don't know how to build these paths: /nix/store/472gbxlwa3klgwby3l8fdzgnrcij40ri-container-test-run-certificates.drv warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/p3dcq3n3kc0jr9ibrgianpxdr22r686b-system-path.drv' on nix-store.geninf.io:50051 system-path> build01: building p3dcq3n3kc0jr9ibrgianpxdr22r686b-system-path.drv system-path> structuredAttrs is enabled system-path> created 1716 symlinks in user environment building '/nix/store/s2c7g2hygqzz21ymb0frg1ilipv8ibbg-nginx.conf.drv' on nix-store.geninf.io:50051 nginx.conf> build01: building s2c7g2hygqzz21ymb0frg1ilipv8ibbg-nginx.conf.drv building '/nix/store/s6j2bfczfbl44ra5g6ziym808d78l4d8-nginx.conf.drv' on nix-store.geninf.io:50051 nginx.conf> build01: building s6j2bfczfbl44ra5g6ziym808d78l4d8-nginx.conf.drv building '/nix/store/s5wjmd9sv86r3i8l2dmg5qxy0v88829q-system-path.drv' on nix-store.geninf.io:50051 system-path> build01: building s5wjmd9sv86r3i8l2dmg5qxy0v88829q-system-path.drv building '/nix/store/19y1v6wqfp33vrj83gkgb7p6flmsjihd-system-path.drv' on nix-store.geninf.io:50051 system-path> build01: building 19y1v6wqfp33vrj83gkgb7p6flmsjihd-system-path.drv nginx.conf> structuredAttrs is enabled nginx.conf> structuredAttrs is enabled system-path> structuredAttrs is enabled system-path> structuredAttrs is enabled system-path> created 1716 symlinks in user environment system-path> created 1716 symlinks in user environment nginx.conf> nginx.conf> ==================== Results =================== nginx.conf> No issues found. nginx.conf> nginx.conf> ==================== Summary =================== nginx.conf> Total issues: nginx.conf> Unspecified: 0 nginx.conf> Low: 0 nginx.conf> Medium: 0 nginx.conf> High: 0 nginx.conf> nginx.conf> nginx.conf> ==================== Results =================== nginx.conf> No issues found. nginx.conf> nginx.conf> ==================== Summary =================== nginx.conf> Total issues: nginx.conf> Unspecified: 0 nginx.conf> Low: 0 nginx.conf> Medium: 0 nginx.conf> High: 0 nginx.conf> building '/nix/store/9bvmql487gdr1c7v2s3g0jha1pbfgz4p-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build01: building 9bvmql487gdr1c7v2s3g0jha1pbfgz4p-dbus-1.drv building '/nix/store/0c8fjav3r1knd3yjfq4p6zjxg3qm8p7b-unit-script-nginx-pre-start.drv' on nix-store.geninf.io:50051 unit-script-nginx-pre-start> build01: building 0c8fjav3r1knd3yjfq4p6zjxg3qm8p7b-unit-script-nginx-pre-start.drv building '/nix/store/p89lhsm2sdjrnifv4mmhkrg9d0cbc6gv-unit-script-nginx-pre-start.drv' on nix-store.geninf.io:50051 unit-script-nginx-pre-start> build01: building p89lhsm2sdjrnifv4mmhkrg9d0cbc6gv-unit-script-nginx-pre-start.drv unit-script-nginx-pre-start> structuredAttrs is enabled unit-script-nginx-pre-start> structuredAttrs is enabled building '/nix/store/85mvg5wvs0vhna1z19lh2l1n9k98z6mn-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build01: building 85mvg5wvs0vhna1z19lh2l1n9k98z6mn-dbus-1.drv building '/nix/store/6bd10ppnzw6a7r6j66y5gmq5arvbddbi-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build01: building 6bd10ppnzw6a7r6j66y5gmq5arvbddbi-dbus-1.drv building '/nix/store/5mp749xzbaqgss52d9jhi6bm6qa9rdn4-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build01: building 5mp749xzbaqgss52d9jhi6bm6qa9rdn4-X-Restart-Triggers-dbus-broker.drv building '/nix/store/58dc2z92sld5l0809y80nxprgcsdq73m-unit-nginx.service.drv' on nix-store.geninf.io:50051 unit-nginx.service> build01: building 58dc2z92sld5l0809y80nxprgcsdq73m-unit-nginx.service.drv building '/nix/store/8ipd9rmjx22r11filwycp8lapb3bpw15-unit-nginx.service.drv' on nix-store.geninf.io:50051 unit-nginx.service> build01: building 8ipd9rmjx22r11filwycp8lapb3bpw15-unit-nginx.service.drv unit-nginx.service> structuredAttrs is enabled unit-nginx.service> structuredAttrs is enabled X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/liyv1n351ri2wrb3s9ya0l1gi95rn5sd-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build01: building liyv1n351ri2wrb3s9ya0l1gi95rn5sd-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/kh4scj57dnzf0jrfw506mq7jbl4snsd8-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build01: building kh4scj57dnzf0jrfw506mq7jbl4snsd8-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/61a51k3s83y3xx08g5ihb6xfnyscbyb9-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building 61a51k3s83y3xx08g5ihb6xfnyscbyb9-unit-dbus-broker.service.drv building '/nix/store/9wpz7pakdm8h1f7s29haw0xgmazljm5i-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building 9wpz7pakdm8h1f7s29haw0xgmazljm5i-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/46yrv4yk61zkbpzr7rhlb0idn1yyzgh5-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building 46yrv4yk61zkbpzr7rhlb0idn1yyzgh5-unit-dbus-broker.service.drv building '/nix/store/b94y39zv7xyliq9h82k7gl7pcpmlv0c1-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building b94y39zv7xyliq9h82k7gl7pcpmlv0c1-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/6rrn9ywh26p56w9zsmx5m9vmbxygj6rw-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building 6rrn9ywh26p56w9zsmx5m9vmbxygj6rw-unit-dbus-broker.service.drv building '/nix/store/xs241qddg9jrkm7zkzrpkgkq07gzc1d5-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building xs241qddg9jrkm7zkzrpkgkq07gzc1d5-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/h1qjak90lzlzpc8b0s23y331z4x1wz5i-user-units.drv' on nix-store.geninf.io:50051 user-units> build01: building h1qjak90lzlzpc8b0s23y331z4x1wz5i-user-units.drv building '/nix/store/grl58g73yf719wx7g1vnvn3nz169bh89-system-units.drv' on nix-store.geninf.io:50051 system-units> build01: building grl58g73yf719wx7g1vnvn3nz169bh89-system-units.drv building '/nix/store/2s6l1kq6kr1kd1zdqf4jsa62s2a5d6v1-user-units.drv' on nix-store.geninf.io:50051 user-units> build01: building 2s6l1kq6kr1kd1zdqf4jsa62s2a5d6v1-user-units.drv building '/nix/store/5phdgcq918p7hh8qwjkn8cs8iznqmqvx-system-units.drv' on nix-store.geninf.io:50051 system-units> build01: building 5phdgcq918p7hh8qwjkn8cs8iznqmqvx-system-units.drv building '/nix/store/axajn5sk537kfrr9iw82j7hz3fbbh8z3-system-units.drv' on nix-store.geninf.io:50051 system-units> build01: building axajn5sk537kfrr9iw82j7hz3fbbh8z3-system-units.drv building '/nix/store/42zpgqf7gil5bxyyp41a120s0gag0wba-user-units.drv' on nix-store.geninf.io:50051 user-units> build01: building 42zpgqf7gil5bxyyp41a120s0gag0wba-user-units.drv building '/nix/store/sd98h81qa9106mlddd06im6j1cfglfak-etc.drv' on nix-store.geninf.io:50051 etc> build01: building sd98h81qa9106mlddd06im6j1cfglfak-etc.drv building '/nix/store/w861gbvm4m9qpdg5nxgzbp6aphn08mas-etc.drv' on nix-store.geninf.io:50051 etc> build01: building w861gbvm4m9qpdg5nxgzbp6aphn08mas-etc.drv building '/nix/store/jfg84j8vh4dbyvvz2ac6iiynv0xmfi0n-etc.drv' on nix-store.geninf.io:50051 etc> build01: building jfg84j8vh4dbyvvz2ac6iiynv0xmfi0n-etc.drv building '/nix/store/9j5h89mjnl8vn9biapnh0msdc7i5v95d-activate.drv' on nix-store.geninf.io:50051 activate> build01: building 9j5h89mjnl8vn9biapnh0msdc7i5v95d-activate.drv activate> structuredAttrs is enabled building '/nix/store/jm5vf4iaxc8hn3jl239im4bsi7haf69j-activate.drv' on nix-store.geninf.io:50051 activate> build01: building jm5vf4iaxc8hn3jl239im4bsi7haf69j-activate.drv activate> structuredAttrs is enabled building '/nix/store/7qb1j06p6py9dwwww1lcbpp00kxyydcn-activate.drv' on nix-store.geninf.io:50051 activate> build01: building 7qb1j06p6py9dwwww1lcbpp00kxyydcn-activate.drv activate> structuredAttrs is enabled building '/nix/store/3q6r1z5r0cx3kg2a6fh7m1qswf1nkn6m-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> build01: building 3q6r1z5r0cx3kg2a6fh7m1qswf1nkn6m-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/sp4r43xz57llpqp40i8n7cnp0wn8xn3h-nixos-system-client-test.drv' on nix-store.geninf.io:50051 nixos-system-client-test> build01: building sp4r43xz57llpqp40i8n7cnp0wn8xn3h-nixos-system-client-test.drv nixos-system-client-test> structuredAttrs is enabled building '/nix/store/awjsswya2gqq14nhd68kd5zw5w5w9bi8-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> build01: building awjsswya2gqq14nhd68kd5zw5w5w9bi8-nixos-system-server-test.drv nixos-system-server-test> structuredAttrs is enabled building '/nix/store/4f1815b82ql3c5qi89xn1azqym8ziqp6-run-ca-nspawn.drv' on nix-store.geninf.io:50051 run-ca-nspawn> build01: building 4f1815b82ql3c5qi89xn1azqym8ziqp6-run-ca-nspawn.drv building '/nix/store/545ipikxcpzvq0bbjnxznk87zki4brk0-run-client-nspawn.drv' on nix-store.geninf.io:50051 