don't know how to build these paths:
  /nix/store/20f40lhwm6xwl2c7qz5sd8i2ffj6i367-container-test-run-certificates.drv
warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user
building '/nix/store/n5grnq0dqrxshm8i0dbkhmmgg7y5hps0-system-path.drv' on nix-store.geninf.io:50051
system-path> build-x86-01: building n5grnq0dqrxshm8i0dbkhmmgg7y5hps0-system-path.drv
building '/nix/store/zm0iwa9yqr83qymgyz57ws79qv5migjf-system-path.drv' on nix-store.geninf.io:50051
system-path> build-x86-01: building zm0iwa9yqr83qymgyz57ws79qv5migjf-system-path.drv
building '/nix/store/h14bclqq8xxripa6vi2hqv4m8y0n91m1-nginx.conf.drv' on nix-store.geninf.io:50051
nginx.conf> build-x86-01: building h14bclqq8xxripa6vi2hqv4m8y0n91m1-nginx.conf.drv
nginx.conf> structuredAttrs is enabled
system-path> structuredAttrs is enabled
system-path> structuredAttrs is enabled
building '/nix/store/mg2ka5aj8cisdb31mgx9r0064hjxbjr0-nginx.conf.drv' on nix-store.geninf.io:50051
nginx.conf> gi-build-x86-02: building mg2ka5aj8cisdb31mgx9r0064hjxbjr0-nginx.conf.drv
building '/nix/store/s58dl9r5ygmamwz5xjryzzsb7ia1820w-system-path.drv' on nix-store.geninf.io:50051
system-path> gi-build-x86-02: building s58dl9r5ygmamwz5xjryzzsb7ia1820w-system-path.drv
nginx.conf> structuredAttrs is enabled
system-path> created 1721 symlinks in user environment
system-path> created 1721 symlinks in user environment
system-path> structuredAttrs is enabled
nginx.conf> 
nginx.conf> ==================== Results ===================
nginx.conf> No issues found.
nginx.conf> 
nginx.conf> ==================== Summary ===================
nginx.conf> Total issues:
nginx.conf>     Unspecified: 0
nginx.conf>     Low: 0
nginx.conf>     Medium: 0
nginx.conf>     High: 0
nginx.conf> 
system-path> created 1721 symlinks in user environment
nginx.conf> 
nginx.conf> ==================== Results ===================
nginx.conf> No issues found.
nginx.conf> 
nginx.conf> ==================== Summary ===================
nginx.conf> Total issues:
nginx.conf>     Unspecified: 0
nginx.conf>     Low: 0
nginx.conf>     Medium: 0
nginx.conf>     High: 0
nginx.conf> 
building '/nix/store/j66h754qy0j5cma7p46xl4mvacx45vjn-unit-script-nginx-pre-start.drv' on nix-store.geninf.io:50051
unit-script-nginx-pre-start> build-x86-01: building j66h754qy0j5cma7p46xl4mvacx45vjn-unit-script-nginx-pre-start.drv
unit-script-nginx-pre-start> structuredAttrs is enabled
building '/nix/store/2z9jyyw0kx2v1d8c9q9ijyz2mqrmcazm-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> build-x86-01: building 2z9jyyw0kx2v1d8c9q9ijyz2mqrmcazm-dbus-1.drv
building '/nix/store/ffpxxpx779xknv2gqhl3p1n70ry79g7n-unit-script-nginx-pre-start.drv' on nix-store.geninf.io:50051
unit-script-nginx-pre-start> gi-build-x86-02: building ffpxxpx779xknv2gqhl3p1n70ry79g7n-unit-script-nginx-pre-start.drv
unit-script-nginx-pre-start> structuredAttrs is enabled
building '/nix/store/i7npzpd7m0as6b5fnfi5n8p4rj5mqx8a-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> build-x86-01: building i7npzpd7m0as6b5fnfi5n8p4rj5mqx8a-dbus-1.drv
building '/nix/store/pk78hlp9y4b684dmxgc03xgi3lax3wj9-unit-nginx.service.drv' on nix-store.geninf.io:50051
unit-nginx.service> build-x86-01: building pk78hlp9y4b684dmxgc03xgi3lax3wj9-unit-nginx.service.drv
unit-nginx.service> structuredAttrs is enabled
building '/nix/store/na4rgim4jrpqzrq2b2w878w4751jphw7-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> gi-build-x86-02: building na4rgim4jrpqzrq2b2w878w4751jphw7-dbus-1.drv
building '/nix/store/6a27il99ria6d3sg95xxvhv9w99hvwsy-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> build-x86-01: building 6a27il99ria6d3sg95xxvhv9w99hvwsy-X-Restart-Triggers-dbus-broker.drv
building '/nix/store/mf1b8h758zcxdypzhiqh5d6q354jgvm6-unit-nginx.service.drv' on nix-store.geninf.io:50051
unit-nginx.service> gi-build-x86-02: building mf1b8h758zcxdypzhiqh5d6q354jgvm6-unit-nginx.service.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
building '/nix/store/625c5hlvpy6bgcn1s7lxz7lbwi8rr7q2-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> build-x86-01: building 625c5hlvpy6bgcn1s7lxz7lbwi8rr7q2-X-Restart-Triggers-dbus-broker.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
unit-nginx.service> structuredAttrs is enabled
building '/nix/store/lbxl65k8zb91sf9c9vrrh5lswn02f729-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building lbxl65k8zb91sf9c9vrrh5lswn02f729-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/7585b9l9k9kqg6dpgkqyh4hliaqqjj0h-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building 7585b9l9k9kqg6dpgkqyh4hliaqqjj0h-unit-dbus-broker.service.drv
building '/nix/store/mnsh4m0spk4vy41m66p5dm0hzh62digy-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building mnsh4m0spk4vy41m66p5dm0hzh62digy-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/maz8ghz7k0mlfb8d8n0xhdvm9zbhma3i-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> gi-build-x86-02: building maz8ghz7k0mlfb8d8n0xhdvm9zbhma3i-unit-dbus-broker.service.drv
building '/nix/store/ys53rpjvgf6h30klb86ih8cn9g32mgas-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> gi-build-x86-02: building ys53rpjvgf6h30klb86ih8cn9g32mgas-X-Restart-Triggers-dbus-broker.drv
building '/nix/store/9641wsy9fmzmzd0gq1q4w4axapjzkw0c-user-units.drv' on nix-store.geninf.io:50051
user-units> build-x86-01: building 9641wsy9fmzmzd0gq1q4w4axapjzkw0c-user-units.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/qfwgw46j7bwmglq79nw7li0c0iirvpdz-user-units.drv' on nix-store.geninf.io:50051
user-units> build-x86-01: building qfwgw46j7bwmglq79nw7li0c0iirvpdz-user-units.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
building '/nix/store/5ymjs8mw554042pbqp0r3vb9h69wvhnj-system-units.drv' on nix-store.geninf.io:50051
system-units> gi-build-x86-02: building 5ymjs8mw554042pbqp0r3vb9h69wvhnj-system-units.drv
building '/nix/store/fjwx7kcc1jmwi0iblqc0gyb8cz1bq5bf-system-units.drv' on nix-store.geninf.io:50051
system-units> gi-build-x86-02: building fjwx7kcc1jmwi0iblqc0gyb8cz1bq5bf-system-units.drv
building '/nix/store/c0kkgcg51x3jjl2qvwqjsnakalflw67r-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> gi-build-x86-02: building c0kkgcg51x3jjl2qvwqjsnakalflw67r-unit-dbus-broker.service.drv
building '/nix/store/j8z8lgk3xs4595bhmkq953xh93p19gzh-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building j8z8lgk3xs4595bhmkq953xh93p19gzh-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/k4mizmcjdjvp419zwc63frmn14mzfd9j-user-units.drv' on nix-store.geninf.io:50051
user-units> gi-build-x86-02: building k4mizmcjdjvp419zwc63frmn14mzfd9j-user-units.drv
building '/nix/store/s22j8600s47md8dz4hk7gyjmvc3yndsd-system-units.drv' on nix-store.geninf.io:50051
system-units> build-x86-01: building s22j8600s47md8dz4hk7gyjmvc3yndsd-system-units.drv
building '/nix/store/wj28g7fp38kp6sbiyfbabk0ldq2d7s4l-etc.drv' on nix-store.geninf.io:50051
etc> gi-build-x86-02: building wj28g7fp38kp6sbiyfbabk0ldq2d7s4l-etc.drv
building '/nix/store/nbw26bi1vqvib04zqkvlmm4fywf1n2s8-etc.drv' on nix-store.geninf.io:50051
etc> gi-build-x86-02: building nbw26bi1vqvib04zqkvlmm4fywf1n2s8-etc.drv
building '/nix/store/dnja81br1p49j8qcvqxf8dryd7ww6180-etc.drv' on nix-store.geninf.io:50051
etc> gi-build-x86-02: building dnja81br1p49j8qcvqxf8dryd7ww6180-etc.drv
building '/nix/store/jwx73yg7i3kgx51bjpzcyngk4596s2q7-activate.drv' on nix-store.geninf.io:50051
activate> gi-build-x86-02: building jwx73yg7i3kgx51bjpzcyngk4596s2q7-activate.drv
building '/nix/store/2h9zvsc8ymsvhk4hxqph41ldjzcsdv86-activate.drv' on nix-store.geninf.io:50051
activate> gi-build-x86-02: building 2h9zvsc8ymsvhk4hxqph41ldjzcsdv86-activate.drv
building '/nix/store/hqf4sdydf81v2yw96fwzhbq0awv25lsf-activate.drv' on nix-store.geninf.io:50051
activate> gi-build-x86-02: building hqf4sdydf81v2yw96fwzhbq0awv25lsf-activate.drv
activate> structuredAttrs is enabled
activate> structuredAttrs is enabled
activate> structuredAttrs is enabled
building '/nix/store/gyn84nv8749imryh8z5m3jbfhv5m0xaz-nixos-system-client-test.drv' on nix-store.geninf.io:50051
nixos-system-client-test> gi-build-x86-02: building gyn84nv8749imryh8z5m3jbfhv5m0xaz-nixos-system-client-test.drv
nixos-system-client-test> structuredAttrs is enabled
building '/nix/store/sq831kxrp37f41vnbcdr449sqhsyqy8i-nixos-system-server-test.drv' on nix-store.geninf.io:50051
