these 46 derivations will be built:
  /nix/store/zs5dwwvgicj4wcldlmvwflw3xh4pwqix-system-path.drv
  /nix/store/5ri3jr7qi5x74rglb2p2ivsvi5qpyd13-dbus-1.drv
  /nix/store/lnhfn2mvfrip10wrif27816sj7kgaymb-X-Restart-Triggers-dbus-broker.drv
  /nix/store/0snq7n65g0pzlns9hsbhzz6d7hrqardz-unit-dbus-broker.service.drv
  /nix/store/xb2gfq77ln1mjxawqwdy7qc7vhj2vcs8-unit-dbus-broker.service.drv
  /nix/store/1iijpc3whb9f1mxry3nhqwpqarpkizha-user-units.drv
  /nix/store/x9m71np36ag9advzf2pk24jss07qca7h-system-path.drv
  /nix/store/1l058hyjvif3932g9839z9xmaz6q2arj-dbus-1.drv
  /nix/store/abaf3m9pdfijin8vmyivn5xmkxv5i0wq-users-groups.json.drv
  /nix/store/l29v7arhg1rw2ks0dvi52zzasx5y3qjv-vars-check-certificates.drv
  /nix/store/ngjkydfqci6vh9v81iskddg47qw8k9b7-X-Restart-Triggers-dbus-broker.drv
  /nix/store/5y4qpagfm8kcrx28xx791vvh6lfz66zp-unit-dbus-broker.service.drv
  /nix/store/msm13kxx7llfalj3igl27anrvwqvmrzw-user-units.drv
  /nix/store/qmppsbbl3679lkhbpm4d01kna8pwxbzd-unit-dbus-broker.service.drv
  /nix/store/z4i338dfl6dlnax2dsz9khdyg7fbin7k-unit-nix-daemon.service.drv
  /nix/store/rg6caif24k3g4kw7x0xxdn8x589c6bjy-system-units.drv
  /nix/store/dgya2pv9j49nf8wy770yxl72lx0yrxdr-etc.drv
  /nix/store/hb2kilavrk3icciqz78wvld3dl9aq12k-decrypt-age-secrets.drv
  /nix/store/1wzvrywsnp4d588hgkmjx79z6kcwl8rq-activate.drv
  /nix/store/5vfybb96zqjac8927cgrn1w8mii38pa6-test-script.drv
  /nix/store/jh9b0y4id44a36yxxnx2kaarygfg1407-system-units.drv
  /nix/store/j2xxgph7g0q6cin4nynxyfwmf0v895nx-etc.drv
  /nix/store/959d5sb9arvw4r70pv78zkr8q6mlkkf2-users-groups.json.drv
  /nix/store/kkshiaq2xiidwfcss6hgs3i4yb0wcnff-activate.drv
  /nix/store/z5l6gz9dj7ybnnwwwrviriiqib9kd36v-dry-activate.drv
  /nix/store/6wpwk0gylbmwcg54hqbj9rkw72klxcvf-nixos-system-server-test.drv
  /nix/store/v2k6v5n7zpfbcc2ib1qgsf14m1gms9bs-system-path.drv
  /nix/store/mhjr82dh3y7b34xmx88d32ibbngrhvs0-dbus-1.drv
  /nix/store/p986b49mxjwhk7dmpfr9jjj1iv4g3m66-X-Restart-Triggers-dbus-broker.drv
  /nix/store/7d5yhn5wi00rgmkrz0w8v7my73js5xnn-unit-dbus-broker.service.drv
  /nix/store/aa1axf3dfjda1jlfc0jdnffd406c4h79-unit-dbus-broker.service.drv
  /nix/store/rcvlvwcas1xxndvgr7rx07vgdn908vyb-system-units.drv
  /nix/store/sjlphi5fybh7h1kisbip3vv2qy7hkfxl-user-units.drv
  /nix/store/n15hxy573zax4v188p6ashdp0v6jwwwg-etc.drv
  /nix/store/ybk6mq7x84a8m27yvhsxy7wzl22iwmfp-activate.drv
  /nix/store/8ngdz1nrx2zd1jn9w0lpmwk95x27dy91-nixos-system-client-test.drv
  /nix/store/9z27n0dmxvws333aqsrcsmcfvvqp5llp-run-server-nspawn.drv
  /nix/store/fm510cf7xca8rajym126yap0idzz245r-dry-activate.drv
  /nix/store/gligzbhpmfqm4csxsdb66lqifgq9qrif-python3.14-nixos-test-lib-1.0.0.drv
  /nix/store/ixfydcj11krp5d0ccm07bdl1ry2q291i-nixos-system-ca-test.drv
  /nix/store/lwcdwijl603r9rvrc7jrdl1ibvaxmd6c-run-client-nspawn.drv
  /nix/store/nzq31jinkmniwfrbq8vimq31lc0m6p78-run-ca-nspawn.drv
  /nix/store/lpilj6k6l5n7xqnd73afq6x4bsa0zhng-driverConfiguration.json.drv
  /nix/store/mm2n1n9ydlrkhiiqkcpvagl0mm639cyr-nixos-test-driver-1.1.drv
  /nix/store/x3cli7yd53s25pqghjmjjmm7arsfdapb-nixos-test-driver-certificates.drv
  /nix/store/scn07b3jy213x0fac85sw32m6jja4yjs-container-test-run-certificates.drv
building '/nix/store/5vfybb96zqjac8927cgrn1w8mii38pa6-test-script.drv'
building '/nix/store/v2k6v5n7zpfbcc2ib1qgsf14m1gms9bs-system-path.drv'
building '/nix/store/x9m71np36ag9advzf2pk24jss07qca7h-system-path.drv'
building '/nix/store/zs5dwwvgicj4wcldlmvwflw3xh4pwqix-system-path.drv'
building '/nix/store/z4i338dfl6dlnax2dsz9khdyg7fbin7k-unit-nix-daemon.service.drv'
system-path> structuredAttrs is enabled
system-path> structuredAttrs is enabled
system-path> structuredAttrs is enabled
unit-nix-daemon.service> structuredAttrs is enabled
building '/nix/store/l29v7arhg1rw2ks0dvi52zzasx5y3qjv-vars-check-certificates.drv'
building '/nix/store/959d5sb9arvw4r70pv78zkr8q6mlkkf2-users-groups.json.drv'
building '/nix/store/abaf3m9pdfijin8vmyivn5xmkxv5i0wq-users-groups.json.drv'
system-path> created 1729 symlinks in user environment
system-path> created 1729 symlinks in user environment
system-path> created 1729 symlinks in user environment
vars-check-certificates> Running vars check using Nix-based executor...
vars-check-certificates> ✓ All vars checks completed successfully
building '/nix/store/1l058hyjvif3932g9839z9xmaz6q2arj-dbus-1.drv'
building '/nix/store/5ri3jr7qi5x74rglb2p2ivsvi5qpyd13-dbus-1.drv'
building '/nix/store/mhjr82dh3y7b34xmx88d32ibbngrhvs0-dbus-1.drv'
building '/nix/store/ngjkydfqci6vh9v81iskddg47qw8k9b7-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/z5l6gz9dj7ybnnwwwrviriiqib9kd36v-dry-activate.drv'
building '/nix/store/hb2kilavrk3icciqz78wvld3dl9aq12k-decrypt-age-secrets.drv'
building '/nix/store/lnhfn2mvfrip10wrif27816sj7kgaymb-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/p986b49mxjwhk7dmpfr9jjj1iv4g3m66-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/fm510cf7xca8rajym126yap0idzz245r-dry-activate.drv'
building '/nix/store/5y4qpagfm8kcrx28xx791vvh6lfz66zp-unit-dbus-broker.service.drv'
building '/nix/store/qmppsbbl3679lkhbpm4d01kna8pwxbzd-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/0snq7n65g0pzlns9hsbhzz6d7hrqardz-unit-dbus-broker.service.drv'
building '/nix/store/7d5yhn5wi00rgmkrz0w8v7my73js5xnn-unit-dbus-broker.service.drv'
building '/nix/store/aa1axf3dfjda1jlfc0jdnffd406c4h79-unit-dbus-broker.service.drv'
building '/nix/store/xb2gfq77ln1mjxawqwdy7qc7vhj2vcs8-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/msm13kxx7llfalj3igl27anrvwqvmrzw-user-units.drv'
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/jh9b0y4id44a36yxxnx2kaarygfg1407-system-units.drv'
building '/nix/store/rcvlvwcas1xxndvgr7rx07vgdn908vyb-system-units.drv'
building '/nix/store/rg6caif24k3g4kw7x0xxdn8x589c6bjy-system-units.drv'
building '/nix/store/sjlphi5fybh7h1kisbip3vv2qy7hkfxl-user-units.drv'
building '/nix/store/1iijpc3whb9f1mxry3nhqwpqarpkizha-user-units.drv'
building '/nix/store/j2xxgph7g0q6cin4nynxyfwmf0v895nx-etc.drv'
building '/nix/store/dgya2pv9j49nf8wy770yxl72lx0yrxdr-etc.drv'
building '/nix/store/n15hxy573zax4v188p6ashdp0v6jwwwg-etc.drv'
building '/nix/store/kkshiaq2xiidwfcss6hgs3i4yb0wcnff-activate.drv'
building '/nix/store/6wpwk0gylbmwcg54hqbj9rkw72klxcvf-nixos-system-server-test.drv'
building '/nix/store/1wzvrywsnp4d588hgkmjx79z6kcwl8rq-activate.drv'
building '/nix/store/ybk6mq7x84a8m27yvhsxy7wzl22iwmfp-activate.drv'
nixos-system-server-test> structuredAttrs is enabled
building '/nix/store/9z27n0dmxvws333aqsrcsmcfvvqp5llp-run-server-nspawn.drv'
building '/nix/store/ixfydcj11krp5d0ccm07bdl1ry2q291i-nixos-system-ca-test.drv'
building '/nix/store/8ngdz1nrx2zd1jn9w0lpmwk95x27dy91-nixos-system-client-test.drv'
nixos-system-ca-test> structuredAttrs is enabled
building '/nix/store/nzq31jinkmniwfrbq8vimq31lc0m6p78-run-ca-nspawn.drv'
nixos-system-client-test> structuredAttrs is enabled
building '/nix/store/lwcdwijl603r9rvrc7jrdl1ibvaxmd6c-run-client-nspawn.drv'
building '/nix/store/lpilj6k6l5n7xqnd73afq6x4bsa0zhng-driverConfiguration.json.drv'
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/x3cli7yd53s25pqghjmjjmm7arsfdapb-nixos-test-driver-certificates.drv'
nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-certificates> All checks passed!
nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-certificates> All checks passed!
building '/nix/store/scn07b3jy213x0fac85sw32m6jja4yjs-container-test-run-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol'
building '/nix/store/scn07b3jy213x0fac85sw32m6jja4yjs-container-test-run-certificates.drv'
container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-certificates> start all VLans
container-test-run-certificates> (finished: start all VLans, in 0.00 seconds)
container-test-run-certificates> 
container-test-run-certificates> Test will time out and terminate in 3600 seconds
container-test-run-certificates> run the VM test script
container-test-run-certificates> additionally exposed symbols:
container-test-run-certificates>     ca, client, server,
container-test-run-certificates>     vlan1,
container-test-run-certificates>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-certificates> start all VMs
container-test-run-certificates> ca: systemd-nspawn running (pid 53)
container-test-run-certificates> client: systemd-nspawn running (pid 54)
container-test-run-certificates> server: systemd-nspawn running (pid 55)
container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal...
container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal...
container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal...
container-test-run-certificates> (finished: start all VMs, in 0.00 seconds)
container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container client on /build/vm-state-client.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca.
container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container server on /build/vm-state-server.
container-test-run-certificates> server # [6138197.941500] server systemd-journald[69]: Journal started
container-test-run-certificates> server # [6138197.941532] server systemd-journald[69]: Runtime Journal (/run/log/journal/da3f7fc691264ba2927323a9015230f8) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> server # [6138197.948957] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [6138197.955203] server systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> client # [6138197.864107] client systemd-journald[69]: Journal started
container-test-run-certificates> client # [6138197.864143] client systemd-journald[69]: Runtime Journal (/run/log/journal/22822e019e194809945f5f0d1b7df738) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> client # [6138197.867098] client systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> server # [6138197.955746] server systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [6138197.873275] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [6138197.956245] server systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> client # [6138197.881082] client systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> server # [6138197.977548] server systemd-journald[69]: Time spent on flushing to /var/log/journal/da3f7fc691264ba2927323a9015230f8 is 1.595ms for 6 entries.
container-test-run-certificates> server # [6138197.977548] server systemd-journald[69]: System Journal (/var/log/journal/da3f7fc691264ba2927323a9015230f8) is 8M, max 4G, 3.9G free.
container-test-run-certificates> server # [6138197.983690] server systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> server # [6138197.983958] server systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> server # [6138197.984077] server systemd[1]: Reached target Local File Systems.
container-test-run-certificates> client # [6138197.881948] client systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> server # [6138197.984742] server systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> client # [6138197.882547] client systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> server # [6138197.984780] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [6138197.907757] client systemd-journald[69]: Time spent on flushing to /var/log/journal/22822e019e194809945f5f0d1b7df738 is 1.554ms for 7 entries.
container-test-run-certificates> server # [6138197.985516] server systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> client # [6138197.907757] client systemd-journald[69]: System Journal (/var/log/journal/22822e019e194809945f5f0d1b7df738) is 8M, max 4G, 3.9G free.
container-test-run-certificates> server # [6138197.985544] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> client # [6138197.921164] client systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> server # [6138198.011377] server systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> client # [6138197.921845] client systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> server # [6138198.012944] server systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> client # [6138197.921936] client systemd[1]: Reached target Local File Systems.
container-test-run-certificates> server # [6138198.033165] server systemd-tmpfiles[141]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> client # [6138197.922611] client systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> server # [6138198.033384] server systemd-tmpfiles[141]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6138197.922652] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [6138197.923407] client systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> server # [6138198.033545] server systemd-tmpfiles[141]: fchmod() of /var/log/journal/da3f7fc691264ba2927323a9015230f8 failed: Operation not permitted
container-test-run-certificates> client # [6138197.923434] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> client # [6138197.985313] client systemd[1]: Finished Firewall.
container-test-run-certificates> server # [6138198.033769] server systemd-tmpfiles[141]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6138197.986185] client systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> client # [6138197.986646] client systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> client # [6138197.986909] client systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> client # [6138197.987924] client systemd[1]: Starting Network Management...
container-test-run-certificates> client # [6138197.988508] client systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> client # [6138198.004047] client systemd-tmpfiles[175]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> client # [6138198.004255] client systemd-tmpfiles[175]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6138198.004400] client systemd-tmpfiles[175]: fchmod() of /var/log/journal/22822e019e194809945f5f0d1b7df738 failed: Operation not permitted
container-test-run-certificates> client # [6138198.004616] client systemd-tmpfiles[175]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6138198.008502] client systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> client # [6138198.011359] client systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [6138198.012228] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [6138197.850425] ca systemd-journald[78]: Journal started
container-test-run-certificates> client # [6138198.025007] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> ca # [6138197.850475] ca systemd-journald[78]: Runtime Journal (/run/log/journal/ad68bfedff7e4045945076f1deb8af80) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> ca # [6138197.869028] ca systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> ca # [6138197.875050] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> ca # [6138197.883068] ca systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> client # [6138198.029202] client systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> ca # [6138197.884154] ca systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [6138198.030256] client systemd[1]: Starting Update is Completed...
container-test-run-certificates> ca # [6138197.902241] ca systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> client # [6138198.037702] client systemd[1]: Finished Update is Completed.
container-test-run-certificates> ca # [6138197.907757] ca systemd-journald[78]: Time spent on flushing to /var/log/journal/ad68bfedff7e4045945076f1deb8af80 is 1.452ms for 7 entries.
container-test-run-certificates> ca # [6138197.907757] ca systemd-journald[78]: System Journal (/var/log/journal/ad68bfedff7e4045945076f1deb8af80) is 8M, max 4G, 3.9G free.
container-test-run-certificates> ca # [6138197.924714] ca systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> ca # [6138197.925526] ca systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> ca # [6138197.927150] ca systemd[1]: Reached target Local File Systems.
container-test-run-certificates> ca # [6138197.927843] ca systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> ca # [6138197.927884] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [6138197.929644] ca systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> ca # [6138197.929668] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> ca # [6138197.973483] ca systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> ca # [6138197.976067] ca systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> ca # [6138197.977706] ca systemd[1]: Finished Firewall.
container-test-run-certificates> ca # [6138197.978123] ca systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> ca # [6138197.978334] ca systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> ca # [6138197.979216] ca systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [6138197.987923] ca systemd-tmpfiles[184]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> ca # [6138197.988136] ca systemd-tmpfiles[184]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [6138197.988277] ca systemd-tmpfiles[184]: fchmod() of /var/log/journal/ad68bfedff7e4045945076f1deb8af80 failed: Operation not permitted
container-test-run-certificates> ca # [6138197.988482] ca systemd-tmpfiles[184]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [6138197.995788] ca systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> ca # [6138197.997277] ca systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> ca # [6138197.997885] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [6138198.006908] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> ca # [6138198.016538] ca systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> ca # [6138198.017452] ca systemd[1]: Starting Update is Completed...
container-test-run-certificates> ca # [6138198.026215] ca systemd[1]: Finished Update is Completed.
container-test-run-certificates> server # [6138198.040178] server systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> server # [6138198.042069] server systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> server # [6138198.042975] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> server # [6138198.052658] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> server # [6138198.062315] server systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> server # [6138198.063423] server systemd[1]: Starting Update is Completed...
container-test-run-certificates> server # [6138198.069148] server systemd[1]: Finished Update is Completed.
container-test-run-certificates> server # [6138198.072995] server systemd[1]: Finished Firewall.