run-client-nspawn> build01: building 545ipikxcpzvq0bbjnxznk87zki4brk0-run-client-nspawn.drv building '/nix/store/2xdygdvbr2imk6mm36mkqa9573yffqyx-run-server-nspawn.drv' on nix-store.geninf.io:50051 run-server-nspawn> build01: building 2xdygdvbr2imk6mm36mkqa9573yffqyx-run-server-nspawn.drv building '/nix/store/gnj645x58si8d7xdn6i7jp5phwf90psm-driverConfiguration.json.drv' on nix-store.geninf.io:50051 driverConfiguration.json> build01: building gnj645x58si8d7xdn6i7jp5phwf90psm-driverConfiguration.json.drv driverConfiguration.json> structuredAttrs is enabled building '/nix/store/qqr2p0vfppsplg9f9qb8x1h8qj1zsgd4-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> build01: building qqr2p0vfppsplg9f9qb8x1h8qj1zsgd4-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/472gbxlwa3klgwby3l8fdzgnrcij40ri-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build01: building 472gbxlwa3klgwby3l8fdzgnrcij40ri-container-test-run-certificates.drv container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [38521.062129] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [38521.062186] ca systemd-journald[81]: Runtime Journal (/run/log/journal/f5ea0e56ba6d40a0ad219e139a6ad032) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> ca # [38521.086597] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [38521.100261] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [38521.114728] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [38521.115621] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [38521.116734] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [38521.124077] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/f5ea0e56ba6d40a0ad219e139a6ad032 is 1.181ms for 7 entries. container-test-run-certificates> ca # [38521.124077] ca systemd-journald[81]: System Journal (/var/log/journal/f5ea0e56ba6d40a0ad219e139a6ad032) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [38521.141577] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [38521.142054] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [38521.143309] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [38521.143411] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [38521.144255] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [38521.144316] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [38521.145207] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [38521.145985] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [38521.146023] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [38521.160592] ca systemd-tmpfiles[151]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [38521.160752] ca systemd-tmpfiles[151]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [38521.160857] ca systemd-tmpfiles[151]: fchmod() of /var/log/journal/f5ea0e56ba6d40a0ad219e139a6ad032 failed: Operation not permitted container-test-run-certificates> ca # [38521.161010] ca systemd-tmpfiles[151]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [38521.162446] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [38521.163566] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [38521.164450] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [38521.175683] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [38521.182239] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [38521.185741] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [38521.186859] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [38521.196865] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [38521.222795] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [38521.222967] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [38521.223183] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [38521.224353] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [38522.060080] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [38522.101945] ca systemd-networkd[199]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [38522.102038] ca systemd-networkd[199]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [38522.115204] ca systemd-networkd[199]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [38522.115377] ca systemd-networkd[199]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [38522.115538] ca systemd-networkd[199]: lo: Link UP container-test-run-certificates> ca # [38522.115543] ca systemd-networkd[199]: lo: Gained carrier container-test-run-certificates> ca # [38522.115752] ca systemd-networkd[199]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [38522.116145] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [38522.116222] ca systemd-networkd[199]: eth1: Link UP container-test-run-certificates> ca # [38522.116541] ca systemd-networkd[199]: eth1: Gained carrier container-test-run-certificates> ca # [38522.117149] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [38522.141962] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [38522.756057] ca systemd-resolved[128]: Positive Trust Anchors: container-test-run-certificates> ca # [38522.756070] ca systemd-resolved[128]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [38522.756075] ca systemd-resolved[128]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [38522.756120] ca systemd-resolved[128]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [38522.779671] ca systemd-resolved[128]: Using system hostname 'ca'. container-test-run-certificates> ca # [38522.781139] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [38522.781275] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [38522.781393] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [38522.781494] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [38522.781904] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [38522.781961] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [38522.782007] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [38522.782052] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [38522.782295] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [38522.782504] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [38522.782726] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [38522.782805] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [38522.782895] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [38522.785178] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [38522.786599] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [38522.786674] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [38522.788315] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [38522.790226] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [38522.792709] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [38522.808450] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [38523.031512] ca acme-setup-privileged[204]: + set -euo pipefail container-test-run-certificates> ca # [38523.031512] ca acme-setup-privileged[204]: + cd /var/lib/acme container-test-run-certificates> ca # [38523.031512] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [38523.033218] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [38523.035303] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [38523.035303] ca acme-setup-privileged[204]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [38523.035421] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [38523.035421] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [38523.197864] ca nsncd[206]: Oct 16 20:05:28.169 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [38523.197887] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [38523.197964] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [38523.198025] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [38523.199920] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [38523.200789] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [38523.259306] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [38523.261061] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [38523.261137] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [38523.261176] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [38523.498308] ca dbus-broker-launch[212]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [38523.499828] ca dbus-broker-launch[212]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [38523.499828] ca dbus-broker-launch[212]: Invalid user-name in /nix/store/19pyxqiwhnmmdkwgpmhlvk3qkxswxw3v-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [38523.500238] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [38523.507294] ca