Fix TLS certificate check test failures #4190

New issue

Open

opened 2026-04-06 23:13:57 +00:00 by freemo · 0 comments

freemo commented

2026-04-06 23:13:57 +00:00

Owner

Problem

The TLS certificate check tests in features/tls_certificate_check.feature are currently failing and have been tagged with @tdd_expected_fail to allow CI to pass.

Tests Affected

All 13 scenarios in features/tls_certificate_check.feature that are marked with @tdd_issue @tdd_issue_1543:

Script detects missing SAN for git.dev.cleveragents.com
Script passes when hostname is present in SANs
Script detects expired certificate
Script warns when certificate expires within threshold
Script does not warn when certificate expires beyond threshold
Script reports TLS handshake failure as an error
Script reports connection timeout as an error
Script reports connection refused as an error
Script accepts wildcard SAN matching the hostname
Script rejects wildcard SAN that does not match the hostname
_hostname_matches_san returns True for exact match
_hostname_matches_san returns False when hostname is absent
_hostname_matches_san accepts wildcard for single-level subdomain

Root Cause

Issue #1543 reports that the TLS handshake failure on git.dev.cleveragents.com was caused by the hostname being absent from the certificate's Subject Alternative Names (SANs). The test scenarios verify that the check script correctly detects this condition and reports it as an error.

Definition of Done

Investigate why the TLS certificate check tests are failing
Fix the underlying issue causing test failures
Remove @tdd_expected_fail tags from all scenarios
Verify all tests pass without the expected fail tags
CI shows all tests passing

Priority

Medium - These tests verify important TLS certificate validation functionality for CleverAgents infrastructure.

Labels

Type/Bug
Priority/Medium
Component/Testing
TDD/Expected-Fail

## Problem The TLS certificate check tests in `features/tls_certificate_check.feature` are currently failing and have been tagged with `@tdd_expected_fail` to allow CI to pass. ## Tests Affected All 13 scenarios in `features/tls_certificate_check.feature` that are marked with `@tdd_issue @tdd_issue_1543`: - Script detects missing SAN for git.dev.cleveragents.com - Script passes when hostname is present in SANs - Script detects expired certificate - Script warns when certificate expires within threshold - Script does not warn when certificate expires beyond threshold - Script reports TLS handshake failure as an error - Script reports connection timeout as an error - Script reports connection refused as an error - Script accepts wildcard SAN matching the hostname - Script rejects wildcard SAN that does not match the hostname - _hostname_matches_san returns True for exact match - _hostname_matches_san returns False when hostname is absent - _hostname_matches_san accepts wildcard for single-level subdomain ## Root Cause Issue #1543 reports that the TLS handshake failure on git.dev.cleveragents.com was caused by the hostname being absent from the certificate's Subject Alternative Names (SANs). The test scenarios verify that the check script correctly detects this condition and reports it as an error. ## Definition of Done 1. [ ] Investigate why the TLS certificate check tests are failing 2. [ ] Fix the underlying issue causing test failures 3. [ ] Remove `@tdd_expected_fail` tags from all scenarios 4. [ ] Verify all tests pass without the expected fail tags 5. [ ] CI shows all tests passing ## Priority Medium - These tests verify important TLS certificate validation functionality for CleverAgents infrastructure. ## Labels - Type/Bug - Priority/Medium - Component/Testing - TDD/Expected-Fail

Rows
Columns