container-test-run-certificates> server # [6138198.073113] server systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> server # [6138198.073276] server systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> server # [6138198.074090] server systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [6138198.923587] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [6138198.923702] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> ca # [6138198.924757] ca systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> ca # [6138198.970841] ca systemd-networkd[188]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [6138198.970929] ca systemd-networkd[188]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [6138198.978561] ca systemd-networkd[188]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [6138198.978759] ca systemd-networkd[188]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [6138198.978831] ca systemd-networkd[188]: lo: Link UP
container-test-run-certificates> ca # [6138198.978835] ca systemd-networkd[188]: lo: Gained carrier
container-test-run-certificates> ca # [6138198.978983] ca systemd-networkd[188]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> ca # [6138198.979293] ca systemd[1]: Started Network Management.
container-test-run-certificates> ca # [6138198.981284] ca systemd-networkd[188]: eth1: Link UP
container-test-run-certificates> ca # [6138198.981309] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> ca # [6138198.983099] ca systemd-networkd[188]: eth1: Gained carrier
container-test-run-certificates> ca # [6138198.999490] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [6138198.918375] server systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [6138198.924434] client systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [6138198.973825] client systemd-networkd[174]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [6138198.934567] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [6138198.973922] client systemd-networkd[174]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [6138198.964397] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [6138198.982109] client systemd-networkd[174]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [6138198.964492] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [6138198.982318] client systemd-networkd[174]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [6138198.969925] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [6138198.983193] client systemd-networkd[174]: lo: Link UP
container-test-run-certificates> server # [6138198.970106] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [6138198.983199] client systemd-networkd[174]: lo: Gained carrier
container-test-run-certificates> server # [6138198.970181] server systemd-networkd[186]: lo: Link UP
container-test-run-certificates> client # [6138198.983400] client systemd-networkd[174]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> server # [6138198.970185] server systemd-networkd[186]: lo: Gained carrier
container-test-run-certificates> client # [6138198.983864] client systemd[1]: Started Network Management.
container-test-run-certificates> server # [6138198.970328] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> client # [6138198.984973] client systemd-networkd[174]: eth1: Link UP
container-test-run-certificates> server # [6138198.970584] server systemd[1]: Started Network Management.
container-test-run-certificates> client # [6138198.985149] client systemd-networkd[174]: eth1: Gained carrier
container-test-run-certificates> server # [6138198.970619] server systemd-networkd[186]: eth1: Link UP
container-test-run-certificates> client # [6138198.985513] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> server # [6138198.970766] server systemd-networkd[186]: eth1: Gained carrier
container-test-run-certificates> client # [6138199.003106] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [6138198.981254] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> server # [6138198.991398] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> client # [6138199.271096] client systemd-resolved[99]: Positive Trust Anchors:
container-test-run-certificates> client # [6138199.271109] client systemd-resolved[99]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> client # [6138199.271113] client systemd-resolved[99]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> client # [6138199.271137] client systemd-resolved[99]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> client # [6138199.283877] client systemd-resolved[99]: Using system hostname 'client'.
container-test-run-certificates> client # [6138199.285320] client systemd[1]: Started Network Name Resolution.
container-test-run-certificates> client # [6138199.285382] client systemd[1]: Reached target Network.
container-test-run-certificates> client # [6138199.285424] client systemd[1]: Reached target System Initialization.
container-test-run-certificates> client # [6138199.285457] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [6138199.285477] client systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> client # [6138199.285492] client systemd[1]: Reached target Timer Units.
container-test-run-certificates> client # [6138199.285587] client systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> client # [6138199.285688] client systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> client # [6138199.285775] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> client # [6138199.285786] client systemd[1]: Reached target Socket Units.
container-test-run-certificates> client # [6138199.285812] client systemd[1]: Reached target Basic System.
container-test-run-certificates> client # [6138199.286598] client systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> client # [6138199.287131] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> client # [6138199.288008] client systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> client # [6138199.319618] client systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> client # [6138199.456995] client nsncd[189]: Aug 10 11:04:16.822 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> client # [6138199.457107] client systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> client # [6138199.457176] client systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> client # [6138199.457225] client systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> client # [6138199.458561] client systemd[1]: Starting User Login Management...
container-test-run-certificates> client # [6138199.461074] client systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> client # [6138199.488120] client systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> client # [6138199.489139] client systemd[1]: Started Console Getty.
container-test-run-certificates> client # [6138199.489180] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> client # [6138199.489199] client systemd[1]: Reached target Login Prompts.
container-test-run-certificates> ca # [6138199.298586] ca systemd-resolved[117]: Positive Trust Anchors:
container-test-run-certificates> ca # [6138199.298598] ca systemd-resolved[117]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> ca # [6138199.298600] ca systemd-resolved[117]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> ca # [6138199.298619] ca systemd-resolved[117]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> ca # [6138199.312360] ca systemd-resolved[117]: Using system hostname 'ca'.
container-test-run-certificates> ca # [6138199.314039] ca systemd[1]: Started Network Name Resolution.
container-test-run-certificates> ca # [6138199.314129] ca systemd[1]: Reached target Network.
container-test-run-certificates> ca # [6138199.314173] ca systemd[1]: Reached target Network is Online.
container-test-run-certificates> ca # [6138199.314211] ca systemd[1]: Reached target System Initialization.
container-test-run-certificates> ca # [6138199.314443] ca systemd[1]: Started Renew ACME Certificate for ca.foo.
container-test-run-certificates> ca # [6138199.314468] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [6138199.314485] ca systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> ca # [6138199.314501] ca systemd[1]: Reached target Timer Units.
container-test-run-certificates> ca # [6138199.314614] ca systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> ca # [6138199.314708] ca systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> ca # [6138199.314805] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> ca # [6138199.314826] ca systemd[1]: Reached target Socket Units.
container-test-run-certificates> ca # [6138199.314855] ca systemd[1]: Reached target Basic System.
container-test-run-certificates> ca # [6138199.316080] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> ca # [6138199.316611] ca systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> ca # [6138199.316635] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem
container-test-run-certificates> ca # [6138199.317196] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> ca # [6138199.317809] ca systemd[1]: Starting step-ca service...
container-test-run-certificates> ca # [6138199.318711] ca systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> ca # [6138199.347881] ca systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> ca # [6138199.458443] ca acme-setup-privileged[201]: + set -euo pipefail
container-test-run-certificates> ca # [6138199.458443] ca acme-setup-privileged[201]: + cd /var/lib/acme
container-test-run-certificates> ca # [6138199.458443] ca acme-setup-privileged[201]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> ca # [6138199.460194] ca acme-setup-privileged[201]: + chown -R acme .lego/accounts
container-test-run-certificates> ca # [6138199.461655] ca acme-setup-privileged[201]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [6138199.461655] ca acme-setup-privileged[201]: + '[' -d ca.foo ']'
container-test-run-certificates> ca # [6138199.461655] ca acme-setup-privileged[201]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [6138199.461655] ca acme-setup-privileged[201]: + '[' -d .lego/ca.foo ']'
container-test-run-certificates> ca # [6138199.479815] ca nsncd[203]: Aug 10 11:04:16.845 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> ca # [6138199.482425] ca systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> ca # [6138199.483062] ca systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> ca # [6138199.483129] ca systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> ca # [6138199.484121] ca systemd[1]: Starting User Login Management...
container-test-run-certificates> ca # [6138199.484686] ca systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> ca # [6138199.496093] ca systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> ca # [6138199.496838] ca systemd[1]: Started Console Getty.
container-test-run-certificates> ca # [6138199.496865] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> ca # [6138199.496878] ca systemd[1]: Reached target Login Prompts.
container-test-run-certificates> server # [6138199.500142] server systemd-resolved[96]: Positive Trust Anchors:
container-test-run-certificates> server # [6138199.500155] server systemd-resolved[96]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> server # [6138199.500158] server systemd-resolved[96]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> server # [6138199.500183] server systemd-resolved[96]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> server # [6138199.516199] server systemd-resolved[96]: Using system hostname 'server'.
container-test-run-certificates> server # [6138199.517524] server systemd[1]: Started Network Name Resolution.
container-test-run-certificates> server # [6138199.517612] server systemd[1]: Reached target Network.
container-test-run-certificates> server # [6138199.517666] server systemd[1]: Reached target Network is Online.
container-test-run-certificates> server # [6138199.517705] server systemd[1]: Reached target System Initialization.
container-test-run-certificates> server # [6138199.517925] server systemd[1]: Started Renew ACME Certificate for test.foo.
container-test-run-certificates> server # [6138199.517955] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [6138199.517974] server systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> server # [6138199.517990] server systemd[1]: Reached target Timer Units.
container-test-run-certificates> server # [6138199.518303] server systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> server # [6138199.518392] server systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> server # [6138199.518506] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> server # [6138199.518525] server systemd[1]: Reached target Socket Units.
container-test-run-certificates> server # [6138199.518565] server systemd[1]: Reached target Basic System.