nixos-system-server-test> gi-build-x86-02: building sq831kxrp37f41vnbcdr449sqhsyqy8i-nixos-system-server-test.drv
nixos-system-server-test> structuredAttrs is enabled
building '/nix/store/7n282j9ylbxgw1k1m6rxy408wwc4sjb3-run-client-nspawn.drv' on nix-store.geninf.io:50051
run-client-nspawn> gi-build-x86-02: building 7n282j9ylbxgw1k1m6rxy408wwc4sjb3-run-client-nspawn.drv
building '/nix/store/dprgkjxv8cpw23zwzpfyma93avl4nh2m-nixos-system-ca-test.drv' on nix-store.geninf.io:50051
nixos-system-ca-test> build-x86-01: building dprgkjxv8cpw23zwzpfyma93avl4nh2m-nixos-system-ca-test.drv
nixos-system-ca-test> structuredAttrs is enabled
building '/nix/store/6df8fd3fbn01jk7b44737n7x5138s6ll-run-ca-nspawn.drv' on nix-store.geninf.io:50051
run-ca-nspawn> build-x86-01: building 6df8fd3fbn01jk7b44737n7x5138s6ll-run-ca-nspawn.drv
building '/nix/store/n84aib8d9vjrcx15sxjwjl116q3sm8bk-run-server-nspawn.drv' on nix-store.geninf.io:50051
run-server-nspawn> gi-build-x86-02: building n84aib8d9vjrcx15sxjwjl116q3sm8bk-run-server-nspawn.drv
building '/nix/store/38i3rzcf4zrr3jrb4mmi1z70fmdax0sm-driverConfiguration.json.drv' on nix-store.geninf.io:50051
driverConfiguration.json> gi-build-x86-02: building 38i3rzcf4zrr3jrb4mmi1z70fmdax0sm-driverConfiguration.json.drv
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/l9j17y0qr5n3qbkxwb23sf1dzyn8111p-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051
nixos-test-driver-certificates> gi-build-x86-02: building l9j17y0qr5n3qbkxwb23sf1dzyn8111p-nixos-test-driver-certificates.drv
nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-certificates> All checks passed!
nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-certificates> All checks passed!
building '/nix/store/20f40lhwm6xwl2c7qz5sd8i2ffj6i367-container-test-run-certificates.drv' on nix-store.geninf.io:50051
container-test-run-certificates> build-x86-01: building 20f40lhwm6xwl2c7qz5sd8i2ffj6i367-container-test-run-certificates.drv
container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-certificates> start all VLans
container-test-run-certificates> (finished: start all VLans, in 0.00 seconds)
container-test-run-certificates> 
container-test-run-certificates> Test will time out and terminate in 3600.0 seconds
container-test-run-certificates> run the VM test script
container-test-run-certificates> additionally exposed symbols:
container-test-run-certificates>     ca, client, server,
container-test-run-certificates>     vlan1,
container-test-run-certificates>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-certificates> ca: systemd-nspawn running (pid 50)
container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal...
container-test-run-certificates> ca: waiting for unit step-ca.service
container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca.
container-test-run-certificates> ca # [39578.024824] ca systemd-journald[81]: Journal started
container-test-run-certificates> ca # [39578.024853] ca systemd-journald[81]: Runtime Journal (/run/log/journal/ab6d41afd4064c09bc633d9e0f90549c) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> ca # [39578.029721] ca systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> ca # [39578.036283] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> ca # [39578.043617] ca systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> ca # [39578.044010] ca systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> ca # [39578.044317] ca systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> ca # [39578.047940] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/ab6d41afd4064c09bc633d9e0f90549c is 1.012ms for 7 entries.
container-test-run-certificates> ca # [39578.047940] ca systemd-journald[81]: System Journal (/var/log/journal/ab6d41afd4064c09bc633d9e0f90549c) is 8M, max 4G, 3.9G free.
container-test-run-certificates> ca # [39578.057865] ca systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> ca # [39578.058318] ca systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> ca # [39578.058370] ca systemd[1]: Reached target Local File Systems.
container-test-run-certificates> ca # [39578.058841] ca systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> ca # [39578.058863] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [39578.059287] ca systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> ca # [39578.059307] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> ca # [39578.063421] ca systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> ca # [39578.063809] ca systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> ca # [39578.072801] ca systemd-tmpfiles[144]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> ca # [39578.072949] ca systemd-tmpfiles[144]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [39578.073055] ca systemd-tmpfiles[144]: fchmod() of /var/log/journal/ab6d41afd4064c09bc633d9e0f90549c failed: Operation not permitted
container-test-run-certificates> ca # [39578.073200] ca systemd-tmpfiles[144]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [39578.073853] ca systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> ca # [39578.074269] ca systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> ca # [39578.074572] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [39578.081557] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> ca # [39578.086351] ca systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> ca # [39578.086748] ca systemd[1]: Starting Update is Completed...
container-test-run-certificates> ca # [39578.092411] ca systemd[1]: Finished Update is Completed.
container-test-run-certificates> ca # [39578.111874] ca systemd[1]: Finished Firewall.
container-test-run-certificates> ca # [39578.111938] ca systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> ca # [39578.112083] ca systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> ca # [39578.112564] ca systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [39578.261657] ca systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> ca # [39578.570555] ca systemd-networkd[198]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [39578.570622] ca systemd-networkd[198]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [39578.578342] ca systemd-networkd[198]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [39578.578486] ca systemd-networkd[198]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [39578.578567] ca systemd-networkd[198]: lo: Link UP
container-test-run-certificates> ca # [39578.578571] ca systemd-networkd[198]: lo: Gained carrier
container-test-run-certificates> ca # [39578.578717] ca systemd-networkd[198]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> ca # [39578.578963] ca systemd[1]: Started Network Management.
container-test-run-certificates> ca # [39578.578995] ca systemd-networkd[198]: eth1: Link UP
container-test-run-certificates> ca # [39578.579127] ca systemd-networkd[198]: eth1: Gained carrier
container-test-run-certificates> ca # [39578.579628] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> ca # [39578.600961] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> ca # [39578.896727] ca systemd-resolved[117]: Positive Trust Anchors:
container-test-run-certificates> ca # [39578.896734] ca systemd-resolved[117]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> ca # [39578.896738] ca systemd-resolved[117]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> ca # [39578.896755] ca systemd-resolved[117]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> ca # [39578.907744] ca systemd-resolved[117]: Using system hostname 'ca'.
container-test-run-certificates> ca # [39578.908576] ca systemd[1]: Started Network Name Resolution.
container-test-run-certificates> ca # [39578.908637] ca systemd[1]: Reached target Network.
container-test-run-certificates> ca # [39578.908677] ca systemd[1]: Reached target Network is Online.
container-test-run-certificates> ca # [39578.908711] ca systemd[1]: Reached target System Initialization.
container-test-run-certificates> ca # [39578.908845] ca systemd[1]: Started Renew ACME Certificate for ca.foo.
container-test-run-certificates> ca # [39578.908872] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [39578.908887] ca systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> ca # [39578.908896] ca systemd[1]: Reached target Timer Units.