dbus-broker-launch[212]: Ready container-test-run-certificates> ca # [38523.708415] ca systemd-networkd[199]: eth1: Gained IPv6LL container-test-run-certificates> ca # [38524.270579] ca acme-setup-start[222]: + set -euo pipefail container-test-run-certificates> ca # [38524.270579] ca acme-setup-start[222]: + test -e ca/key.pem container-test-run-certificates> ca # [38524.271003] ca acme-setup-start[222]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [38524.271884] ca systemd-logind[238]: New seat seat0. container-test-run-certificates> ca # [38524.272126] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [38524.274381] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [38524.320479] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [38524.324188] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [38524.328825] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [38524.329162] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [38524.657449] ca step-ca[207]: badger 2026/10/16 20:05:29 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [38524.662615] ca step-ca[207]: 2026/10/16 20:05:29 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [38524.668059] ca step-ca[207]: 2026/10/16 20:05:29 Starting Smallstep CA/0.30.2 (linux/arm64) container-test-run-certificates> ca # [38524.668059] ca step-ca[207]: 2026/10/16 20:05:29 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [38524.668059] ca step-ca[207]: 2026/10/16 20:05:29 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [38524.668059] ca step-ca[207]: 2026/10/16 20:05:29 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [38524.668059] ca step-ca[207]: 2026/10/16 20:05:29 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [38524.668059] ca step-ca[207]: 2026/10/16 20:05:29 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [38524.668059] ca step-ca[207]: 2026/10/16 20:05:29 X.509 Root Fingerprint: 137d8173c35112c0105e02d18918e70953da0eedb7ead14cdca50a680b599c66 container-test-run-certificates> ca # [38524.668884] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [38524.669213] ca step-ca[207]: 2026/10/16 20:05:29 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [38525.244150] ca acme-ca.foo-start[258]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [38525.247548] ca acme-ca.foo-start[258]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [38525.247548] ca acme-ca.foo-start[258]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [38525.262892] ca acme-ca.foo-start[297]: + cd ca.foo container-test-run-certificates> ca # [38525.263340] ca acme-ca.foo-start[297]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [38525.264948] ca acme-ca.foo-start[298]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [38525.265259] ca acme-ca.foo-start[297]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [38525.266733] ca acme-ca.foo-start[297]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [38525.266983] ca acme-ca.foo-start[258]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [38525.269052] ca acme-ca.foo-start[258]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [38525.270856] ca acme-ca.foo-start[258]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [38525.272363] ca acme-ca.foo-start[258]: + for fixpath in out certificates container-test-run-certificates> ca # [38525.272402] ca acme-ca.foo-start[258]: + '[' -d out ']' container-test-run-certificates> ca # [38525.272402] ca acme-ca.foo-start[258]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [38525.274181] ca acme-ca.foo-start[258]: + chown -R acme:nginx out container-test-run-certificates> ca # [38525.278155] ca acme-ca.foo-start[258]: + for fixpath in out certificates container-test-run-certificates> ca # [38525.278186] ca acme-ca.foo-start[258]: + '[' -d certificates ']' container-test-run-certificates> ca # [38525.284093] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [38525.286786] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [38526.188379] ca nginx-pre-start[309]: nginx: the configuration file /nix/store/msh0hy9fb7r49jxrh4xff7g1fmrr6ck9-nginx.conf syntax is ok container-test-run-certificates> ca # [38526.189003] ca nginx-pre-start[309]: nginx: configuration file /nix/store/msh0hy9fb7r49jxrh4xff7g1fmrr6ck9-nginx.conf test is successful container-test-run-certificates> ca # [38526.195273] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [38526.196234] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [38526.198360] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [38527.074692] ca acme-order-renew-ca.foo-start[312]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [38527.078098] ca acme-order-renew-ca.foo-start[312]: + set -euo pipefail container-test-run-certificates> ca # [38527.078243] ca acme-order-renew-ca.foo-start[312]: + exec container-test-run-certificates> ca # [38527.078291] ca acme-order-renew-ca.foo-start[312]: + /nix/store/vf2h24m5aa7phb4v1kbc2qd9r41jdfqv-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [38527.080195] ca acme-order-renew-ca.foo-start[324]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [38527.083147] ca acme-order-renew-ca.foo-start[312]: + '[' -n '' ']' container-test-run-certificates> ca # [38527.083201] ca acme-order-renew-ca.foo-start[312]: + exec container-test-run-certificates> ca # [38527.083261] ca acme-order-renew-ca.foo-start[312]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [38527.083308] ca acme-order-renew-ca.foo-start[312]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [38527.108190] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.080011989Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [38527.135333] ca step-ca[207]: time="2026-10-16T20:05:32Z" level=info duration="161.123µs" duration-ns=161123 fields.time="2026-10-16T20:05:32Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=37a49407-f35b-4926-8cbb-2e3af2adbcb9 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38527.135792] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.107636891Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [38527.136785] ca step-ca[207]: time="2026-10-16T20:05:32Z" level=info duration="792.131µs" duration-ns=792131 fields.time="2026-10-16T20:05:32Z" method=HEAD name=ca nonce=dTBjcDUwQ3RCT3EyZEhhVWo2dmlSMnQyVEs5QmduSlY path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=ec64b372-6647-4d88-9c8d-735c59ce21d2 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38527.139167] ca step-ca[207]: time="2026-10-16T20:05:32Z" level=info duration=1.807105ms duration-ns=1807105 fields.time="2026-10-16T20:05:32Z" method=POST name=ca nonce=SlBIa0cwMGlFTVBMY2daVWJ2ZVhyRWZiWXhSU3FYeXo path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=2573325c-c78e-4486-b978-0aec5ec86ccf response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/LbDFWjkzXUqxF0qAHSBl6SuhlLCscSeR/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38527.139834] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.111688307Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [38527.139834] ca acme-order-renew-ca.foo-start[325]: Your account credentials have been saved in your container-test-run-certificates> ca # [38527.139834] ca acme-order-renew-ca.foo-start[325]: configuration directory at "accounts". container-test-run-certificates> ca # [38527.139834] ca acme-order-renew-ca.foo-start[325]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [38527.139834] ca acme-order-renew-ca.foo-start[325]: configuration directory will also contain private keys container-test-run-certificates> ca # [38527.139834] ca acme-order-renew-ca.foo-start[325]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [38527.139834] ca acme-order-renew-ca.foo-start[325]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [38527.139969] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.111828469Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [38527.144879] ca step-ca[207]: time="2026-10-16T20:05:32Z" level=info duration=4.362381ms duration-ns=4362381 fields.time="2026-10-16T20:05:32Z" method=POST name=ca nonce=ZHZXdUF5c3FaRFdlS1hVWmU2a2Q5Y01OVHF3V3gzRHI path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1ac0e6bd-c44d-49f0-a5cd-8f0fd55b3d61 response="{\"id\":\"v0vvjh6MBeyZJ1y7OvgylI6xLyLec2AM\",\"status\":\"pending\",\"expires\":\"2026-10-17T20:05:32Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-16T20:04:32Z\",\"notAfter\":\"2027-01-14T20:05:32Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/Hfa1azRMjYBRsYVCNr9aZkUQkIHP2K4U\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/v0vvjh6MBeyZJ1y7OvgylI6xLyLec2AM/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38527.204403] ca