container-test-run-certificates> server # [6138199.519977] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> server # [6138199.520750] server systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> server # [6138199.520778] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem
container-test-run-certificates> server # [6138199.521882] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> server # [6138199.523011] server systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> server # [6138199.557467] server systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> server # [6138199.702970] server acme-setup-privileged[192]: + set -euo pipefail
container-test-run-certificates> server # [6138199.702970] server acme-setup-privileged[192]: + cd /var/lib/acme
container-test-run-certificates> server # [6138199.703369] server acme-setup-privileged[192]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> server # [6138199.703951] server acme-setup-privileged[192]: + chown -R acme .lego/accounts
container-test-run-certificates> server # [6138199.705708] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [6138199.705708] server acme-setup-privileged[192]: + '[' -d test.foo ']'
container-test-run-certificates> server # [6138199.705708] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [6138199.705708] server acme-setup-privileged[192]: + '[' -d .lego/test.foo ']'
container-test-run-certificates> ca # [6138199.698254] ca dbus-broker-launch[205]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> client # [6138199.685536] client dbus-broker-launch[190]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> ca # [6138199.699464] ca dbus-broker-launch[205]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> client # [6138199.686491] client dbus-broker-launch[190]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> ca # [6138199.699464] ca dbus-broker-launch[205]: Invalid user-name in /nix/store/03c1qz6sbw65myz4g15gwnmk6bn9bqvs-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> client # [6138199.686491] client dbus-broker-launch[190]: Invalid user-name in /nix/store/3i0dril8pm9b9k5yk00rp0fqs31imqmb-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> ca # [6138199.700035] ca systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> client # [6138199.686922] client systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> ca # [6138199.703849] ca dbus-broker-launch[205]: Ready
container-test-run-certificates> client # [6138199.692959] client dbus-broker-launch[190]: Ready
container-test-run-certificates> ca: must succeed: systemctl restart acme-order-renew-ca.foo.service 
container-test-run-certificates> server # [6138199.758934] server nsncd[194]: Aug 10 11:04:17.124 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> server # [6138199.759003] server systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> server # [6138199.759080] server systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> server # [6138199.759126] server systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> server # [6138199.760099] server systemd[1]: Starting User Login Management...
container-test-run-certificates> server # [6138199.762854] server systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> server # [6138199.780245] server systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> server # [6138199.781294] server systemd[1]: Started Console Getty.
container-test-run-certificates> server # [6138199.781321] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> server # [6138199.781336] server systemd[1]: Reached target Login Prompts.
container-test-run-certificates> server # [6138199.930300] server dbus-broker-launch[195]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> server # [6138199.931054] server dbus-broker-launch[195]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> server # [6138199.931054] server dbus-broker-launch[195]: Invalid user-name in /nix/store/nq4pz9y1rflky46nakazq0kn0c94wl35-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> server # [6138199.931440] server systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> server # [6138199.937056] server dbus-broker-launch[195]: Ready
container-test-run-certificates> client # [6138200.061095] client systemd-networkd[174]: eth1: Gained IPv6LL
container-test-run-certificates> ca # [6138200.318216] ca systemd-networkd[188]: eth1: Gained IPv6LL
container-test-run-certificates> ca # [6138200.600300] ca systemd-logind[230]: New seat seat0.
container-test-run-certificates> ca # [6138200.600440] ca systemd[1]: Started User Login Management.
container-test-run-certificates> client # [6138200.588012] client systemd-logind[198]: New seat seat0.
container-test-run-certificates> client # [6138200.588210] client systemd[1]: Started User Login Management.
container-test-run-certificates> client # [6138200.593981] client systemd[1]: Starting linger-users.service...
container-test-run-certificates> client # [6138200.604187] client systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> client # [6138200.604306] client systemd[1]: Finished linger-users.service.
container-test-run-certificates> client # [6138200.604739] client systemd[1]: Reached target Multi-User System.
container-test-run-certificates> client # [6138200.605150] client systemd[1]: Startup finished in 3.154s.
container-test-run-certificates> server # [6138200.638162] server systemd-networkd[186]: eth1: Gained IPv6LL
container-test-run-certificates> server # [6138200.815731] server systemd-logind[224]: New seat seat0.
container-test-run-certificates> server # [6138200.815891] server systemd[1]: Started User Login Management.
container-test-run-certificates> server # [6138200.830358] server systemd[1]: Starting linger-users.service...
container-test-run-certificates> server # [6138200.839631] server systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> server # [6138200.839815] server systemd[1]: Finished linger-users.service.
container-test-run-certificates> ca # [6138200.601510] ca systemd[1]: Starting linger-users.service...
container-test-run-certificates> ca # [6138200.610700] ca systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> ca # [6138200.610831] ca systemd[1]: Finished linger-users.service.
container-test-run-certificates> ca # [6138200.754245] ca acme-setup-start[218]: + set -euo pipefail
container-test-run-certificates> ca # [6138200.754245] ca acme-setup-start[218]: + test -e ca/key.pem
container-test-run-certificates> ca # [6138200.754611] ca acme-setup-start[218]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> ca # [6138200.766175] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> ca # [6138200.768450] ca systemd[1]: Starting Ensure certificate for ca.foo...
container-test-run-certificates> server # [6138200.889811] server acme-setup-start[208]: + set -euo pipefail
container-test-run-certificates> server # [6138200.889811] server acme-setup-start[208]: + test -e ca/key.pem
container-test-run-certificates> server # [6138200.889811] server acme-setup-start[208]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> server # [6138200.907215] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> server # [6138200.909208] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> ca # [6138201.060424] ca step-ca[204]: badger 2026/08/10 11:04:18 INFO: All 0 tables opened in 0s
container-test-run-certificates> ca # [6138201.072873] ca step-ca[204]: 2026/08/10 11:04:18 Building new tls configuration using step-ca x509 Signer Interface
container-test-run-certificates> ca # [6138201.076741] ca step-ca[204]: 2026/08/10 11:04:18 Starting Smallstep CA/0.30.2 (linux/amd64)
container-test-run-certificates> ca # [6138201.076741] ca step-ca[204]: 2026/08/10 11:04:18 Documentation: https://u.step.sm/docs/ca
container-test-run-certificates> ca # [6138201.076741] ca step-ca[204]: 2026/08/10 11:04:18 Community Discord: https://u.step.sm/discord
container-test-run-certificates> ca # [6138201.076741] ca step-ca[204]: 2026/08/10 11:04:18 Config file: /etc/smallstep/ca.json
container-test-run-certificates> ca # [6138201.076741] ca step-ca[204]: 2026/08/10 11:04:18 The primary server URL is https://ca.foo:1443
container-test-run-certificates> ca # [6138201.076741] ca step-ca[204]: 2026/08/10 11:04:18 Root certificates are available at https://ca.foo:1443/roots.pem
container-test-run-certificates> ca # [6138201.076741] ca step-ca[204]: 2026/08/10 11:04:18 X.509 Root Fingerprint: 0bac67e91890b96566195e4e2163d18fda49f881932fbccd8515622eee876440
container-test-run-certificates> ca # [6138201.076910] ca systemd[1]: Started step-ca service.
container-test-run-certificates> ca # [6138201.076993] ca step-ca[204]: 2026/08/10 11:04:18 Serving HTTPS on 0.0.0.0:1443 ...
container-test-run-certificates> ca # [6138202.001732] ca acme-ca.foo-start[256]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6138202.016691] ca acme-ca.foo-start[256]: + '[' -e out/acme-success ']'
container-test-run-certificates> ca # [6138202.016691] ca acme-ca.foo-start[256]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=
container-test-run-certificates> ca # [6138202.016758] ca acme-ca.foo-start[280]: + cd ca.foo
container-test-run-certificates> ca # [6138202.016758] ca acme-ca.foo-start[280]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> ca # [6138202.016986] ca acme-ca.foo-start[281]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> ca # [6138202.017061] ca acme-ca.foo-start[280]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> ca # [6138202.017834] ca acme-ca.foo-start[280]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> ca # [6138202.017991] ca acme-ca.foo-start[256]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> ca # [6138202.018892] ca acme-ca.foo-start[256]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> ca # [6138202.019722] ca acme-ca.foo-start[256]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [6138202.020594] ca acme-ca.foo-start[256]: + for fixpath in out certificates
container-test-run-certificates> ca # [6138202.020594] ca acme-ca.foo-start[256]: + '[' -d out ']'
container-test-run-certificates> ca # [6138202.020652] ca acme-ca.foo-start[256]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6138202.021447] ca acme-ca.foo-start[256]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6138202.022875] ca acme-ca.foo-start[256]: + for fixpath in out certificates
container-test-run-certificates> ca # [6138202.022875] ca acme-ca.foo-start[256]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6138202.025681] ca systemd[1]: Finished Ensure certificate for ca.foo.
container-test-run-certificates> ca # [6138202.026668] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server # [6138202.090640] server acme-test.foo-start[245]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6138202.092010] server acme-test.foo-start[245]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [6138202.092029] server acme-test.foo-start[245]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [6138202.097931] server acme-test.foo-start[255]: + cd test.foo
container-test-run-certificates> server # [6138202.098266] server acme-test.foo-start[255]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [6138202.098694] server acme-test.foo-start[256]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [6138202.098879] server acme-test.foo-start[255]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [6138202.099468] server acme-test.foo-start[255]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [6138202.099596] server acme-test.foo-start[245]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [6138202.100539] server acme-test.foo-start[245]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [6138202.101767] server acme-test.foo-start[245]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6138202.102641] server acme-test.foo-start[245]: + for fixpath in out certificates
container-test-run-certificates> server # [6138202.102641] server acme-test.foo-start[245]: + '[' -d out ']'
container-test-run-certificates> server # [6138202.102702] server acme-test.foo-start[245]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6138202.104388] server acme-test.foo-start[245]: + chown -R acme:nginx out
container-test-run-certificates> server # [6138202.105902] server acme-test.foo-start[245]: + for fixpath in out certificates
container-test-run-certificates> server # [6138202.105902] server acme-test.foo-start[245]: + '[' -d certificates ']'
container-test-run-certificates> server # [6138202.108996] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [6138202.109893] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca # [6138202.749332] ca nginx-pre-start[292]: nginx: the configuration file /nix/store/kq5c5qz20zx5wm8355dw6aszncxf3i56-nginx.conf syntax is ok
container-test-run-certificates> ca # [6138202.749708] ca nginx-pre-start[292]: nginx: configuration file /nix/store/kq5c5qz20zx5wm8355dw6aszncxf3i56-nginx.conf test is successful
container-test-run-certificates> ca # [6138202.753111] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> ca # [6138202.753407] ca systemd[1]: Reached target Multi-User System.