container-test-run-certificates> ca # [39578.908969] ca systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> ca # [39578.909028] ca systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> ca # [39578.909097] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> ca # [39578.909107] ca systemd[1]: Reached target Socket Units.
container-test-run-certificates> ca # [39578.909128] ca systemd[1]: Reached target Basic System.
container-test-run-certificates> ca # [39578.909852] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> ca # [39578.910189] ca systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> ca # [39578.910208] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem
container-test-run-certificates> ca # [39578.910621] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> ca # [39578.911057] ca systemd[1]: Starting step-ca service...
container-test-run-certificates> ca # [39578.911765] ca systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> ca # [39578.939334] ca systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> ca # [39579.023276] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> ca # [39579.038932] ca acme-setup-privileged[204]: + set -euo pipefail
container-test-run-certificates> ca # [39579.038932] ca acme-setup-privileged[204]: + cd /var/lib/acme
container-test-run-certificates> ca # [39579.039283] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> ca # [39579.039895] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts
container-test-run-certificates> ca # [39579.041006] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [39579.041035] ca acme-setup-privileged[204]: + '[' -d ca.foo ']'
container-test-run-certificates> ca # [39579.041035] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [39579.041035] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']'
container-test-run-certificates> ca # [39579.075308] ca nsncd[206]: Oct 16 20:08:48.020 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> ca # [39579.075336] ca systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> ca # [39579.075384] ca systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> ca # [39579.075417] ca systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> ca # [39579.076092] ca systemd[1]: Starting User Login Management...
container-test-run-certificates> ca # [39579.076421] ca systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> ca # [39579.081899] ca systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> ca # [39579.082361] ca systemd[1]: Started Console Getty.
container-test-run-certificates> ca # [39579.082383] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> ca # [39579.082392] ca systemd[1]: Reached target Login Prompts.
container-test-run-certificates> ca # [39579.197971] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> ca # [39579.198349] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> ca # [39579.198349] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/3xd0bfda3n5lw6v13mjdqmk4rx3z5j57-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> ca # [39579.198615] ca systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> ca # [39579.202353] ca dbus-broker-launch[208]: Ready
container-test-run-certificates> ca # [39579.749046] ca systemd-logind[238]: New seat seat0.
container-test-run-certificates> ca # [39579.749164] ca systemd[1]: Started User Login Management.
container-test-run-certificates> ca # [39579.749843] ca systemd[1]: Starting linger-users.service...
container-test-run-certificates> ca # [39579.774061] ca systemd-networkd[198]: eth1: Gained IPv6LL
container-test-run-certificates> ca # [39579.780787] ca systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> ca # [39579.780886] ca systemd[1]: Finished linger-users.service.
container-test-run-certificates> ca # [39579.812168] ca acme-setup-start[222]: + set -euo pipefail
container-test-run-certificates> ca # [39579.812314] ca acme-setup-start[222]: + test -e ca/key.pem
container-test-run-certificates> ca # [39579.812314] ca acme-setup-start[222]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> ca # [39579.818752] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> ca # [39579.820070] ca systemd[1]: Starting Ensure certificate for ca.foo...
container-test-run-certificates> ca # [39580.031349] ca step-ca[207]: badger 2026/10/16 20:08:48 INFO: All 0 tables opened in 0s
container-test-run-certificates> ca # [39580.033670] ca step-ca[207]: 2026/10/16 20:08:48 Building new tls configuration using step-ca x509 Signer Interface
container-test-run-certificates> ca # [39580.035957] ca step-ca[207]: 2026/10/16 20:08:48 Starting Smallstep CA/0.30.2 (linux/amd64)
container-test-run-certificates> ca # [39580.035957] ca step-ca[207]: 2026/10/16 20:08:48 Documentation: https://u.step.sm/docs/ca
container-test-run-certificates> ca # [39580.035957] ca step-ca[207]: 2026/10/16 20:08:48 Community Discord: https://u.step.sm/discord
container-test-run-certificates> ca # [39580.035957] ca step-ca[207]: 2026/10/16 20:08:48 Config file: /etc/smallstep/ca.json
container-test-run-certificates> ca # [39580.036063] ca step-ca[207]: 2026/10/16 20:08:48 The primary server URL is https://ca.foo:1443
container-test-run-certificates> ca # [39580.036063] ca step-ca[207]: 2026/10/16 20:08:48 Root certificates are available at https://ca.foo:1443/roots.pem
container-test-run-certificates> ca # [39580.036063] ca step-ca[207]: 2026/10/16 20:08:48 X.509 Root Fingerprint: a6b7094ed9cada697e81c0c71bac4084aeeeedb2924b510c8013be30b218b4ae
container-test-run-certificates> ca # [39580.036119] ca systemd[1]: Started step-ca service.
container-test-run-certificates> ca # [39580.036331] ca step-ca[207]: 2026/10/16 20:08:48 Serving HTTPS on 0.0.0.0:1443 ...
container-test-run-certificates> ca # [39580.452157] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [39580.453958] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']'
container-test-run-certificates> ca # [39580.453958] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=
container-test-run-certificates> ca # [39580.458427] ca acme-ca.foo-start[285]: + cd ca.foo
container-test-run-certificates> ca # [39580.458582] ca acme-ca.foo-start[285]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> ca # [39580.459393] ca acme-ca.foo-start[286]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> ca # [39580.459527] ca acme-ca.foo-start[285]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> ca # [39580.460185] ca acme-ca.foo-start[285]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> ca # [39580.460333] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> ca # [39580.461278] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> ca # [39580.462133] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [39580.462980] ca acme-ca.foo-start[259]: + for fixpath in out certificates
container-test-run-certificates> ca # [39580.462998] ca acme-ca.foo-start[259]: + '[' -d out ']'
container-test-run-certificates> ca # [39580.462998] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [39580.464024] ca acme-ca.foo-start[259]: + chown -R acme:nginx out
container-test-run-certificates> ca # [39580.465398] ca acme-ca.foo-start[259]: + for fixpath in out certificates
container-test-run-certificates> ca # [39580.465414] ca acme-ca.foo-start[259]: + '[' -d certificates ']'
container-test-run-certificates> ca # [39580.467247] ca systemd[1]: Finished Ensure certificate for ca.foo.
container-test-run-certificates> ca # [39580.468101] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca # [39581.087848] ca nginx-pre-start[297]: nginx: the configuration file /nix/store/j9k1pqlkp4dg4848kv820jyplrx4bjw5-nginx.conf syntax is ok
container-test-run-certificates> ca # [39581.088159] ca nginx-pre-start[297]: nginx: configuration file /nix/store/j9k1pqlkp4dg4848kv820jyplrx4bjw5-nginx.conf test is successful
container-test-run-certificates> ca # [39581.090776] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> ca # [39581.091048] ca systemd[1]: Reached target Multi-User System.
container-test-run-certificates> ca # [39581.091609] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> ca # [39581.699851] ca acme-order-renew-ca.foo-start[300]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [39581.701931] ca acme-order-renew-ca.foo-start[300]: + set -euo pipefail
container-test-run-certificates> ca # [39581.702007] ca acme-order-renew-ca.foo-start[300]: + exec
container-test-run-certificates> ca # [39581.702007] ca acme-order-renew-ca.foo-start[300]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11
container-test-run-certificates> ca # [39581.702787] ca acme-order-renew-ca.foo-start[312]: ++ find accounts -path '*/keys/*.key' -print -quit
container-test-run-certificates> ca # [39581.704188] ca acme-order-renew-ca.foo-start[300]: + '[' -n '' ']'
container-test-run-certificates> ca # [39581.704220] ca acme-order-renew-ca.foo-start[300]: + exec
container-test-run-certificates> ca # [39581.704247] ca acme-order-renew-ca.foo-start[300]: + '[' -e certificates/ca.foo.key ']'
container-test-run-certificates> ca # [39581.704268] ca acme-order-renew-ca.foo-start[300]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains
container-test-run-certificates> ca # [39581.713924] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.658752112Z INFO  Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key
container-test-run-certificates> ca # [39581.727446] ca step-ca[207]: time="2026-10-16T20:08:50Z" level=info duration="63.47µs" duration-ns=63470 fields.time="2026-10-16T20:08:50Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=81ec1e52-541d-4915-ad5c-1bbd0ab85c63 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39581.727688] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.672458436Z INFO  Registering the account. email=none@none.tld
container-test-run-certificates> ca # [39581.737581] ca step-ca[207]: time="2026-10-16T20:08:50Z" level=info duration=9.85434ms duration-ns=9854340 fields.time="2026-10-16T20:08:50Z" method=HEAD name=ca nonce=bkFQaTNmVUdGV3R2OUc3aVBZMk1GMERQU3JuVEtGVXo path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=bcbb0713-1a62-498d-972e-5723169ba97c size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39581.738872] ca step-ca[207]: time="2026-10-16T20:08:50Z" level=info duration="969.076µs" duration-ns=969076 fields.time="2026-10-16T20:08:50Z" method=POST name=ca nonce=QUtaMUJpcVVUZlRzbnZDNE1LRFpRZlNmYjg3V2xoSHg path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=cf957fe1-c381-4df2-8230-d9e0f4455f0b response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/YQSuBDV42CMypqnNlnyQIrd2REyjGwL7/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39581.739114] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.683957905Z WARN  !!!! HEADS UP !!!!
