ] Investigate and identify the root cause of the TLS/SNI misconfiguration on `git.cleveragents.com` - [ ] Apply the correct TLS/SNI server configuration fix (e.g., correct virtual host / SNI binding) - [ ] Verify that `git clone https://git.cleveragents.com/cleveragents/cleveragents-core.git` succeeds - [ ] Verify that CI pipelines that depend on cloning the repository pass end-to-end - [ ] Run `nox` (all default sessions), fix any errors - [ ] Verify coverage >= 97% via `nox -s coverage_report` ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly (`fix(ci): resolve TLS/SNI handshake failure preventing repository clone`), followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly (`fix/ci-tls-sni-clone-failure`). - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator
freemo added this to the v3.6.0 milestone 2026-04-02 23:31:39 +00:00
freemo modified the milestone from v3.6.0 to v3.8.0 2026-04-02 23:32:15 +00:00
Author
Owner

Closing as duplicate of #1543 (TLS/clone failure — Priority/Critical, MoSCoW/Must Have).


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Closing as duplicate of #1543 (TLS/clone failure — Priority/Critical, MoSCoW/Must Have). --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
freemo 2026-04-02 23:41:26 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
cleveragents/cleveragents-core#1699
No description provided.