container-test-run-certificates> ca # [6138202.754165] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> server # [6138202.774645] server nginx-pre-start[267]: nginx: the configuration file /nix/store/zafvf844xnw673m936smapl0gwz94csl-nginx.conf syntax is ok
container-test-run-certificates> server # [6138202.775118] server nginx-pre-start[267]: nginx: configuration file /nix/store/zafvf844xnw673m936smapl0gwz94csl-nginx.conf test is successful
container-test-run-certificates> server # [6138202.777887] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [6138202.778122] server systemd[1]: Reached target Multi-User System.
container-test-run-certificates> server # [6138202.778746] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> server # [6138203.267025] server acme-order-renew-test.foo-start[270]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6138203.268721] server acme-order-renew-test.foo-start[270]: + set -euo pipefail
container-test-run-certificates> server # [6138203.268768] server acme-order-renew-test.foo-start[270]: + echo ad12aa6741ce4bd2c108
container-test-run-certificates> server # [6138203.268824] server acme-order-renew-test.foo-start[270]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> server # [6138203.269488] server acme-order-renew-test.foo-start[270]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run
container-test-run-certificates> server # [6138203.280348] server acme-order-renew-test.foo-start[281]: 2026/08/10 11:04:20 No key found for account none@none.tld. Generating a P256 key.
container-test-run-certificates> server # [6138203.280578] server acme-order-renew-test.foo-start[281]: 2026/08/10 11:04:20 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key
container-test-run-certificates> server # [6138203.295743] server acme-order-renew-test.foo-start[281]: 2026/08/10 11:04:20 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority
container-test-run-certificates> server # [6138203.295983] server acme-order-renew-test.foo-start[270]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.
container-test-run-certificates> server # [6138203.295983] server acme-order-renew-test.foo-start[270]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.
container-test-run-certificates> server # [6138203.295983] server acme-order-renew-test.foo-start[270]: + exit 10
container-test-run-certificates> server # [6138203.298187] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a
container-test-run-certificates> server # [6138203.298267] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'.
container-test-run-certificates> server # [6138203.298401] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> server # [6138203.298570] server systemd[1]: Startup finished in 5.794s.
container-test-run-certificates> ca # [6138203.278305] ca acme-order-renew-ca.foo-start[295]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6138203.281451] ca acme-order-renew-ca.foo-start[295]: + set -euo pipefail
container-test-run-certificates> ca # [6138203.281514] ca acme-order-renew-ca.foo-start[295]: + echo 88dc4fc401a6091a1bd9
container-test-run-certificates> ca # [6138203.281596] ca acme-order-renew-ca.foo-start[295]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> ca # [6138203.282287] ca acme-order-renew-ca.foo-start[295]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run
container-test-run-certificates> ca # [6138203.293233] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 No key found for account none@none.tld. Generating a P256 key.
container-test-run-certificates> ca # [6138203.293471] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key
container-test-run-certificates> ca # [6138203.307630] ca step-ca[204]: time="2026-08-10T11:04:20Z" level=info duration="97.393µs" duration-ns=97393 fields.time="2026-08-10T11:04:20Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=47ee2e64-b067-4603-af5d-0957399de70f response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138203.307977] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] acme: Registering account for none@none.tld
container-test-run-certificates> ca # [6138203.309239] ca step-ca[204]: time="2026-08-10T11:04:20Z" level=info duration=1.198908ms duration-ns=1198908 fields.time="2026-08-10T11:04:20Z" method=HEAD name=ca nonce=alA0SDZQN1BBUk1wSlNVSmo2eG0xMlJVVFA0SHRMc1Q path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=e982d0e6-f6e5-4e9b-a9f8-932882a0ddb1 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138203.310580] ca step-ca[204]: time="2026-08-10T11:04:20Z" level=info duration=1.019019ms duration-ns=1019019 fields.time="2026-08-10T11:04:20Z" method=POST name=ca nonce=YURVVE1BYkJXZjBYVHV3OThXRnpvMXpDbktMNDlnTE0 path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=55f17667-da56-496d-8af1-79b9936efe1e response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/Ixiv8dlFXJ5ZbWLUqlYXNu7XQQgNETJE/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138203.310778] ca acme-order-renew-ca.foo-start[307]: !!!! HEADS UP !!!!
container-test-run-certificates> ca # [6138203.310778] ca acme-order-renew-ca.foo-start[307]: Your account credentials have been saved in your
container-test-run-certificates> ca # [6138203.310778] ca acme-order-renew-ca.foo-start[307]: configuration directory at "accounts".
container-test-run-certificates> ca # [6138203.310778] ca acme-order-renew-ca.foo-start[307]: You should make a secure backup of this folder now. This
container-test-run-certificates> ca # [6138203.310778] ca acme-order-renew-ca.foo-start[307]: configuration directory will also contain private keys
container-test-run-certificates> ca # [6138203.310778] ca acme-order-renew-ca.foo-start[307]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> ca # [6138203.310778] ca acme-order-renew-ca.foo-start[307]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> ca # [6138203.310924] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate
container-test-run-certificates> ca # [6138203.312855] ca step-ca[204]: time="2026-08-10T11:04:20Z" level=info duration=1.716623ms duration-ns=1716623 fields.time="2026-08-10T11:04:20Z" method=POST name=ca nonce=RUNBdFltTm4yM0thWnBtUEpyMmZjckVJcnNEdWtUaEE path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=89294a8c-f6ab-48c4-a7b5-e167d09344d4 response="{\"id\":\"OzMU69d6ey7ZG43zuRJ2snZTheSTpfGA\",\"status\":\"pending\",\"expires\":\"2026-08-11T11:04:20Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-10T11:03:20Z\",\"notAfter\":\"2026-11-08T11:04:20Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/OzMU69d6ey7ZG43zuRJ2snZTheSTpfGA/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138203.370308] ca step-ca[204]: time="2026-08-10T11:04:20Z" level=info duration="858.928µs" duration-ns=858928 fields.time="2026-08-10T11:04:20Z" method=POST name=ca nonce=Rkg4WTEyYUdDYXRNNXpaaE9mZGV5WFRNVDI2UmlxRUU path=/acme/acme/authz/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=ab80bb91-1cf6-41f8-874d-d989f675ca4f response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"a9M4cLjf7FZ3xnvkbBdSIOzg2LmnfOVU\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve/ya5q2gerR0tocHUN3jgJvpY1Mbd0FVHG\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"a9M4cLjf7FZ3xnvkbBdSIOzg2LmnfOVU\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve/dw15B9Gj72cp2nthIstDwDk6gJ2C3MGA\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"a9M4cLjf7FZ3xnvkbBdSIOzg2LmnfOVU\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve/jcVJXxugwCQBCddWlJ0no1WBKZsPAFLS\"}],\"wildcard\":false,\"expires\":\"2026-08-11T11:04:20Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138203.370517] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve
container-test-run-certificates> ca # [6138203.370517] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01
container-test-run-certificates> ca # [6138203.370585] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] [ca.foo] acme: use http-01 solver
container-test-run-certificates> ca # [6138203.370585] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] [ca.foo] acme: Trying to solve HTTP-01
container-test-run-certificates> ca # [6138203.372506] ca step-ca[204]: time="2026-08-10T11:04:20Z" level=info duration=1.697607ms duration-ns=1697607 fields.time="2026-08-10T11:04:20Z" method=POST name=ca nonce=WWxTc3oyelZ4blZPb3ExeGtVMkl4SktwOGQ0aVNmUDM path=/acme/acme/challenge/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve/dw15B9Gj72cp2nthIstDwDk6gJ2C3MGA protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=2a8c207e-38b2-4381-a874-790a781d7558 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"a9M4cLjf7FZ3xnvkbBdSIOzg2LmnfOVU\",\"validated\":\"2026-08-10T11:04:20Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve/dw15B9Gj72cp2nthIstDwDk6gJ2C3MGA\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138203.372618] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] [ca.foo] The server validated our request
container-test-run-certificates> ca # [6138203.372653] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates
container-test-run-certificates> ca # [6138203.375324] ca step-ca[204]: time="2026-08-10T11:04:20Z" level=info duration=2.355656ms duration-ns=2355656 fields.time="2026-08-10T11:04:20Z" method=POST name=ca nonce=VFE2ZlU3TjVuUjczUFB5cFdTdjl4dDkzSjJpS21aT0I path=/acme/acme/order/OzMU69d6ey7ZG43zuRJ2snZTheSTpfGA/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c8639710-ccb3-4c29-acc4-547fb6077440 response="{\"id\":\"OzMU69d6ey7ZG43zuRJ2snZTheSTpfGA\",\"status\":\"valid\",\"expires\":\"2026-08-11T11:04:20Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-10T11:03:20Z\",\"notAfter\":\"2026-11-08T11:04:20Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/6QHEz8tgvUIIgKalINN8HjLPVwUtrpve\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/OzMU69d6ey7ZG43zuRJ2snZTheSTpfGA/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/3XCpuatMvj6PL19i1PKy00puaDIyJkE6\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138203.376099] ca step-ca[204]: time="2026-08-10T11:04:20Z" level=info certificate="MIIB1TCCAXqgAwIBAgIRAMVAHDPT5txM9ixRgSfjwXAwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODEwMTEwMzIwWhcNMjYxMTA4MTEwNDIwWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARv1B0iIMiC5U3Lz6/osFuk/UheGQfRtYIoh9B+LYnywUYG7cjjXFQpMHCPzeMY1tymo1qcUqLEDocYqKNGUG1To4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFOrnJnadJSqOseidmTD0I8Ux7ZVUMB8GA1UdIwQYMBaAFEkfj1wq4YRwlZfoqoT3wb+19QDMMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSQAwRgIhALWiGe5nVWPvDlnjvTYLrhXMrtX0qE7BcQR8LJBrbzA0AiEAkz8iHLftkrDt3lRcExY5sGsAaRiIFkINKGyoybI9EOM=" duration="508.037µs" duration-ns=508037 fields.time="2026-08-10T11:04:20Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=MDJ6Q2JuWnVVZWp1Nld1aDVyVDBGRXpGQjZtNWhaM1Q path=/acme/acme/certificate/3XCpuatMvj6PL19i1PKy00puaDIyJkE6 protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=85d22f1d-d79b-4ee5-8c56-0acb410399ec sans="map[dns:[ca.foo]]" serial=262190794182260276755661628216527012208 size=1344 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= valid-from="2026-08-10T11:03:20Z" valid-to="2026-11-08T11:04:20Z"
container-test-run-certificates> ca # [6138203.376189] ca acme-order-renew-ca.foo-start[307]: 2026/08/10 11:04:20 [INFO] [ca.foo] Server responded with a certificate.