container-test-run-certificates> ca # [39581.739114] ca acme-order-renew-ca.foo-start[313]: Your account credentials have been saved in your
container-test-run-certificates> ca # [39581.739114] ca acme-order-renew-ca.foo-start[313]: configuration directory at "accounts".
container-test-run-certificates> ca # [39581.739114] ca acme-order-renew-ca.foo-start[313]: You should make a secure backup of this folder now. This
container-test-run-certificates> ca # [39581.739114] ca acme-order-renew-ca.foo-start[313]: configuration directory will also contain private keys
container-test-run-certificates> ca # [39581.739114] ca acme-order-renew-ca.foo-start[313]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> ca # [39581.739114] ca acme-order-renew-ca.foo-start[313]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> ca # [39581.739269] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.684113528Z INFO  Obtaining bundled SAN certificate. domains=ca.foo
container-test-run-certificates> ca # [39581.740762] ca step-ca[207]: time="2026-10-16T20:08:50Z" level=info duration=1.328482ms duration-ns=1328482 fields.time="2026-10-16T20:08:50Z" method=POST name=ca nonce=amNkTjFUbVczWnM2ZlRhY1ZMTzdYVmZUbThKdExFN2c path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1830f018-91db-4594-b01c-a0aa8e70ab17 response="{\"id\":\"0BHSiTmz7RL2BLVubQh3gzzIVTIGZTIE\",\"status\":\"pending\",\"expires\":\"2026-10-17T20:08:50Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-16T20:07:50Z\",\"notAfter\":\"2027-01-14T20:08:50Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/hoqrGEZXoKOD9tnVnlbJoNPeOVKVzZ3v\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/0BHSiTmz7RL2BLVubQh3gzzIVTIGZTIE/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39581.797811] ca step-ca[207]: time="2026-10-16T20:08:50Z" level=info duration="575.314µs" duration-ns=575314 fields.time="2026-10-16T20:08:50Z" method=POST name=ca nonce=ZUxoTWRDeHpZeUZVZ0V5MkljaVBHd3BSMFZ0MnZOZWE path=/acme/acme/authz/hoqrGEZXoKOD9tnVnlbJoNPeOVKVzZ3v protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=85cb8b88-266c-4448-ac01-2771e777c417 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"2PxUVppTSrPsb2u6IFKBp1sxldxDtP3v\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/hoqrGEZXoKOD9tnVnlbJoNPeOVKVzZ3v/iZFNnTjBnBXzSNhL5srQg8JnbkvlWEr8\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"2PxUVppTSrPsb2u6IFKBp1sxldxDtP3v\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/hoqrGEZXoKOD9tnVnlbJoNPeOVKVzZ3v/72qYSNSztJ4r1wdfugay17rk9dWDX82U\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"2PxUVppTSrPsb2u6IFKBp1sxldxDtP3v\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/hoqrGEZXoKOD9tnVnlbJoNPeOVKVzZ3v/kMUl3wfhb3sRuAeTjlzLNA1AsSwrRQ5L\"}],\"wildcard\":false,\"expires\":\"2026-10-17T20:08:50Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39581.797988] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.742818221Z INFO  Use solver. domain=ca.foo type=http-01
container-test-run-certificates> ca # [39581.797988] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.742829722Z INFO  http01: Trying to solve HTTP-01. domain=ca.foo
container-test-run-certificates> ca # [39581.799925] ca step-ca[207]: time="2026-10-16T20:08:50Z" level=info duration=1.637144ms duration-ns=1637144 fields.time="2026-10-16T20:08:50Z" method=POST name=ca nonce=WUdCOXIzRGFOSjBYaTdXY3N2eVNYWUg2VWFLZTlPTG0 path=/acme/acme/challenge/hoqrGEZXoKOD9tnVnlbJoNPeOVKVzZ3v/72qYSNSztJ4r1wdfugay17rk9dWDX82U protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=83d362df-529b-455a-b655-04a0e50dcde9 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"2PxUVppTSrPsb2u6IFKBp1sxldxDtP3v\",\"validated\":\"2026-10-16T20:08:50Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/hoqrGEZXoKOD9tnVnlbJoNPeOVKVzZ3v/72qYSNSztJ4r1wdfugay17rk9dWDX82U\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39581.800058] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.744896956Z INFO  The server validated our request. domain=ca.foo
container-test-run-certificates> ca # [39581.800088] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.744929347Z INFO  Validations succeeded; requesting certificates. domains=ca.foo
container-test-run-certificates> ca # [39581.802314] ca step-ca[207]: time="2026-10-16T20:08:50Z" level=info duration=1.95963ms duration-ns=1959630 fields.time="2026-10-16T20:08:50Z" method=POST name=ca nonce=Q2s5R05TSnhQelVFdlhFT0lMbkZrb0RIUW43UEp3aFM path=/acme/acme/order/0BHSiTmz7RL2BLVubQh3gzzIVTIGZTIE/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=4cade824-f699-4885-a5a6-e50f6bd36f60 response="{\"id\":\"0BHSiTmz7RL2BLVubQh3gzzIVTIGZTIE\",\"status\":\"valid\",\"expires\":\"2026-10-17T20:08:50Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-16T20:07:50Z\",\"notAfter\":\"2027-01-14T20:08:50Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/hoqrGEZXoKOD9tnVnlbJoNPeOVKVzZ3v\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/0BHSiTmz7RL2BLVubQh3gzzIVTIGZTIE/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/CaN6qIeTvkqZ1wL6mZ5P53Pn8KaMVkQR\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39581.802936] ca step-ca[207]: time="2026-10-16T20:08:50Z" level=info certificate=MIIB0zCCAXmgAwIBAgIQUs7HhhNM9uZIYgABalwcHDAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjEwMTYyMDA3NTBaFw0yNzAxMTQyMDA4NTBaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABHoH0PFZipH35WcEw8i+qE+DqmS1/6+zTRt6EtgQd7oSwFH1A88RRIjPM4tMdCsrBq2CQqdpKJxayxf6q1GxVO6jgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUbFreSznzMsTg+7pIfzj3YxMJuEQwHwYDVR0jBBgwFoAUBTu+iFb6KPHLm1XzKo2FUZFQSeUwEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNIADBFAiAr8qkIbH17xeGSV8xJOhZwPA93nMLs+cmiZK+PuoQA6QIhAJvymi1TRhe0T4Bo56ApiRl9JNeHyXrDkym2eFF3Qrtp duration="361.541µs" duration-ns=361541 fields.time="2026-10-16T20:08:50Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=ZERVUThjSWpIYWxxVTY3ZVRKeGR2djlraHhHMnNDVHM path=/acme/acme/certificate/CaN6qIeTvkqZ1wL6mZ5P53Pn8KaMVkQR protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=eed87738-6903-4a1f-9bbc-23553b86981f sans="map[dns:[ca.foo]]" serial=110070355629279439162442986558198651932 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-16T20:07:50Z" valid-to="2027-01-14T20:08:50Z"
container-test-run-certificates> ca # [39581.803005] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.747846762Z INFO  Server responded with a certificate. domains=ca.foo
container-test-run-certificates> ca # [39581.803030] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.747876959Z INFO  Writing file. filepath=certificates/ca.foo.crt
container-test-run-certificates> ca # [39581.803060] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.747908568Z INFO  Writing file. filepath=certificates/ca.foo.issuer.crt
container-test-run-certificates> ca # [39581.803081] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.747929628Z INFO  Writing file. filepath=certificates/ca.foo.key
container-test-run-certificates> ca # [39581.803115] ca acme-order-renew-ca.foo-start[313]: 2026-10-16T20:08:50.747963281Z INFO  Writing file. filepath=certificates/ca.foo.json
container-test-run-certificates> ca # [39581.805665] ca acme-order-renew-ca.foo-start[300]: + touch out/acme-success
container-test-run-certificates> ca # [39581.806816] ca acme-order-renew-ca.foo-start[300]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [39581.807444] ca acme-order-renew-ca.foo-start[300]: + touch out/renewed
container-test-run-certificates> ca # [39581.808239] ca acme-order-renew-ca.foo-start[300]: + echo Installing new certificate
container-test-run-certificates> ca # [39581.808239] ca acme-order-renew-ca.foo-start[300]: Installing new certificate
container-test-run-certificates> ca # [39581.808263] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [39581.809016] ca acme-order-renew-ca.foo-start[332]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> ca # [39581.809161] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.key out/key.pem
container-test-run-certificates> ca # [39581.809918] ca acme-order-renew-ca.foo-start[333]: 'certificates/ca.foo.key' -> 'out/key.pem'
container-test-run-certificates> ca # [39581.810052] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem
container-test-run-certificates> ca # [39581.810809] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> ca # [39581.810934] ca acme-order-renew-ca.foo-start[300]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> ca # [39581.811789] ca acme-order-renew-ca.foo-start[300]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [39581.812674] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates
container-test-run-certificates> ca # [39581.812686] ca acme-order-renew-ca.foo-start[300]: + '[' -d out ']'
container-test-run-certificates> ca # [39581.812686] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [39581.813513] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx out
container-test-run-certificates> ca # [39581.815063] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates
container-test-run-certificates> ca # [39581.815074] ca acme-order-renew-ca.foo-start[300]: + '[' -d certificates ']'
container-test-run-certificates> ca # [39581.815074] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [39581.815987] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [39581.817291] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [39581.927221] ca systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> ca # [39581.929936] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [39581.930088] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> ca # [39582.525324] ca nginx[350]: nginx: the configuration file /nix/store/j9k1pqlkp4dg4848kv820jyplrx4bjw5-nginx.conf syntax is ok
container-test-run-certificates> ca # [39582.525536] ca nginx[350]: nginx: configuration file /nix/store/j9k1pqlkp4dg4848kv820jyplrx4bjw5-nginx.conf test is successful
container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 5.64 seconds)
container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem'
container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds)
container-test-run-certificates> ca: must succeed: systemctl restart nginx.service
container-test-run-certificates> ca # [39583.110390] ca systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> ca # [39583.110535] ca systemd[1]: Startup finished in 5.338s.
