[Bug]: TCP transport logs client cert common name at ERROR level on every request

What happened?

When the TCP transport is used with TLS client certificates (mutual TLS), the request server logs the client certificate's common name at ERROR level on every request it receives. This is an informational event, not an error, so it floods the master log with false ERROR entries — one per job return / auth from every minion.

The offending call is in SaltMessageServer.handle_message in salt/transport/tcp.py:

  async def handle_message(self, stream, payload, header=None):
      try:
          cert = stream.socket.getpeercert()
      except AttributeError:
          pass
      else:
          if cert:
              name = salt.transport.base.common_name(cert)
              log.error("Request client cert %r", name)   # <-- wrong level

Setup

• Salt 3008.2 (Argon), onedir package, RHEL 8.10
• transport: tcp
• TLS enabled with mutual auth:
  master: ssl { cert_reqs: CERT_REQUIRED, ca_certs: }
  minions present a client certfile/keyfile (cert_reqs: CERT_NONE)
• Hardened RHEL 8. ( FIPS enabled, fapolicyd enabled, selinux enabled )

Steps to Reproduce the behavior

1. Configure the master and minions for transport: tcp with SSL and client certificates
   (mutual TLS).
2. Start the services and let minions authenticate / return jobs.
3. Tail the master log: tail -f /var/log/salt/master

Expected behavior
A normal, valid client-cert request should not produce a log entry at all, or at most a
debug/trace entry. Nothing about a successful cert presentation is an error.

Actual behavior / logs
Every request emits an ERROR line. Example (hostname redacted):

2026-09-08 15:56:57,529 [salt.transport.tcp:769 ][ERROR ][1285384] Request client cert '*.example.internal'

Suggested fix
Change log.error(...) to log.trace(...) (or log.debug), or remove the line — it
appears to be leftover debug instrumentation.

Type of salt install

Official rpm

Major version

3008.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

rhel-8

salt --versions-report output

Salt Version:
            Salt: 3008.2

  Python Version:
          Python: 3.14.6 (main, Jun 11 2026, 02:19:05) [GCC 11.2.0]

            cffi: 2.0.0
        cherrypy: 18.10.0
    cryptography: 48.0.0
        dateutil: 2.9.0.post0
           gitdb: 4.0.12
       gitpython: 3.1.50
          Jinja2: 3.1.6
    looseversion: 1.3.0
         msgpack: 1.1.2
       packaging: 24.0
       pycparser: 3.00
    pycryptodome: 3.23.0
    python-gnupg: 0.5.6
          PyYAML: 6.0.3
           PyZMQ: 27.1.0
          relenv: 0.22.14
           smmap: 5.0.2
         timelib: 0.3.0
         Tornado: 6.5.7
             ZMQ: 4.3.5

  Salt Package Information:
    Package Type: onedir

  System Versions:
            dist: rhel 8.10 Ootpa
          locale: utf-8
         machine: x86_64
         release: 4.18.0-553.156.1.el8_10.x86_64
          system: Linux
         version: Red Hat Enterprise Linux 8.10 Ootpa

Open salt/transport/tcp.py and inspect SaltMessageServer.handle_message, especially the client-certificate logging call. Reproduce a mutual-TLS request if needed and confirm that valid client certificates no longer emit an ERROR entry; the message should be removed or logged at debug/trace level.