container-test-run-certificates> ca # [6138203.378619] ca acme-order-renew-ca.foo-start[295]: + mv domainhash.txt certificates/
container-test-run-certificates> ca # [6138203.379754] ca acme-order-renew-ca.foo-start[295]: + touch out/acme-success
container-test-run-certificates> ca # [6138203.380582] ca acme-order-renew-ca.foo-start[295]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6138203.381145] ca acme-order-renew-ca.foo-start[295]: + touch out/renewed
container-test-run-certificates> ca # [6138203.382360] ca acme-order-renew-ca.foo-start[295]: + echo Installing new certificate
container-test-run-certificates> ca # [6138203.382360] ca acme-order-renew-ca.foo-start[295]: Installing new certificate
container-test-run-certificates> ca # [6138203.382360] ca acme-order-renew-ca.foo-start[295]: + cp -vp certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6138203.383304] ca acme-order-renew-ca.foo-start[327]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> ca # [6138203.383492] ca acme-order-renew-ca.foo-start[295]: + cp -vp certificates/ca.foo.key out/key.pem
container-test-run-certificates> ca # [6138203.384276] ca acme-order-renew-ca.foo-start[328]: 'certificates/ca.foo.key' -> 'out/key.pem'
container-test-run-certificates> ca # [6138203.384507] ca acme-order-renew-ca.foo-start[295]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem
container-test-run-certificates> ca # [6138203.385397] ca acme-order-renew-ca.foo-start[329]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> ca # [6138203.385538] ca acme-order-renew-ca.foo-start[295]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> ca # [6138203.386523] ca acme-order-renew-ca.foo-start[295]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [6138203.387465] ca acme-order-renew-ca.foo-start[295]: + for fixpath in out certificates
container-test-run-certificates> ca # [6138203.387465] ca acme-order-renew-ca.foo-start[295]: + '[' -d out ']'
container-test-run-certificates> ca # [6138203.387519] ca acme-order-renew-ca.foo-start[295]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6138203.388379] ca acme-order-renew-ca.foo-start[295]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6138203.390015] ca acme-order-renew-ca.foo-start[295]: + for fixpath in out certificates
container-test-run-certificates> ca # [6138203.390015] ca acme-order-renew-ca.foo-start[295]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6138203.390060] ca acme-order-renew-ca.foo-start[295]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [6138203.390973] ca acme-order-renew-ca.foo-start[295]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [6138203.392457] ca acme-order-renew-ca.foo-start[295]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [6138203.505218] ca systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> ca # [6138203.507402] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [6138203.507498] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> ca # [6138203.915489] ca nginx[345]: nginx: the configuration file /nix/store/kq5c5qz20zx5wm8355dw6aszncxf3i56-nginx.conf syntax is ok
container-test-run-certificates> ca # [6138203.915786] ca nginx[345]: nginx: configuration file /nix/store/kq5c5qz20zx5wm8355dw6aszncxf3i56-nginx.conf test is successful
container-test-run-certificates> ca # [6138204.327412] ca systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> ca # [6138204.327675] ca systemd[1]: Startup finished in 6.853s.
container-test-run-certificates> ca # [6138204.681204] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 5.17 seconds)
container-test-run-certificates> ca # [6138205.065987] ca acme-order-renew-ca.foo-start[360]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6138205.067951] ca acme-order-renew-ca.foo-start[360]: + set -euo pipefail
container-test-run-certificates> ca # [6138205.067990] ca acme-order-renew-ca.foo-start[360]: + echo 88dc4fc401a6091a1bd9
container-test-run-certificates> ca # [6138205.068130] ca acme-order-renew-ca.foo-start[360]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> ca # [6138205.068902] ca acme-order-renew-ca.foo-start[360]: + '[' -e certificates/ca.foo.key ']'
container-test-run-certificates> ca # [6138205.068957] ca acme-order-renew-ca.foo-start[360]: + '[' -e certificates/ca.foo.crt ']'
container-test-run-certificates> ca # [6138205.069186] ca acme-order-renew-ca.foo-start[368]: ++ find accounts -name none@none.tld.key
container-test-run-certificates> ca # [6138205.070571] ca acme-order-renew-ca.foo-start[360]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']'
container-test-run-certificates> ca # [6138205.070595] ca acme-order-renew-ca.foo-start[360]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic
container-test-run-certificates> ca # [6138205.095057] ca step-ca[204]: time="2026-08-10T11:04:22Z" level=info duration="40.366µs" duration-ns=40366 fields.time="2026-08-10T11:04:22Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=5b0474d2-3d33-4dd7-abd8-a375d17bfbf8 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138205.095301] ca acme-order-renew-ca.foo-start[369]: 2026/08/10 11:04:22 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint
container-test-run-certificates> ca # [6138205.095301] ca acme-order-renew-ca.foo-start[369]: 2026/08/10 11:04:22 [INFO] [ca.foo] The certificate expires at 2026-11-08T11:04:20Z, the renewal can be performed in 1439h59m37.539099987s: no renewal.
container-test-run-certificates> ca # [6138205.095482] ca acme-order-renew-ca.foo-start[360]: + mv domainhash.txt certificates/
container-test-run-certificates> ca # [6138205.096630] ca acme-order-renew-ca.foo-start[360]: + touch out/acme-success
container-test-run-certificates> ca # [6138205.097468] ca acme-order-renew-ca.foo-start[360]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6138205.098040] ca acme-order-renew-ca.foo-start[360]: + for fixpath in out certificates
container-test-run-certificates> ca # [6138205.098053] ca acme-order-renew-ca.foo-start[360]: + '[' -d out ']'
container-test-run-certificates> ca # [6138205.098053] ca acme-order-renew-ca.foo-start[360]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6138205.098832] ca acme-order-renew-ca.foo-start[360]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6138205.100181] ca acme-order-renew-ca.foo-start[360]: + for fixpath in out certificates
container-test-run-certificates> ca # [6138205.100194] ca acme-order-renew-ca.foo-start[360]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6138205.100194] ca acme-order-renew-ca.foo-start[360]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [6138205.100962] ca acme-order-renew-ca.foo-start[360]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [6138205.102127] ca acme-order-renew-ca.foo-start[360]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [6138205.208341] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [6138205.208466] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> server: must succeed: systemctl restart acme-test.foo.service
container-test-run-certificates> server # [6138208.217785] server systemd[1]: acme-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [6138208.217868] server systemd[1]: Stopped Ensure certificate for test.foo.
container-test-run-certificates> server # [6138208.218668] server systemd[1]: Stopping Ensure certificate for test.foo...
container-test-run-certificates> server # [6138208.219552] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.44 seconds)
container-test-run-certificates> client: waiting for success: curl -v https://test.foo
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [1009 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [112 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 10 11:04:19 2026 GMT
container-test-run-certificates> *   expire date: Sep  9 11:04:19 2028 GMT
container-test-run-certificates> *   issuer: CN=minica root ca 1646a3
container-test-run-certificates> *   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 13
container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html
container-test-run-certificates> 
container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not
container-test-run-certificates> establish a secure connection to it. To learn more about this situation and
container-test-run-certificates> how to fix it, please visit the webpage mentioned above.