container-test-run-certificates> ca # [39583.152995] ca systemd[1]: Stopping Nginx Web Server...
container-test-run-certificates> ca # [39583.218105] ca systemd[1]: nginx.service: Deactivated successfully.
container-test-run-certificates> ca # [39583.218240] ca systemd[1]: Stopped Nginx Web Server.
container-test-run-certificates> ca # [39583.218256] ca systemd[1]: nginx.service: Consumed 2.337s CPU time over 2.750s wall clock time.
container-test-run-certificates> ca # [39583.219818] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.72 seconds)
container-test-run-certificates> server: systemd-nspawn running (pid 443)
container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal...
container-test-run-certificates> client: systemd-nspawn running (pid 446)
container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal...
container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem'
container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container server on /build/vm-state-server.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container client on /build/vm-state-client.
container-test-run-certificates> ca # [39583.867125] ca nginx-pre-start[374]: nginx: the configuration file /nix/store/j9k1pqlkp4dg4848kv820jyplrx4bjw5-nginx.conf syntax is ok
container-test-run-certificates> ca # [39583.867351] ca nginx-pre-start[374]: nginx: configuration file /nix/store/j9k1pqlkp4dg4848kv820jyplrx4bjw5-nginx.conf test is successful
container-test-run-certificates> ca # [39583.870107] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [39584.395740] server systemd-journald[72]: Journal started
container-test-run-certificates> server # [39584.395782] server systemd-journald[72]: Runtime Journal (/run/log/journal/d5435c04f5494a6f80925c1f8f2c4b16) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> server # [39584.399700] server systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> server # [39584.409172] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [39584.438306] server systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> server # [39584.438688] server systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> server # [39584.438963] server systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> server # [39584.443321] server systemd-journald[72]: Time spent on flushing to /var/log/journal/d5435c04f5494a6f80925c1f8f2c4b16 is 1.183ms for 7 entries.
container-test-run-certificates> server # [39584.443321] server systemd-journald[72]: System Journal (/var/log/journal/d5435c04f5494a6f80925c1f8f2c4b16) is 8M, max 4G, 3.9G free.
container-test-run-certificates> server # [39584.456664] server systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> server # [39584.456813] server systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> server # [39584.457451] server systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> server # [39584.457497] server systemd[1]: Reached target Local File Systems.
container-test-run-certificates> server # [39584.457920] server systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> server # [39584.457950] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [39584.458280] server systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> server # [39584.458589] server systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> server # [39584.458605] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> server # [39584.468413] server systemd-tmpfiles[156]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> server # [39584.468569] server systemd-tmpfiles[156]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> server # [39584.468670] server systemd-tmpfiles[156]: fchmod() of /var/log/journal/d5435c04f5494a6f80925c1f8f2c4b16 failed: Operation not permitted
container-test-run-certificates> server # [39584.468819] server systemd-tmpfiles[156]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> server # [39584.469704] server systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> server # [39584.470101] server systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> server # [39584.470395] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> server # [39584.476155] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> server # [39584.481877] server systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> server # [39584.482286] server systemd[1]: Starting Update is Completed...
container-test-run-certificates> server # [39584.486020] server systemd[1]: Finished Firewall.
container-test-run-certificates> server # [39584.486083] server systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> server # [39584.486220] server systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> server # [39584.486674] server systemd[1]: Starting Network Management...
container-test-run-certificates> server # [39584.486785] server systemd[1]: Finished Update is Completed.
container-test-run-certificates> server # [39584.550585] server systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [39584.395061] client systemd-journald[72]: Journal started
container-test-run-certificates> client # [39584.395089] client systemd-journald[72]: Runtime Journal (/run/log/journal/cc027a07b0d141c0934af756376c53b9) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> client # [39584.400225] client systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> client # [39584.407078] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> client # [39584.414714] client systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> client # [39584.415058] client systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [39584.415367] client systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> client # [39584.441048] client systemd-journald[72]: Time spent on flushing to /var/log/journal/cc027a07b0d141c0934af756376c53b9 is 1.094ms for 7 entries.
container-test-run-certificates> client # [39584.441048] client systemd-journald[72]: System Journal (/var/log/journal/cc027a07b0d141c0934af756376c53b9) is 8M, max 4G, 3.9G free.
container-test-run-certificates> client # [39584.453671] client systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> client # [39584.453869] client systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> client # [39584.454405] client systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> client # [39584.454451] client systemd[1]: Reached target Local File Systems.
container-test-run-certificates> client # [39584.454842] client systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> client # [39584.454867] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [39584.455209] client systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> client # [39584.455502] client systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> client # [39584.455518] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> client # [39584.464614] client systemd-tmpfiles[153]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> client # [39584.464756] client systemd-tmpfiles[153]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> client # [39584.464857] client systemd-tmpfiles[153]: fchmod() of /var/log/journal/cc027a07b0d141c0934af756376c53b9 failed: Operation not permitted
container-test-run-certificates> client # [39584.465015] client systemd-tmpfiles[153]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [39584.465685] client systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> client # [39584.466099] client systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [39584.466407] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> client # [39584.472168] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> client # [39584.477583] client systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> client # [39584.478044] client systemd[1]: Starting Update is Completed...
container-test-run-certificates> client # [39584.479860] client systemd[1]: Finished Firewall.
container-test-run-certificates> client # [39584.479915] client systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> client # [39584.480057] client systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> client # [39584.480490] client systemd[1]: Starting Network Management...
container-test-run-certificates> client # [39584.484972] client systemd[1]: Finished Update is Completed.
container-test-run-certificates> client # [39584.549929] client systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> server # [39585.022822] server systemd-networkd[188]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [39585.022896] server systemd-networkd[188]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [39585.030895] server systemd-networkd[188]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [39585.031046] server systemd-networkd[188]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [39585.031122] server systemd-networkd[188]: lo: Link UP
container-test-run-certificates> server # [39585.031125] server systemd-networkd[188]: lo: Gained carrier
container-test-run-certificates> server # [39585.031264] server systemd-networkd[188]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> server # [39585.031492] server systemd[1]: Started Network Management.
container-test-run-certificates> server # [39585.048170] server systemd-networkd[188]: eth1: Link UP
container-test-run-certificates> server # [39585.048208] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> server # [39585.048344] server systemd-networkd[188]: eth1: Gained carrier
container-test-run-certificates> server # [39585.070458] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> client # [39585.012038] client systemd-networkd[184]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [39585.012109] client systemd-networkd[184]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [39585.019933] client systemd-networkd[184]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [39585.020084] client systemd-networkd[184]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [39585.020153] client systemd-networkd[184]: lo: Link UP
container-test-run-certificates> client # [39585.020157] client systemd-networkd[184]: lo: Gained carrier
container-test-run-certificates> client # [39585.020299] client systemd-networkd[184]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> client # [39585.020521] client systemd[1]: Started Network Management.