step-ca[207]: time="2026-10-16T20:05:32Z" level=info duration=2.280512ms duration-ns=2280512 fields.time="2026-10-16T20:05:32Z" method=POST name=ca nonce=R2Q4OGNpRmFzMTZjV0tYYTRMckhIOU9QOEhwTmVjQmE path=/acme/acme/authz/Hfa1azRMjYBRsYVCNr9aZkUQkIHP2K4U protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1290a74c-ded8-4a94-aa57-294a49fa2807 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"K3xGw2H8dpkSs7bZZsEDwZvA2rXTHL1p\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Hfa1azRMjYBRsYVCNr9aZkUQkIHP2K4U/z461VGnHyPrK9i7LvkTN3eJf0wKRetfP\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"K3xGw2H8dpkSs7bZZsEDwZvA2rXTHL1p\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Hfa1azRMjYBRsYVCNr9aZkUQkIHP2K4U/u4o1cCLb3Ah45fYJYTorvJVR6B0RbJ91\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"K3xGw2H8dpkSs7bZZsEDwZvA2rXTHL1p\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Hfa1azRMjYBRsYVCNr9aZkUQkIHP2K4U/0vhETBqIwJLCMlOmSigIcL5Jk0F1qZcW\"}],\"wildcard\":false,\"expires\":\"2026-10-17T20:05:32Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38527.204843] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.176676165Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [38527.204922] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.176729166Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [38527.210439] ca step-ca[207]: time="2026-10-16T20:05:32Z" level=info duration=4.784346ms duration-ns=4784346 fields.time="2026-10-16T20:05:32Z" method=POST name=ca nonce=Q2h2NTJBUk5iOGJDVkViQnRaWGFmdG44TGJYZnZ4TW4 path=/acme/acme/challenge/Hfa1azRMjYBRsYVCNr9aZkUQkIHP2K4U/u4o1cCLb3Ah45fYJYTorvJVR6B0RbJ91 protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=9cadf4c7-0f5c-4573-813a-3f4427515d9b response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"K3xGw2H8dpkSs7bZZsEDwZvA2rXTHL1p\",\"validated\":\"2026-10-16T20:05:32Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Hfa1azRMjYBRsYVCNr9aZkUQkIHP2K4U/u4o1cCLb3Ah45fYJYTorvJVR6B0RbJ91\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38527.210913] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.182752969Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [38527.211017] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.182871931Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [38527.221987] ca step-ca[207]: time="2026-10-16T20:05:32Z" level=info duration=9.207288ms duration-ns=9207288 fields.time="2026-10-16T20:05:32Z" method=POST name=ca nonce=UzRrWW5HTzFka2NRcUQ2ZWJZYlRrWHQ5SUxOUjdhSDU path=/acme/acme/order/v0vvjh6MBeyZJ1y7OvgylI6xLyLec2AM/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=db79cfdc-fa5c-416f-b847-edd5785348d1 response="{\"id\":\"v0vvjh6MBeyZJ1y7OvgylI6xLyLec2AM\",\"status\":\"valid\",\"expires\":\"2026-10-17T20:05:32Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-16T20:04:32Z\",\"notAfter\":\"2027-01-14T20:05:32Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/Hfa1azRMjYBRsYVCNr9aZkUQkIHP2K4U\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/v0vvjh6MBeyZJ1y7OvgylI6xLyLec2AM/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/uECsq4C73dcOhc0rEvLuBK3dJSWVI3Ac\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38527.225121] ca step-ca[207]: time="2026-10-16T20:05:32Z" level=info certificate="MIIB1DCCAXqgAwIBAgIRAMg/ilWPpw9VmSRug5fLrwcwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDE2MjAwNDMyWhcNMjcwMTE0MjAwNTMyWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR87TgbFfYwHrbbC5TLxIfy29Xkm91+iMFC+nslUN9S5Ab4ED/jJqgXMGaHx3rbIIDzxtX4AapEnIrymcyuIYxyo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFLJDJ19woNtzNFVPSJIKX/IDPesTMB8GA1UdIwQYMBaAFHPd1fxy72K77GWTxc3NBVW5NFzGMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIgf1wYU3DSUgSjnVARtltHIA1ocqDR5lfgTfrfutEnflYCIQDU8OWtU9P6nee0Hi/3EWN26tuozPfWmhdiJHxyKpBSpQ==" duration=2.102229ms duration-ns=2102229 fields.time="2026-10-16T20:05:32Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=Q2RRNUNYcXh0VEtsTzNlaEFTRzhRZHRtMk10b1lmMmE path=/acme/acme/certificate/uECsq4C73dcOhc0rEvLuBK3dJSWVI3Ac protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=a8064421-8c9d-4812-b83a-f39cd844cf01 sans="map[dns:[ca.foo]]" serial=266175519610448305795179577204963782407 size=1344 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= valid-from="2026-10-16T20:04:32Z" valid-to="2027-01-14T20:05:32Z" container-test-run-certificates> ca # [38527.225418] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.197258890Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [38527.225495] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.197359211Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [38527.225653] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.197506173Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [38527.225714] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.197579734Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [38527.225863] ca acme-order-renew-ca.foo-start[325]: 2026-10-16T20:05:32.197717576Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [38527.230779] ca acme-order-renew-ca.foo-start[312]: + touch out/acme-success container-test-run-certificates> ca # [38527.233006] ca acme-order-renew-ca.foo-start[312]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [38527.234528] ca acme-order-renew-ca.foo-start[312]: + touch out/renewed container-test-run-certificates> ca # [38527.236426] ca acme-order-renew-ca.foo-start[312]: + echo Installing new certificate container-test-run-certificates> ca # [38527.236426] ca acme-order-renew-ca.foo-start[312]: Installing new certificate container-test-run-certificates> ca # [38527.236426] ca acme-order-renew-ca.foo-start[312]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [38527.238650] ca acme-order-renew-ca.foo-start[354]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [38527.239012] ca acme-order-renew-ca.foo-start[312]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [38527.241094] ca acme-order-renew-ca.foo-start[355]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [38527.241534] ca acme-order-renew-ca.foo-start[312]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [38527.243372] ca acme-order-renew-ca.foo-start[356]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [38527.243697] ca acme-order-renew-ca.foo-start[312]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [38527.245761] ca acme-order-renew-ca.foo-start[312]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [38527.248010] ca acme-order-renew-ca.foo-start[312]: + for fixpath in out certificates container-test-run-certificates> ca # [38527.248010] ca acme-order-renew-ca.foo-start[312]: + '[' -d out ']' container-test-run-certificates> ca # [38527.248122] ca acme-order-renew-ca.foo-start[312]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [38527.250036] ca acme-order-renew-ca.foo-start[312]: + chown -R acme:nginx out container-test-run-certificates> ca # [38527.254144] ca acme-order-renew-ca.foo-start[312]: + for fixpath in out certificates container-test-run-certificates> ca # [38527.254144] ca acme-order-renew-ca.foo-start[312]: + '[' -d certificates ']' container-test-run-certificates> ca # [38527.254144] ca acme-order-renew-ca.foo-start[312]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [38527.256359] ca acme-order-renew-ca.foo-start[312]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [38527.259724] ca acme-order-renew-ca.foo-start[312]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [38527.422482] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [38527.427697] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [38527.427965] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [38527.428300] ca systemd[1]: acme-order-renew-ca.foo.service: Consumed 1.089s CPU time over 1.229s wall clock time. container-test-run-certificates> ca # [38528.273074] ca nginx[372]: nginx: the configuration file /nix/store/msh0hy9fb7r49jxrh4xff7g1fmrr6ck9-nginx.conf syntax is ok container-test-run-certificates> ca # [38528.273658] ca nginx[372]: nginx: configuration file /nix/store/msh0hy9fb7r49jxrh4xff7g1fmrr6ck9-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 9.17 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.01 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [38529.181277] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [38529.181859] ca systemd[1]: Startup finished in 8.555s. container-test-run-certificates> ca # [38529.354203] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [38529.425518] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [38529.425902] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [38529.425951] ca systemd[1]: nginx.service: Consumed 3.303s CPU time over 4.138s wall clock time. container-test-run-certificates> ca # [38529.430496] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.97 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 465) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 468) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ca # [38530.297403] ca nginx-pre-start[396]: nginx: the configuration file /nix/store/msh0hy9fb7r49jxrh4xff7g1fmrr6ck9-nginx.conf syntax is ok container-test-run-certificates> ca # [38530.297986] ca nginx-pre-start[396]: nginx: configuration file /nix/store/msh0hy9fb7r49jxrh4xff7g1fmrr6ck9-nginx.conf test is successful container-test-run-certificates> ca # [38530.303598] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # No journal files were found. container-test-run-certificates> server # No journal boot entry found for the specified boot (+0). container-test-run-certificates> client # [38531.258802] client systemd-journald[72]: Journal started container-test-run-certificates> client # [38531.258864] client systemd-journald[72]: Runtime Journal (/run/log/journal/84aa81430e984b0ea1505ede43e2df38) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> client # [38531.261498] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [38531.273548] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [38531.287191] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [38531.288175] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [38531.288918] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [38531.298605] client systemd-journald[72]: Time spent on flushing to /var/log/journal/84aa81430e984b0ea1505ede43e2df38 is 1.585ms for 7 entries. container-test-run-certificates> client # [38531.298605] client systemd-journald[72]: System Journal (/var/log/journal/84aa81430e984b0ea1505ede43e2df38) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [38531.307938] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [38531.308538] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [38531.308652] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [38531.309521] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [38531.309573] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [38531.310643] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [38531.310678] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [38531.320685] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [38531.322344] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [38531.338741] client systemd-tmpfiles[126]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [38531.338912] client systemd-tmpfiles[126]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [38531.339030] client systemd-tmpfiles[126]: fchmod() of /var/log/journal/84aa81430e984b0ea1505ede43e2df38 failed: Operation not permitted container-test-run-certificates> client # [38531.339197] client systemd-tmpfiles[126]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [38531.340656] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [38531.341827] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [38531.342583] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [38531.357464] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [38531.366415] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [38531.367727] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [38531.379227] client systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [38531.402856] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [38531.425362] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [38531.425515] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [38531.425736] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [38531.426924] client systemd[1]: Starting Network Management... container-test-run-certificates> server # [38531.295647] server systemd-journald[72]: Journal started container-test-run-certificates> server # [38531.295707] server systemd-journald[72]: Runtime Journal (/run/log/journal/1d596e17485e44e4bd74d43b19cf5a27) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> server # [38531.301881] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [38531.316679] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [38531.330323] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [38531.331136] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [38531.332075] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [38531.340067] server systemd-journald[72]: Time spent on flushing to /var/log/journal/1d596e17485e44e4bd74d43b19cf5a27 is 1.314ms for 7 entries. container-test-run-certificates> server # [38531.340067] server systemd-journald[72]: System Journal (/var/log/journal/1d596e17485e44e4bd74d43b19cf5a27) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [38531.351068] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [38531.351689] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [38531.351795] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [38531.352697] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [38531.352771] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [38531.353579] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [38531.353613] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [38531.357678] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [38531.359025] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [38531.377328] server systemd-tmpfiles[126]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [38531.377524] server systemd-tmpfiles[126]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [38531.377656] server systemd-tmpfiles[126]: fchmod() of /var/log/journal/1d596e17485e44e4bd74d43b19cf5a27 failed: Operation not permitted container-test-run-certificates> server # [38531.377850] server systemd-tmpfiles[126]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [38531.379265] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [38531.380380] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [38531.381138] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [38531.394745] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [38531.402660] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [38531.404291] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [38531.405359] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [38531.416625] server systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [38531.465118] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [38531.465281] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [38531.465519] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [38531.466713] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [38532.123135] server systemd-networkd[190]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [38532.123222] server systemd-networkd[190]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [38532.132452] server systemd-networkd[190]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [38532.132619] server systemd-networkd[190]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [38532.132763] server systemd-networkd[190]: lo: Link UP container-test-run-certificates> server # [38532.132767] server systemd-networkd[190]: lo: Gained carrier container-test-run-certificates> server # [38532.132957] server systemd-networkd[190]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [38532.133298] server systemd[1]: Started Network Management. container-test-run-certificates> server # [38532.133373] server systemd-networkd[190]: eth1: Link UP container-test-run-certificates> server # [38532.133659] server systemd-networkd[190]: eth1: Gained carrier container-test-run-certificates> server # [38532.164529] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [38532.179593] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [38532.307238] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [38532.117838] client systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [38532.117928] client systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [38532.127207] client systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [38532.127375] client systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [38532.127514] client systemd-networkd[186]: lo: Link UP container-test-run-certificates> client # [38532.127518] client systemd-networkd[186]: lo: Gained carrier container-test-run-certificates> client # [38532.127725] client systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [38532.128149] client systemd[1]: Started Network Management. container-test-run-certificates> client # [38532.128205] client systemd-networkd[186]: eth1: Link UP container-test-run-certificates> client # [38532.128522] client systemd-networkd[186]: eth1: Gained carrier container-test-run-certificates> client # [38532.129264] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [38532.173816] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [38532.255551] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [38532.445065] client systemd-resolved[103]: Positive Trust Anchors: container-test-run-certificates> client # [38532.445077] client systemd-resolved[103]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [38532.445082] client systemd-resolved[103]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [38532.445115] client systemd-resolved[103]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [38532.464850] client systemd-resolved[103]: Using system hostname 'client'. container-test-run-certificates> client # [38532.466185] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [38532.466310] client systemd[1]: Reached target Network. container-test-run-certificates> client # [38532.466413] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [38532.466509] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [38532.466563] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [38532.466604] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [38532.466821] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [38532.467036] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [38532.467245] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [38532.467284] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [38532.467363] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [38532.469080] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [38532.470543] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [38532.473467] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [38532.534731] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [38532.718597] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [38532.719212] client nsncd[192]: Oct 16 20:05:37.690 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [38532.718714] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [38532.718816] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [38532.487534] server systemd-resolved[107]: Positive Trust Anchors: container-test-run-certificates> server # [38532.487547] server systemd-resolved[107]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [38532.487550] server systemd-resolved[107]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [38532.487583] server systemd-resolved[107]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [38532.507518] server systemd-resolved[107]: Using system hostname 'server'. container-test-run-certificates> server # [38532.508902] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [38532.509034] server systemd[1]: Reached target Network. container-test-run-certificates> server # [38532.509136] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [38532.509232] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [38532.509624] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [38532.509673] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [38532.509719] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [38532.509757] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [38532.509982] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [38532.510172] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [38532.510388] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [38532.510430] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [38532.510515] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [38532.517633] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [38532.518852] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [38532.518922] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [38532.520323] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [38532.522332] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [38532.541174] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [38532.679850] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [38532.679850] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [38532.679850] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [38532.682169] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [38532.684142] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [38532.684142] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [38532.684277] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [38532.684277] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [38532.713648] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [38532.714189] server nsncd[197]: Oct 16 20:05:37.685 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [38532.713741] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [38532.713806] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [38532.724418] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [38532.725399] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [38532.738048] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [38532.724816] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [38532.726283] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [38532.738067] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [38532.739833] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [38532.739912] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [38532.739950] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [38532.903965] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [38532.905248] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [38532.905248] client dbus-broker-launch[193]: Invalid user-name in /nix/store/iwc97hm3l0cq3d55ab2cc9czdipn8pv2-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [38532.905688] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [38532.913065] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [38532.739850] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [38532.739905] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [38532.739927] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [38532.907653] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [38532.908526] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [38532.908526] server dbus-broker-launch[198]: Invalid user-name in /nix/store/4dcl85jb6ycm7p1nnh4phk2vcz93cgz3-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [38532.908937] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [38532.915842] server dbus-broker-launch[198]: Ready container-test-run-certificates> server # [38533.212436] server systemd-networkd[190]: eth1: Gained IPv6LL container-test-run-certificates> client # [38533.514475] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [38533.514717] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [38533.556751] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [38533.570608] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [38533.570708] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [38533.571201] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [38533.571416] client systemd[1]: Startup finished in 2.766s. container-test-run-certificates> server # [38533.505755] server systemd-logind[222]: New seat seat0. container-test-run-certificates> server # [38533.505916] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [38533.507405] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [38533.566898] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [38533.567195] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [38533.627435] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [38533.627435] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [38533.627875] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [38533.650324] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [38533.653125] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> client # [38534.016288] client systemd-networkd[186]: eth1: Gained IPv6LL container-test-run-certificates> server # [38534.496790] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [38534.500564] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [38534.500564] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [38534.512644] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [38534.513279] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [38534.514466] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [38534.514815] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [38534.516204] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [38534.516472] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [38534.518453] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [38534.520419] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [38534.522350] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [38534.522350] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [38534.522469] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [38534.524239] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [38534.528808] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [38534.528808] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [38534.534090] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [38534.536298] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [38535.426638] server nginx-pre-start[270]: nginx: the configuration file /nix/store/3hbygpvfkcv5f96sdwgvbfcyz06av65s-nginx.conf syntax is ok container-test-run-certificates> server # [38535.427283] server nginx-pre-start[270]: nginx: configuration file /nix/store/3hbygpvfkcv5f96sdwgvbfcyz06av65s-nginx.conf test is successful container-test-run-certificates> server # [38535.434471] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [38535.435497] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [38535.437776] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [38536.314360] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [38536.317824] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [38536.317979] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [38536.318062] server acme-order-renew-test.foo-start[273]: + /nix/store/vf2h24m5aa7phb4v1kbc2qd9r41jdfqv-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [38536.319654] server acme-order-renew-test.foo-start[284]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [38536.322735] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [38536.322812] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [38536.322863] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [38536.322863] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [38536.347894] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.319719529Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [38536.378047] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.349883706Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [38536.390160] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.362001954Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [38536.390160] server acme-order-renew-test.foo-start[285]: Your account credentials have been saved in your container-test-run-certificates> server # [38536.390160] server acme-order-renew-test.foo-start[285]: configuration directory at "accounts". container-test-run-certificates> server # [38536.390160] server acme-order-renew-test.foo-start[285]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [38536.390160] server acme-order-renew-test.foo-start[285]: configuration directory will also contain private keys container-test-run-certificates> server # [38536.390160] server acme-order-renew-test.foo-start[285]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [38536.390160] server acme-order-renew-test.foo-start[285]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [38536.390505] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.362245317Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [38536.462789] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.434625718Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [38536.462871] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.434674998Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [38536.472253] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.444091048Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [38536.472364] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.444216930Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [38536.493307] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.465147300Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [38536.493377] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.465246061Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [38536.493534] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.465388463Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [38536.493603] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.465465384Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [38536.493762] server acme-order-renew-test.foo-start[285]: 2026-10-16T20:05:41.465615306Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [38536.499142] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [38536.501829] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [38536.503120] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [38536.505068] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [38536.505068] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [38536.505068] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [38536.506998] server acme-order-renew-test.foo-start[315]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [38536.507368] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [38536.509002] server acme-order-renew-test.foo-start[316]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [38536.509346] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [38536.511229] server acme-order-renew-test.foo-start[317]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [38536.511535] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [38536.513465] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [38536.515873] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [38536.515873] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [38536.515979] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [38536.518852] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [38536.522028] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [38536.522028] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [38536.522120] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [38536.524135] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [38536.527857] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [38536.377521] ca step-ca[207]: time="2026-10-16T20:05:41Z" level=info duration="63.361µs" duration-ns=63361 fields.time="2026-10-16T20:05:41Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=94ab3f99-a1fa-483a-913f-7eafc41ee8af response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38536.382943] ca step-ca[207]: time="2026-10-16T20:05:41Z" level=info duration="831.492µs" duration-ns=831492 fields.time="2026-10-16T20:05:41Z" method=HEAD name=ca nonce=emVqemVzWjVYZ2ROUTJjeHJvSTRZQ0pDUFd5bEgzWHQ path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=0bee7e19-3dad-4863-a4cc-c5937d1a3573 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38536.389399] ca step-ca[207]: time="2026-10-16T20:05:41Z" level=info duration=2.699317ms duration-ns=2699317 fields.time="2026-10-16T20:05:41Z" method=POST name=ca nonce=WnBMd2NkU0VFS2VBS2k4dEkzNUhwTXpBOGRFVkFkdDY path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=75a778e9-6183-46e3-9fcc-ab63b57dc433 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/3AJIFPzXrEvdg1bbo9JKAGXDCrZMrjgL/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38536.398962] ca step-ca[207]: time="2026-10-16T20:05:41Z" level=info duration=4.957788ms duration-ns=4957788 fields.time="2026-10-16T20:05:41Z" method=POST name=ca nonce=bmhKVWRFZXU5V09SMktldUdJeDAyUExVeGlNVUFHcUc path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=b3de00e6-f4ab-4f1b-9a3d-31c71526d3e3 