container-test-run-certificates> client # [39585.020561] client systemd-networkd[184]: eth1: Link UP
container-test-run-certificates> client # [39585.020675] client systemd-networkd[184]: eth1: Gained carrier
container-test-run-certificates> client # [39585.021163] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> client # [39585.053784] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [39585.396558] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> server # [39585.397664] server systemd-resolved[131]: Positive Trust Anchors:
container-test-run-certificates> server # [39585.397675] server systemd-resolved[131]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> server # [39585.397678] server systemd-resolved[131]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> server # [39585.397695] server systemd-resolved[131]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> server # [39585.408364] server systemd-resolved[131]: Using system hostname 'server'.
container-test-run-certificates> server # [39585.409344] server systemd[1]: Started Network Name Resolution.
container-test-run-certificates> server # [39585.409418] server systemd[1]: Reached target Network.
container-test-run-certificates> server # [39585.409450] server systemd[1]: Reached target Network is Online.
container-test-run-certificates> server # [39585.409476] server systemd[1]: Reached target System Initialization.
container-test-run-certificates> server # [39585.409631] server systemd[1]: Started Renew ACME Certificate for test.foo.
container-test-run-certificates> server # [39585.409645] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [39585.409656] server systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> server # [39585.409668] server systemd[1]: Reached target Timer Units.
container-test-run-certificates> server # [39585.409735] server systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> server # [39585.409800] server systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> server # [39585.409868] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> server # [39585.409878] server systemd[1]: Reached target Socket Units.
container-test-run-certificates> server # [39585.409897] server systemd[1]: Reached target Basic System.
container-test-run-certificates> server # [39585.410612] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> server # [39585.410940] server systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> server # [39585.410959] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem
container-test-run-certificates> server # [39585.411303] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> server # [39585.411838] server systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> server # [39585.439985] server systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> server # [39585.524729] server acme-setup-privileged[195]: + set -euo pipefail
container-test-run-certificates> server # [39585.524729] server acme-setup-privileged[195]: + cd /var/lib/acme
container-test-run-certificates> server # [39585.524729] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> server # [39585.525603] server acme-setup-privileged[195]: + chown -R acme .lego/accounts
container-test-run-certificates> server # [39585.526481] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [39585.526515] server acme-setup-privileged[195]: + '[' -d test.foo ']'
container-test-run-certificates> server # [39585.526515] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [39585.526515] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']'
container-test-run-certificates> server # [39585.546966] server nsncd[197]: Oct 16 20:08:54.491 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> server # [39585.546994] server systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> server # [39585.547046] server systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> server # [39585.547087] server systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> server # [39585.553206] server systemd[1]: Starting User Login Management...
container-test-run-certificates> server # [39585.553923] server systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> server # [39585.560679] server systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> server # [39585.561332] server systemd[1]: Started Console Getty.
container-test-run-certificates> server # [39585.561353] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> server # [39585.561361] server systemd[1]: Reached target Login Prompts.
container-test-run-certificates> server # [39585.664951] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> server # [39585.665303] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> server # [39585.665303] server dbus-broker-launch[198]: Invalid user-name in /nix/store/3j5vva7yqdfxndbhqx061z9aad8mvcxi-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> server # [39585.665533] server systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> client # [39585.394342] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [39585.397664] client systemd-resolved[107]: Positive Trust Anchors:
container-test-run-certificates> client # [39585.397674] client systemd-resolved[107]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> client # [39585.397677] client systemd-resolved[107]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> client # [39585.397692] client systemd-resolved[107]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> client # [39585.408554] client systemd-resolved[107]: Using system hostname 'client'.
container-test-run-certificates> client # [39585.409431] client systemd[1]: Started Network Name Resolution.
container-test-run-certificates> client # [39585.409488] client systemd[1]: Reached target Network.
container-test-run-certificates> client # [39585.409535] client systemd[1]: Reached target System Initialization.
container-test-run-certificates> client # [39585.409569] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [39585.409596] client systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> client # [39585.409605] client systemd[1]: Reached target Timer Units.
container-test-run-certificates> client # [39585.409702] client systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> client # [39585.409778] client systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> client # [39585.409873] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> client # [39585.409888] client systemd[1]: Reached target Socket Units.
container-test-run-certificates> client # [39585.409915] client systemd[1]: Reached target Basic System.
container-test-run-certificates> client # [39585.410597] client systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> client # [39585.411019] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> client # [39585.411596] client systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> client # [39585.439252] client systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> client # [39585.547030] client nsncd[192]: Oct 16 20:08:54.491 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> client # [39585.547062] client systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> client # [39585.547101] client systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> client # [39585.547132] client systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> client # [39585.553219] client systemd[1]: Starting User Login Management...
container-test-run-certificates> client # [39585.553876] client systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> client # [39585.559457] client systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> client # [39585.560109] client systemd[1]: Started Console Getty.
container-test-run-certificates> client # [39585.560132] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> client # [39585.560145] client systemd[1]: Reached target Login Prompts.
container-test-run-certificates> client # [39585.666102] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> client # [39585.666466] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> client # [39585.666466] client dbus-broker-launch[193]: Invalid user-name in /nix/store/l86nsxmcyia50ml3b77mygyhz9n3r2q9-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> client # [39585.666682] client systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> client # [39585.670174] client dbus-broker-launch[193]: Ready
container-test-run-certificates> server # [39585.669200] server dbus-broker-launch[198]: Ready
container-test-run-certificates> server # [39586.104283] server systemd-logind[222]: New seat seat0.
container-test-run-certificates> server # [39586.104370] server systemd[1]: Started User Login Management.
container-test-run-certificates> server # [39586.105121] server systemd[1]: Starting linger-users.service...
container-test-run-certificates> server # [39586.129373] server systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> server # [39586.129472] server systemd[1]: Finished linger-users.service.
container-test-run-certificates> server # [39586.156715] server acme-setup-start[211]: + set -euo pipefail
container-test-run-certificates> server # [39586.156851] server acme-setup-start[211]: + test -e ca/key.pem
container-test-run-certificates> server # [39586.156851] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> server # [39586.163674] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> server # [39586.164460] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> client # [39586.109594] client systemd-logind[208]: New seat seat0.
container-test-run-certificates> client # [39586.109729] client systemd[1]: Started User Login Management.
container-test-run-certificates> client # [39586.125265] client systemd[1]: Starting linger-users.service...
container-test-run-certificates> client # [39586.130943] client systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> client # [39586.130984] client systemd[1]: Finished linger-users.service.
container-test-run-certificates> client # [39586.131175] client systemd[1]: Reached target Multi-User System.
container-test-run-certificates> client # [39586.131264] client systemd[1]: Startup finished in 2.003s.
container-test-run-certificates> client # [39586.558088] client systemd-networkd[184]: eth1: Gained IPv6LL
container-test-run-certificates> server # [39586.735402] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [39586.736950] server acme-test.foo-start[248]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [39586.736950] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [39586.741324] server acme-test.foo-start[258]: + cd test.foo
container-test-run-certificates> server # [39586.741518] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [39586.742410] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [39586.742555] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [39586.743279] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [39586.743407] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [39586.744248] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [39586.745027] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [39586.745788] server acme-test.foo-start[248]: + for fixpath in out certificates
container-test-run-certificates> server # [39586.745808] server acme-test.foo-start[248]: + '[' -d out ']'
container-test-run-certificates> server # [39586.745808] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [39586.746673] server acme-test.foo-start[248]: + chown -R acme:nginx out
container-test-run-certificates> server # [39586.748509] server acme-test.foo-start[248]: + for fixpath in out certificates
container-test-run-certificates> server # [39586.748521] server acme-test.foo-start[248]: + '[' -d certificates ']'
container-test-run-certificates> server # [39586.750679] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [39586.751455] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server # [39586.879052] server systemd-networkd[188]: eth1: Gained IPv6LL
container-test-run-certificates> server # [39587.365576] server nginx-pre-start[270]: nginx: the configuration file /nix/store/8ccg11zc6yiq6apfgvrigm8nw1jdbp2z-nginx.conf syntax is ok
container-test-run-certificates> server # [39587.365834] server nginx-pre-start[270]: nginx: configuration file /nix/store/8ccg11zc6yiq6apfgvrigm8nw1jdbp2z-nginx.conf test is successful
container-test-run-certificates> server # [39587.367987] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [39587.368593] server systemd[1]: Reached target Multi-User System.