response="{\"id\":\"UqDAViKrplLefLbEETj0pGrvpvcmDHWq\",\"status\":\"pending\",\"expires\":\"2026-10-17T20:05:41Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-16T20:04:41Z\",\"notAfter\":\"2027-01-14T20:05:41Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/60lRLlcmcVEyb1AiQKx5okwsTmcnXe0P\"],\"finalize\":\"https://ca.foo/acme/acme/order/UqDAViKrplLefLbEETj0pGrvpvcmDHWq/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38536.462058] ca step-ca[207]: time="2026-10-16T20:05:41Z" level=info duration=2.16079ms duration-ns=2160790 fields.time="2026-10-16T20:05:41Z" method=POST name=ca nonce=WW40SlFyOVpWb1ZvYlBJSzg4SXlNZE9yWFZZOFZvZTQ path=/acme/acme/authz/60lRLlcmcVEyb1AiQKx5okwsTmcnXe0P protocol=HTTP/1.1 referer= remote-address="::1" request-id=efc9b630-0984-4831-8a73-ebd1dbcfd914 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"XFrIA83IB6yGHJzensNj559x4WyoOyTb\",\"url\":\"https://ca.foo/acme/acme/challenge/60lRLlcmcVEyb1AiQKx5okwsTmcnXe0P/aZk5Hy72YAT85WLtrdC0L6bwdQUdoDtU\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"XFrIA83IB6yGHJzensNj559x4WyoOyTb\",\"url\":\"https://ca.foo/acme/acme/challenge/60lRLlcmcVEyb1AiQKx5okwsTmcnXe0P/PRHpNshVhlKQwjoTexBXqlHOrbl1XF0c\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"XFrIA83IB6yGHJzensNj559x4WyoOyTb\",\"url\":\"https://ca.foo/acme/acme/challenge/60lRLlcmcVEyb1AiQKx5okwsTmcnXe0P/pCdz7wCiF7sBr4vfs8HG1UK4K2esbZJh\"}],\"wildcard\":false,\"expires\":\"2026-10-17T20:05:41Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38536.471635] ca step-ca[207]: time="2026-10-16T20:05:41Z" level=info duration=4.639904ms duration-ns=4639904 fields.time="2026-10-16T20:05:41Z" method=POST name=ca nonce=Sm4zRG05SzU3b1VHYzdXem5zWVNHd1FQS0QwQkk1akM path=/acme/acme/challenge/60lRLlcmcVEyb1AiQKx5okwsTmcnXe0P/PRHpNshVhlKQwjoTexBXqlHOrbl1XF0c protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=8ff48231-7d54-43d6-9814-9a44c0a1d7f1 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"XFrIA83IB6yGHJzensNj559x4WyoOyTb\",\"validated\":\"2026-10-16T20:05:41Z\",\"url\":\"https://ca.foo/acme/acme/challenge/60lRLlcmcVEyb1AiQKx5okwsTmcnXe0P/PRHpNshVhlKQwjoTexBXqlHOrbl1XF0c\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38536.486166] ca step-ca[207]: time="2026-10-16T20:05:41Z" level=info duration=8.712681ms duration-ns=8712681 fields.time="2026-10-16T20:05:41Z" method=POST name=ca nonce=aWtuMHZjeHRTV2thTGFUSFdhWENaRWJPMHZrbndYTHQ path=/acme/acme/order/UqDAViKrplLefLbEETj0pGrvpvcmDHWq/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=171a4423-e48c-4850-9011-9a1d0a605a89 response="{\"id\":\"UqDAViKrplLefLbEETj0pGrvpvcmDHWq\",\"status\":\"valid\",\"expires\":\"2026-10-17T20:05:41Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-16T20:04:41Z\",\"notAfter\":\"2027-01-14T20:05:41Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/60lRLlcmcVEyb1AiQKx5okwsTmcnXe0P\"],\"finalize\":\"https://ca.foo/acme/acme/order/UqDAViKrplLefLbEETj0pGrvpvcmDHWq/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/liAqcXJJT3qCEOjlNUtQh7VgnCujvf33\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [38536.492618] ca step-ca[207]: time="2026-10-16T20:05:41Z" level=info certificate=MIIB2TCCAX6gAwIBAgIRAIhDyztv6Oap/O2I/gjVyHgwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDE2MjAwNDQxWhcNMjcwMTE0MjAwNTQxWjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGY+2BMg1ExzelidSnYV9pB28asV8Z+2I6t4uRzYkY+lrfQs0LYtU7+cgZp/B5zA1LSLQh9Gi+Mwz+zqehX9cGejgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUtr+f9hjDadfuMncPGFBUtq1QnJUwHwYDVR0jBBgwFoAUc93V/HLvYrvsZZPFzc0FVbk0XMYwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0kAMEYCIQD8df/Oo1qgjVjvreBiI2KnUf6LTZ50NQsrYvh24ai3iQIhAKNCDD7TqCYucctGewzVUZ2WY1h6K2jhe/m80BrTjLRj duration=1.778785ms duration-ns=1778785 fields.time="2026-10-16T20:05:41Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=b2tOZUxSUUFPQW9neDV4RTJlWWRMR0hjRFAzS1h5SzA path=/acme/acme/certificate/liAqcXJJT3qCEOjlNUtQh7VgnCujvf33 protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=bc4f5eff-3418-4474-82cf-fd237b9f6ee8 sans="map[dns:[test.foo]]" serial=181127013354515917957057361727274207352 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= valid-from="2026-10-16T20:04:41Z" valid-to="2027-01-14T20:05:41Z" container-test-run-certificates> server # [38536.703572] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [38536.708319] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [38536.708551] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> server # [38536.708811] server systemd[1]: acme-order-renew-test.foo.service: Consumed 1.094s CPU time over 1.270s wall clock time. container-test-run-certificates> server # [38537.583173] server nginx[333]: nginx: the configuration file /nix/store/3hbygpvfkcv5f96sdwgvbfcyz06av65s-nginx.conf syntax is ok container-test-run-certificates> server # [38537.583752] server nginx[333]: nginx: configuration file /nix/store/3hbygpvfkcv5f96sdwgvbfcyz06av65s-nginx.conf test is successful container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 8.16 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [38538.414891] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [38538.415341] server systemd[1]: Startup finished in 7.599s. container-test-run-certificates> server # [38538.488787] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [38538.591738] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [38538.592107] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [38538.592191] server systemd[1]: nginx.service: Consumed 4.965s CPU time over 4.055s wall clock time. container-test-run-certificates> server # [38538.596398] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 1.00 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 34550 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 45336 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 3 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 3 ms: Could not connect to server container-test-run-certificates> server # [38539.463330] server nginx-pre-start[356]: nginx: the configuration file /nix/store/3hbygpvfkcv5f96sdwgvbfcyz06av65s-nginx.conf syntax is ok container-test-run-certificates> server # [38539.463763] server nginx-pre-start[356]: nginx: configuration file /nix/store/3hbygpvfkcv5f96sdwgvbfcyz06av65s-nginx.conf test is successful container-test-run-certificates> server # [38539.469542] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1554 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [933 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [80 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Oct 16 20:04:41 2026 GMT container-test-run-certificates> * expire date: Jan 14 20:05:41 2027 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 34556 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 735 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.06 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> 88:43:cb:3b:6f:e8:e6:a9:fc:ed:88:fe:08:d5:c8:78 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Oct 16 20:04:41 2026 GMT container-test-run-certificates> Not After : Jan 14 20:05:41 2027 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:66:3e:d8:13:20:d4:4c:73:7a:58:9d:4a:76:15: container-test-run-certificates> f6:90:76:f1:ab:15:f1:9f:b6:23:ab:78:b9:1c:d8: container-test-run-certificates> 91:8f:a5:ad:f4:2c:d0:b6:2d:53:bf:9c:81:9a:7f: container-test-run-certificates> 07:9c:c0:d4:b4:8b:42:1f:46:8b:e3:30:cf:ec:ea: container-test-run-certificates> 7a:15:fd:70:67 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> B6:BF:9F:F6:18:C3:69:D7:EE:32:77:0F:18:50:54:B6:AD:50:9C:95 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 73:DD:D5:FC:72:EF:62:BB:EC:65:93:C5:CD:CD:05:55:B9:34:5C:C6 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:46:02:21:00:fc:75:ff:ce:a3:5a:a0:8d:58:ef:ad:e0:62: container-test-run-certificates> 23:62:a7:51:fe:8b:4d:9e:74:35:0b:2b:62:f8:76:e1:a8:b7: container-test-run-certificates> 89:02:21:00:a3:42:0c:3e:d3:a8:26:2e:71:cb:46:7b:0c:d5: container-test-run-certificates> 51:9d:96:63:58:7a:2b:68:e1:7b:f9:bc:d0:1a:d3:8c:b4:63 container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.04 seconds) container-test-run-certificates> (finished: run the VM test script, in 20.42 seconds) container-test-run-certificates> test script finished in 20.47s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 468) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> kill NspawnMachine (pid 465) container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.39 seconds) container-test-run-certificates> Container server terminated by signal KILL.