container-test-run-certificates> server # [39587.369301] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> server # [39587.990085] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [39587.991834] server acme-order-renew-test.foo-start[273]: + set -euo pipefail
container-test-run-certificates> server # [39587.991871] server acme-order-renew-test.foo-start[273]: + exec
container-test-run-certificates> server # [39587.991891] server acme-order-renew-test.foo-start[273]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11
container-test-run-certificates> server # [39587.992662] server acme-order-renew-test.foo-start[285]: ++ find accounts -path '*/keys/*.key' -print -quit
container-test-run-certificates> server # [39587.994194] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']'
container-test-run-certificates> server # [39587.994216] server acme-order-renew-test.foo-start[273]: + exec
container-test-run-certificates> server # [39587.994246] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']'
container-test-run-certificates> server # [39587.994264] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains
container-test-run-certificates> server # [39588.003968] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:56.948800305Z INFO  Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key
container-test-run-certificates> server # [39588.018068] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:56.962904899Z INFO  Registering the account. email=none@none.tld
container-test-run-certificates> server # [39588.032323] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:56.977160889Z WARN  !!!! HEADS UP !!!!
container-test-run-certificates> server # [39588.032323] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your
container-test-run-certificates> server # [39588.032323] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts".
container-test-run-certificates> server # [39588.032323] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This
container-test-run-certificates> server # [39588.032323] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys
container-test-run-certificates> server # [39588.032323] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> server # [39588.032323] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> server # [39588.032464] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:56.977219239Z INFO  Obtaining bundled SAN certificate. domains=test.foo
container-test-run-certificates> server # [39588.093613] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.038440682Z INFO  Use solver. domain=test.foo type=http-01
container-test-run-certificates> server # [39588.093613] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.038457143Z INFO  http01: Trying to solve HTTP-01. domain=test.foo
container-test-run-certificates> server # [39588.096588] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.041426877Z INFO  The server validated our request. domain=test.foo
container-test-run-certificates> server # [39588.096619] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.041468094Z INFO  Validations succeeded; requesting certificates. domains=test.foo
container-test-run-certificates> server # [39588.101285] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.046125746Z INFO  Server responded with a certificate. domains=test.foo
container-test-run-certificates> server # [39588.101317] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.046157466Z INFO  Writing file. filepath=certificates/test.foo.crt
container-test-run-certificates> server # [39588.101361] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.046208752Z INFO  Writing file. filepath=certificates/test.foo.issuer.crt
container-test-run-certificates> server # [39588.101390] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.046229932Z INFO  Writing file. filepath=certificates/test.foo.key
container-test-run-certificates> server # [39588.101418] server acme-order-renew-test.foo-start[286]: 2026-10-16T20:08:57.046265870Z INFO  Writing file. filepath=certificates/test.foo.json
container-test-run-certificates> server # [39588.103933] server acme-order-renew-test.foo-start[273]: + touch out/acme-success
container-test-run-certificates> server # [39588.104805] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [39588.105448] server acme-order-renew-test.foo-start[273]: + touch out/renewed
container-test-run-certificates> server # [39588.106231] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate
container-test-run-certificates> server # [39588.106231] server acme-order-renew-test.foo-start[273]: Installing new certificate
container-test-run-certificates> server # [39588.106259] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [39588.107009] server acme-order-renew-test.foo-start[305]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> server # [39588.107188] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem
container-test-run-certificates> server # [39588.107890] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.key' -> 'out/key.pem'
container-test-run-certificates> server # [39588.108037] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem
container-test-run-certificates> server # [39588.108759] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> server # [39588.108882] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> server # [39588.109724] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [39588.110595] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates
container-test-run-certificates> server # [39588.110607] server acme-order-renew-test.foo-start[273]: + '[' -d out ']'
container-test-run-certificates> server # [39588.110607] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [39588.111450] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out
container-test-run-certificates> server # [39588.112873] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates
container-test-run-certificates> server # [39588.112883] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']'
container-test-run-certificates> server # [39588.112883] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> server # [39588.113700] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates
container-test-run-certificates> server # [39588.114992] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> server # [39588.226033] server systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> server # [39588.228469] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [39588.228586] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> ca # [39588.017871] ca step-ca[207]: time="2026-10-16T20:08:56Z" level=info duration="34.375µs" duration-ns=34375 fields.time="2026-10-16T20:08:56Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=1d31ad0b-b04a-4923-89ad-f58df6a87ebb response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39588.029711] ca step-ca[207]: time="2026-10-16T20:08:56Z" level=info duration=10.908535ms duration-ns=10908535 fields.time="2026-10-16T20:08:56Z" method=HEAD name=ca nonce=Z3gzMEZ0RnNVSldFeWFsbklUeDlOS2xnZ0FsekNDOU0 path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=dfe30651-3fc3-486d-8af5-be94866b7919 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39588.032118] ca step-ca[207]: time="2026-10-16T20:08:56Z" level=info duration=1.417109ms duration-ns=1417109 fields.time="2026-10-16T20:08:56Z" method=POST name=ca nonce=QktIVEpReE01VGxqWGNUSUxjTFZVOUZEZnVuZVlqNW4 path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=2604fc20-ed5a-4428-85df-54779f8a851a response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/z100eSyeBI6UjL3IduLBVvLbPEaatnjD/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39588.034408] ca step-ca[207]: time="2026-10-16T20:08:56Z" level=info duration=1.259823ms duration-ns=1259823 fields.time="2026-10-16T20:08:56Z" method=POST name=ca nonce=Z0RTbnc1c1NOak1ubjJkSFFFRU5YZUdPVG5OT3hYazM path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=8ca501c6-3ea7-4837-989d-35c4500a25c5 response="{\"id\":\"DfCgWbd6nnL37fNnoc2bE4EVFB1e3QQI\",\"status\":\"pending\",\"expires\":\"2026-10-17T20:08:56Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-16T20:07:56Z\",\"notAfter\":\"2027-01-14T20:08:56Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/EYSoDKTPFM6rX0OJCkdy0KabqRRwAYfH\"],\"finalize\":\"https://ca.foo/acme/acme/order/DfCgWbd6nnL37fNnoc2bE4EVFB1e3QQI/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39588.093339] ca step-ca[207]: time="2026-10-16T20:08:57Z" level=info duration=1.572301ms duration-ns=1572301 fields.time="2026-10-16T20:08:57Z" method=POST name=ca nonce=WHo4VUJxczZlaGpiVktIN1dTdW53ZWgxbkFKQjhFM1Q path=/acme/acme/authz/EYSoDKTPFM6rX0OJCkdy0KabqRRwAYfH protocol=HTTP/1.1 referer= remote-address="::1" request-id=595b6dd2-3279-4155-97f4-f5dcb2bdae4f response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"E7bU0z1uJtGLLJ9OJpWVP96FgNOqxp1a\",\"url\":\"https://ca.foo/acme/acme/challenge/EYSoDKTPFM6rX0OJCkdy0KabqRRwAYfH/yPr5IsCvO5IE3ey30fbskn3Nyp8T8cN0\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"E7bU0z1uJtGLLJ9OJpWVP96FgNOqxp1a\",\"url\":\"https://ca.foo/acme/acme/challenge/EYSoDKTPFM6rX0OJCkdy0KabqRRwAYfH/l0GISOEfjz4RQH8NzQKe7blLXBcYgbMi\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"E7bU0z1uJtGLLJ9OJpWVP96FgNOqxp1a\",\"url\":\"https://ca.foo/acme/acme/challenge/EYSoDKTPFM6rX0OJCkdy0KabqRRwAYfH/0GUYIuRI8KYKGc1LUtHgtt7VA8Q1hNfT\"}],\"wildcard\":false,\"expires\":\"2026-10-17T20:08:56Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39588.096420] ca step-ca[207]: time="2026-10-16T20:08:57Z" level=info duration=2.055902ms duration-ns=2055902 fields.time="2026-10-16T20:08:57Z" method=POST name=ca nonce=MmcyOTFaTTc0cEd5bEx5QzF0cXNZNmFxSTdTYnpPRlg path=/acme/acme/challenge/EYSoDKTPFM6rX0OJCkdy0KabqRRwAYfH/l0GISOEfjz4RQH8NzQKe7blLXBcYgbMi protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=737cceb0-cef6-4a92-bfd8-97793e8d5b68 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"E7bU0z1uJtGLLJ9OJpWVP96FgNOqxp1a\",\"validated\":\"2026-10-16T20:08:57Z\",\"url\":\"https://ca.foo/acme/acme/challenge/EYSoDKTPFM6rX0OJCkdy0KabqRRwAYfH/l0GISOEfjz4RQH8NzQKe7blLXBcYgbMi\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39588.099831] ca step-ca[207]: time="2026-10-16T20:08:57Z" level=info duration=2.345888ms duration-ns=2345888 fields.time="2026-10-16T20:08:57Z" method=POST name=ca nonce=WUZYbUdGQUk1RzVpaDA4TkQ3b2ZTeEFxNzdMN1JzbWo path=/acme/acme/order/DfCgWbd6nnL37fNnoc2bE4EVFB1e3QQI/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=838eb3cb-0189-43f5-914e-11d667a47d8d response="{\"id\":\"DfCgWbd6nnL37fNnoc2bE4EVFB1e3QQI\",\"status\":\"valid\",\"expires\":\"2026-10-17T20:08:56Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-16T20:07:56Z\",\"notAfter\":\"2027-01-14T20:08:56Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/EYSoDKTPFM6rX0OJCkdy0KabqRRwAYfH\"],\"finalize\":\"https://ca.foo/acme/acme/order/DfCgWbd6nnL37fNnoc2bE4EVFB1e3QQI/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/P1vDvcrfPMjUPYsazLoZwhmF0JsCWPmi\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [39588.101136] ca step-ca[207]: time="2026-10-16T20:08:57Z" level=info certificate=MIIB2TCCAX6gAwIBAgIRALhadL7/WLN689QQRC06zyAwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDE2MjAwNzU2WhcNMjcwMTE0MjAwODU2WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCj0v5nZaWytjK2pKJs2nuzV7UNc7Swe4zfjm++TyH77tvuGS4zKSVEjQT3hmBDyAcHAykYocTbotdruRDf/8nyjgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUsx6LdkPP3jV9+bvvfTckddEuJ8cwHwYDVR0jBBgwFoAUBTu+iFb6KPHLm1XzKo2FUZFQSeUwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0kAMEYCIQCurGtFf8Ysj+y/BWph/IUQ0GuXQbvWuOm5c+3j9UTgmwIhAMSwKx+4cI63P1utRSc6EYIVy9ueQI7fIguHzkVorATr duration="509.529µs" duration-ns=509529 fields.time="2026-10-16T20:08:57Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=c21WTUNZYXdpNmxZZzRJR2RMVUN0bHNwdzhuaG1pUmg path=/acme/acme/certificate/P1vDvcrfPMjUPYsazLoZwhmF0JsCWPmi protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=77e9b4c9-5d02-4f13-a1c5-021757314c34 sans="map[dns:[test.foo]]" serial=245047625833583466953103540898246610720 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-16T20:07:56Z" valid-to="2027-01-14T20:08:56Z"
container-test-run-certificates> server # [39588.865976] server nginx[323]: nginx: the configuration file /nix/store/8ccg11zc6yiq6apfgvrigm8nw1jdbp2z-nginx.conf syntax is ok
container-test-run-certificates> server # [39588.866198] server nginx[323]: nginx: configuration file /nix/store/8ccg11zc6yiq6apfgvrigm8nw1jdbp2z-nginx.conf test is successful
container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 5.64 seconds)
container-test-run-certificates> server: must succeed: systemctl restart nginx.service
container-test-run-certificates> server # [39589.490897] server systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> server # [39589.491075] server systemd[1]: Startup finished in 5.363s.
container-test-run-certificates> server # [39589.521991] server systemd[1]: Stopping Nginx Web Server...
container-test-run-certificates> server # [39589.598376] server systemd[1]: nginx.service: Deactivated successfully.
container-test-run-certificates> server # [39589.598513] server systemd[1]: Stopped Nginx Web Server.
container-test-run-certificates> server # [39589.598539] server systemd[1]: nginx.service: Consumed 3.648s CPU time over 2.846s wall clock time.
container-test-run-certificates> server # [39589.599948] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.77 seconds)
container-test-run-certificates> client: waiting for success: curl -v https://test.foo
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 57684 failed: Connection refused
container-test-run-certificates> *   Trying 192.168.1.3:443...
container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 39170 failed: Connection refused
container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server
container-test-run-certificates> server # [39590.275135] server nginx-pre-start[346]: nginx: the configuration file /nix/store/8ccg11zc6yiq6apfgvrigm8nw1jdbp2z-nginx.conf syntax is ok
container-test-run-certificates> server # [39590.275399] server nginx-pre-start[346]: nginx: configuration file /nix/store/8ccg11zc6yiq6apfgvrigm8nw1jdbp2z-nginx.conf test is successful
container-test-run-certificates> server # [39590.277951] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1554 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [933 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [79 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Oct 16 20:07:56 2026 GMT
container-test-run-certificates> *   expire date: Jan 14 20:08:56 2027 GMT
container-test-run-certificates> *   issuer: CN=Clan Intermediate CA
container-test-run-certificates> *   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 0
container-test-run-certificates> * SSL certificate verified via OpenSSL.
container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 57686 
container-test-run-certificates>   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
container-test-run-certificates>                                  Dload  Upload  Total   Spent   Left   Speed
container-test-run-certificates>   0      0   0      0   0      0      0      0                              0* using HTTP/2
container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/
container-test-run-certificates> * [HTTP/2] [1] [:method: GET]
container-test-run-certificates> * [HTTP/2] [1] [:scheme: https]
container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo]
container-test-run-certificates> * [HTTP/2] [1] [:path: /]
container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0]
container-test-run-certificates> * [HTTP/2] [1] [accept: */*]
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> * Request completely sent off
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> 100     20 100     20   0      0   1720      0                              0
container-test-run-certificates> * Connection #0 to host test.foo:443 left intact
container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds)
container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2
container-test-run-certificates> Certificate:
container-test-run-certificates>     Data:
container-test-run-certificates>         Version: 3 (0x2)
container-test-run-certificates>         Serial Number:
container-test-run-certificates>             b8:5a:74:be:ff:58:b3:7a:f3:d4:10:44:2d:3a:cf:20
container-test-run-certificates>         Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>         Issuer: CN=Clan Intermediate CA
container-test-run-certificates>         Validity
container-test-run-certificates>             Not Before: Oct 16 20:07:56 2026 GMT
container-test-run-certificates>             Not After : Jan 14 20:08:56 2027 GMT
container-test-run-certificates>         Subject: CN=test.foo
container-test-run-certificates>         Subject Public Key Info:
container-test-run-certificates>             Public Key Algorithm: id-ecPublicKey
container-test-run-certificates>                 Public-Key: (256 bit)
container-test-run-certificates>                 pub:
container-test-run-certificates>                     04:28:f4:bf:99:d9:69:6c:ad:8c:ad:a9:28:9b:36:
container-test-run-certificates>                     9e:ec:d5:ed:43:5c:ed:2c:1e:e3:37:e3:9b:ef:93:
container-test-run-certificates>                     c8:7e:fb:b6:fb:86:4b:8c:ca:49:51:23:41:3d:e1:
container-test-run-certificates>                     98:10:f2:01:c1:c0:ca:46:28:71:36:e8:b5:da:ee:
container-test-run-certificates>                     44:37:ff:f2:7c
container-test-run-certificates>                 ASN1 OID: prime256v1
container-test-run-certificates>                 NIST CURVE: P-256
container-test-run-certificates>         X509v3 extensions:
container-test-run-certificates>             X509v3 Key Usage: critical
container-test-run-certificates>                 Digital Signature
container-test-run-certificates>             X509v3 Extended Key Usage: 
container-test-run-certificates>                 TLS Web Server Authentication, TLS Web Client Authentication
container-test-run-certificates>             X509v3 Subject Key Identifier: 
container-test-run-certificates>                 B3:1E:8B:76:43:CF:DE:35:7D:F9:BB:EF:7D:37:24:75:D1:2E:27:C7
container-test-run-certificates>             X509v3 Authority Key Identifier: 
container-test-run-certificates>                 05:3B:BE:88:56:FA:28:F1:CB:9B:55:F3:2A:8D:85:51:91:50:49:E5
container-test-run-certificates>             X509v3 Subject Alternative Name: 
container-test-run-certificates>                 DNS:test.foo
container-test-run-certificates>             1.3.6.1.4.1.37476.9000.64.1: 
container-test-run-certificates>                 0......acme..
container-test-run-certificates>     Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>     Signature Value:
container-test-run-certificates>         30:46:02:21:00:ae:ac:6b:45:7f:c6:2c:8f:ec:bf:05:6a:61:
container-test-run-certificates>         fc:85:10:d0:6b:97:41:bb:d6:b8:e9:b9:73:ed:e3:f5:44:e0:
container-test-run-certificates>         9b:02:21:00:c4:b0:2b:1f:b8:70:8e:b7:3f:5b:ad:45:27:3a:
container-test-run-certificates>         11:82:15:cb:db:9e:40:8e:df:22:0b:87:ce:45:68:ac:04:eb
container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds)
container-test-run-certificates> (finished: run the VM test script, in 13.82 seconds)
container-test-run-certificates> test script finished in 13.85s
container-test-run-certificates> cleanup
container-test-run-certificates> kill NspawnMachine (pid 50)
container-test-run-certificates> kill NspawnMachine (pid 446)
container-test-run-certificates> Container ca terminated by signal KILL.
container-test-run-certificates> kill NspawnMachine (pid 443)
container-test-run-certificates> Container client terminated by signal KILL.
container-test-run-certificates> (finished: cleanup, in 0.24 seconds)
container-test-run-certificates> Container server terminated by signal KILL.