container-test-run-certificates> server # [6138208.635688] server acme-test.foo-start[303]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6138208.637433] server acme-test.foo-start[303]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [6138208.637433] server acme-test.foo-start[303]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [6138208.643503] server acme-test.foo-start[313]: + cd test.foo
container-test-run-certificates> server # [6138208.643678] server acme-test.foo-start[313]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [6138208.644362] server acme-test.foo-start[314]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [6138208.644473] server acme-test.foo-start[313]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [6138208.645104] server acme-test.foo-start[313]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [6138208.645234] server acme-test.foo-start[303]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [6138208.646072] server acme-test.foo-start[303]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [6138208.646836] server acme-test.foo-start[303]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6138208.647605] server acme-test.foo-start[303]: + for fixpath in out certificates
container-test-run-certificates> server # [6138208.647616] server acme-test.foo-start[303]: + '[' -d out ']'
container-test-run-certificates> server # [6138208.647616] server acme-test.foo-start[303]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6138208.648420] server acme-test.foo-start[303]: + chown -R acme:nginx out
container-test-run-certificates> server # [6138208.649649] server acme-test.foo-start[303]: + for fixpath in out certificates
container-test-run-certificates> server # [6138208.649649] server acme-test.foo-start[303]: + '[' -d certificates ']'
container-test-run-certificates> server # [6138208.651360] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [6138208.653147] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> server # [6138209.049775] server acme-order-renew-test.foo-start[321]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6138209.051543] server acme-order-renew-test.foo-start[321]: + set -euo pipefail
container-test-run-certificates> server # [6138209.051581] server acme-order-renew-test.foo-start[321]: + echo ad12aa6741ce4bd2c108
container-test-run-certificates> server # [6138209.051636] server acme-order-renew-test.foo-start[321]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> server # [6138209.052223] server acme-order-renew-test.foo-start[321]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run
container-test-run-certificates> server # [6138209.074368] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] acme: Registering account for none@none.tld
container-test-run-certificates> server # [6138209.099794] server acme-order-renew-test.foo-start[329]: !!!! HEADS UP !!!!
container-test-run-certificates> server # [6138209.099794] server acme-order-renew-test.foo-start[329]: Your account credentials have been saved in your
container-test-run-certificates> server # [6138209.099794] server acme-order-renew-test.foo-start[329]: configuration directory at "accounts".
container-test-run-certificates> server # [6138209.099794] server acme-order-renew-test.foo-start[329]: You should make a secure backup of this folder now. This
container-test-run-certificates> server # [6138209.099794] server acme-order-renew-test.foo-start[329]: configuration directory will also contain private keys
container-test-run-certificates> server # [6138209.099794] server acme-order-renew-test.foo-start[329]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> server # [6138209.099794] server acme-order-renew-test.foo-start[329]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> server # [6138209.099952] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] [test.foo] acme: Obtaining bundled SAN certificate
container-test-run-certificates> server # [6138209.161109] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB
container-test-run-certificates> server # [6138209.161109] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01
container-test-run-certificates> server # [6138209.161109] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] [test.foo] acme: use http-01 solver
container-test-run-certificates> server # [6138209.161109] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] [test.foo] acme: Trying to solve HTTP-01
container-test-run-certificates> server # [6138209.163539] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] [test.foo] The server validated our request
container-test-run-certificates> server # [6138209.163579] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] [test.foo] acme: Validations succeeded; requesting certificates
container-test-run-certificates> server # [6138209.167939] server acme-order-renew-test.foo-start[329]: 2026/08/10 11:04:26 [INFO] [test.foo] Server responded with a certificate.
container-test-run-certificates> server # [6138209.169914] server acme-order-renew-test.foo-start[321]: + mv domainhash.txt certificates/
container-test-run-certificates> server # [6138209.171100] server acme-order-renew-test.foo-start[321]: + touch out/acme-success
container-test-run-certificates> server # [6138209.171910] server acme-order-renew-test.foo-start[321]: + cmp -s certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [6138209.172472] server acme-order-renew-test.foo-start[321]: + touch out/renewed
container-test-run-certificates> server # [6138209.173154] server acme-order-renew-test.foo-start[321]: + echo Installing new certificate
container-test-run-certificates> server # [6138209.173154] server acme-order-renew-test.foo-start[321]: Installing new certificate
container-test-run-certificates> server # [6138209.173191] server acme-order-renew-test.foo-start[321]: + cp -vp certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [6138209.173883] server acme-order-renew-test.foo-start[349]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> server # [6138209.174023] server acme-order-renew-test.foo-start[321]: + cp -vp certificates/test.foo.key out/key.pem
container-test-run-certificates> server # [6138209.174636] server acme-order-renew-test.foo-start[350]: 'certificates/test.foo.key' -> 'out/key.pem'
container-test-run-certificates> server # [6138209.174745] server acme-order-renew-test.foo-start[321]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem
container-test-run-certificates> server # [6138209.175420] server acme-order-renew-test.foo-start[351]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> server # [6138209.175528] server acme-order-renew-test.foo-start[321]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> server # [6138209.176334] server acme-order-renew-test.foo-start[321]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6138209.177146] server acme-order-renew-test.foo-start[321]: + for fixpath in out certificates
container-test-run-certificates> server # [6138209.177157] server acme-order-renew-test.foo-start[321]: + '[' -d out ']'
container-test-run-certificates> server # [6138209.177157] server acme-order-renew-test.foo-start[321]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6138209.177884] server acme-order-renew-test.foo-start[321]: + chown -R acme:nginx out
container-test-run-certificates> server # [6138209.179129] server acme-order-renew-test.foo-start[321]: + for fixpath in out certificates
container-test-run-certificates> server # [6138209.179155] server acme-order-renew-test.foo-start[321]: + '[' -d certificates ']'
container-test-run-certificates> server # [6138209.179155] server acme-order-renew-test.foo-start[321]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> server # [6138209.179849] server acme-order-renew-test.foo-start[321]: + chown -R acme:nginx certificates
container-test-run-certificates> server # [6138209.181017] server acme-order-renew-test.foo-start[321]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> server # [6138209.259003] server systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> server # [6138209.261032] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [6138209.261143] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> ca # [6138209.074145] ca step-ca[204]: time="2026-08-10T11:04:26Z" level=info duration="34.635µs" duration-ns=34635 fields.time="2026-08-10T11:04:26Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=9768ed0a-4d9d-4e6d-adb9-0c5915a7c273 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138209.096860] ca step-ca[204]: time="2026-08-10T11:04:26Z" level=info duration=21.670464ms duration-ns=21670464 fields.time="2026-08-10T11:04:26Z" method=HEAD name=ca nonce=RlVHYktER1M3RnpRY0NDMHlwb2NJMDlRUHJheVEyQVQ path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=3b620152-32f1-4e29-ae7d-19e8d3102c58 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138209.099578] ca step-ca[204]: time="2026-08-10T11:04:26Z" level=info duration=1.543037ms duration-ns=1543037 fields.time="2026-08-10T11:04:26Z" method=POST name=ca nonce=aGNzTUVaM3VQWWNSZ09jNnpqQ0k5akxBbW5Eak5JMVo path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=396148fe-dd46-4560-adea-d020af5919ec response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/u1YiH2UUOffDwN11vdFDVmEg8d2bZwRP/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138209.101726] ca step-ca[204]: time="2026-08-10T11:04:26Z" level=info duration=1.239104ms duration-ns=1239104 fields.time="2026-08-10T11:04:26Z" method=POST name=ca nonce=bGJZek9GOWhMRG4xUllvZEpScm45U2xiWk00R0V6M0Q path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=179f6735-5698-4754-a7fd-eef9f588597a response="{\"id\":\"ZcDB13dtskpkj8oxR0XLm8qZTcAaUSik\",\"status\":\"pending\",\"expires\":\"2026-08-11T11:04:26Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-10T11:03:26Z\",\"notAfter\":\"2026-11-08T11:04:26Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB\"],\"finalize\":\"https://ca.foo/acme/acme/order/ZcDB13dtskpkj8oxR0XLm8qZTcAaUSik/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138209.160919] ca step-ca[204]: time="2026-08-10T11:04:26Z" level=info duration=1.91655ms duration-ns=1916550 fields.time="2026-08-10T11:04:26Z" method=POST name=ca nonce=OWZEUmZ3S3FxTmZMOHhuV05tUGxCakZUNDdSdWp3ZHE path=/acme/acme/authz/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB protocol=HTTP/1.1 referer= remote-address="::1" request-id=f5d7eaea-7793-41e1-bd76-1b2ae91f9e50 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"2BwQJYKz1WSynmgf8EE0XkA8of28X3iB\",\"url\":\"https://ca.foo/acme/acme/challenge/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB/zd0jN0j9GNpA7lV6z4lpOxiJdFGs6NZ2\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"2BwQJYKz1WSynmgf8EE0XkA8of28X3iB\",\"url\":\"https://ca.foo/acme/acme/challenge/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB/n7WeP83uOGD74QuNFUxljHo2l0yWmoRN\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"2BwQJYKz1WSynmgf8EE0XkA8of28X3iB\",\"url\":\"https://ca.foo/acme/acme/challenge/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB/D9DeORpgWUEI29hQhb2d9JwUJYoMBnjY\"}],\"wildcard\":false,\"expires\":\"2026-08-11T11:04:26Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138209.163380] ca step-ca[204]: time="2026-08-10T11:04:26Z" level=info duration=1.599422ms duration-ns=1599422 fields.time="2026-08-10T11:04:26Z" method=POST name=ca nonce=RWhIUGRDOHFhZU56WGVCZmwyQUhDTWppdWszQk9yTWo path=/acme/acme/challenge/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB/n7WeP83uOGD74QuNFUxljHo2l0yWmoRN protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=e8ff5363-5382-43ae-890b-9108abd7eb17 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"2BwQJYKz1WSynmgf8EE0XkA8of28X3iB\",\"validated\":\"2026-08-10T11:04:26Z\",\"url\":\"https://ca.foo/acme/acme/challenge/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB/n7WeP83uOGD74QuNFUxljHo2l0yWmoRN\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138209.166487] ca step-ca[204]: time="2026-08-10T11:04:26Z" level=info duration=2.093754ms duration-ns=2093754 fields.time="2026-08-10T11:04:26Z" method=POST name=ca nonce=T255VFh3WnZsSlNUaThldVZCUnQyd09yVGpTdEdXM3E path=/acme/acme/order/ZcDB13dtskpkj8oxR0XLm8qZTcAaUSik/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=9080268d-224b-4a5a-a211-4d4ed4c15de4 response="{\"id\":\"ZcDB13dtskpkj8oxR0XLm8qZTcAaUSik\",\"status\":\"valid\",\"expires\":\"2026-08-11T11:04:26Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-10T11:03:26Z\",\"notAfter\":\"2026-11-08T11:04:26Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/NLrgFg67x2kXcSyuGODSuMotSGuOfRmB\"],\"finalize\":\"https://ca.foo/acme/acme/order/ZcDB13dtskpkj8oxR0XLm8qZTcAaUSik/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/MGlZSnOFhycvrpBFdM9dV4tAH1hDzoN2\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6138209.167813] ca step-ca[204]: time="2026-08-10T11:04:26Z" level=info certificate=MIIB1jCCAX2gAwIBAgIQWeB4ULueBAf/uC6GT48wDTAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA4MTAxMTAzMjZaFw0yNjExMDgxMTA0MjZaMBMxETAPBgNVBAMTCHRlc3QuZm9vMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOqiBcaERpVZbB2PoxBD7OCxU/jbb2OQBRL67ELD1umvvVmds/+zEZyMu+u8Az2gAzxNJKpUiNbOg6ddEH2VgrqOBpjCBozAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQQqZEW1P5sui9urCdndpWTtmEaGTAfBgNVHSMEGDAWgBRJH49cKuGEcJWX6KqE98G/tfUAzDATBgNVHREEDDAKggh0ZXN0LmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDRwAwRAIgaVX0DrjvfKghwdBGyXJ0QSCXDi0JutBOFOrltyR6hu8CIBnUEjvzCmmgGfov8tGNGNJloHiqsTKcSUjfYV7KSdv2 duration="536.33µs" duration-ns=536330 fields.time="2026-08-10T11:04:26Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=a05XY2E1SHlkd3MzbXNOb1NOY1VXYWVsaTVsYUx4dTQ path=/acme/acme/certificate/MGlZSnOFhycvrpBFdM9dV4tAH1hDzoN2 protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=213ee3df-71e5-4e98-8f66-a6caca3941b9 sans="map[dns:[test.foo]]" serial=119466806406639479571937848981833330701 size=1344 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= valid-from="2026-08-10T11:03:26Z" valid-to="2026-11-08T11:04:26Z"
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [1009 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [111 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 10 11:04:19 2026 GMT
container-test-run-certificates> *   expire date: Sep  9 11:04:19 2028 GMT
container-test-run-certificates> *   issuer: CN=minica root ca 1646a3
container-test-run-certificates> *   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 13
container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html
container-test-run-certificates> 
container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not
container-test-run-certificates> establish a secure connection to it. To learn more about this situation and
container-test-run-certificates> how to fix it, please visit the webpage mentioned above.
container-test-run-certificates> server # [6138209.604869] server nginx[367]: nginx: the configuration file /nix/store/zafvf844xnw673m936smapl0gwz94csl-nginx.conf syntax is ok
container-test-run-certificates> server # [6138209.605179] server nginx[367]: nginx: configuration file /nix/store/zafvf844xnw673m936smapl0gwz94csl-nginx.conf test is successful
container-test-run-certificates> server # [6138209.950311] server systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [929 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [79 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 10 11:03:26 2026 GMT
container-test-run-certificates> *   expire date: Nov  8 11:04:26 2026 GMT
container-test-run-certificates> *   issuer: CN=Clan Intermediate CA
container-test-run-certificates> *   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 0
container-test-run-certificates> * SSL certificate verified via OpenSSL.
container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 44312 
container-test-run-certificates>   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
container-test-run-certificates>                                  Dload  Upload  Total   Spent   Left   Speed
container-test-run-certificates>   0      0   0      0   0      0      0      0                              0* using HTTP/2
container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/
container-test-run-certificates> * [HTTP/2] [1] [:method: GET]
container-test-run-certificates> * [HTTP/2] [1] [:scheme: https]
container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo]
container-test-run-certificates> * [HTTP/2] [1] [:path: /]
container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.21.0]
container-test-run-certificates> * [HTTP/2] [1] [accept: */*]
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> * Request completely sent off
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> 100     20 100     20   0      0   1616      0                              0
container-test-run-certificates> * Connection #0 to host test.foo:443 left intact
container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 2.06 seconds)
container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2
container-test-run-certificates> Certificate:
container-test-run-certificates>     Data:
container-test-run-certificates>         Version: 3 (0x2)
container-test-run-certificates>         Serial Number:
container-test-run-certificates>             59:e0:78:50:bb:9e:04:07:ff:b8:2e:86:4f:8f:30:0d
container-test-run-certificates>         Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>         Issuer: CN=Clan Intermediate CA
container-test-run-certificates>         Validity
container-test-run-certificates>             Not Before: Aug 10 11:03:26 2026 GMT
container-test-run-certificates>             Not After : Nov  8 11:04:26 2026 GMT
container-test-run-certificates>         Subject: CN=test.foo
container-test-run-certificates>         Subject Public Key Info:
container-test-run-certificates>             Public Key Algorithm: id-ecPublicKey
container-test-run-certificates>                 Public-Key: (256 bit)
container-test-run-certificates>                 pub:
container-test-run-certificates>                     04:3a:a8:81:71:a1:11:a5:56:5b:07:63:e8:c4:10:
container-test-run-certificates>                     fb:38:2c:54:fe:36:db:d8:e4:01:44:be:bb:10:b0:
container-test-run-certificates>                     f5:ba:6b:ef:56:67:6c:ff:ec:c4:67:23:2e:fa:ef:
container-test-run-certificates>                     00:cf:68:00:cf:13:49:2a:95:22:35:b3:a0:e9:d7:
container-test-run-certificates>                     44:1f:65:60:ae
container-test-run-certificates>                 ASN1 OID: prime256v1
container-test-run-certificates>                 NIST CURVE: P-256
container-test-run-certificates>         X509v3 extensions:
container-test-run-certificates>             X509v3 Key Usage: critical
container-test-run-certificates>                 Digital Signature
container-test-run-certificates>             X509v3 Extended Key Usage: 
container-test-run-certificates>                 TLS Web Server Authentication, TLS Web Client Authentication
container-test-run-certificates>             X509v3 Subject Key Identifier: 
container-test-run-certificates>                 10:A9:91:16:D4:FE:6C:BA:2F:6E:AC:27:67:76:95:93:B6:61:1A:19
container-test-run-certificates>             X509v3 Authority Key Identifier: 
container-test-run-certificates>                 49:1F:8F:5C:2A:E1:84:70:95:97:E8:AA:84:F7:C1:BF:B5:F5:00:CC
container-test-run-certificates>             X509v3 Subject Alternative Name: 
container-test-run-certificates>                 DNS:test.foo
container-test-run-certificates>             1.3.6.1.4.1.37476.9000.64.1: 
container-test-run-certificates>                 0......acme..
container-test-run-certificates>     Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>     Signature Value:
container-test-run-certificates>         30:44:02:20:69:55:f4:0e:b8:ef:7c:a8:21:c1:d0:46:c9:72:
container-test-run-certificates>         74:41:20:97:0e:2d:09:ba:d0:4e:14:ea:e5:b7:24:7a:86:ef:
container-test-run-certificates>         02:20:19:d4:12:3b:f3:0a:69:a0:19:fa:2f:f2:d1:8d:18:d2:
container-test-run-certificates>         65:a0:78:aa:b1:32:9c:49:48:df:61:5e:ca:49:db:f6
container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds)
container-test-run-certificates> (finished: run the VM test script, in 13.69 seconds)
container-test-run-certificates> test script finished in 13.99s
container-test-run-certificates> cleanup
container-test-run-certificates> kill NspawnMachine (pid 53)
container-test-run-certificates> kill NspawnMachine (pid 54)
container-test-run-certificates> Container ca terminated by signal KILL.
container-test-run-certificates> kill NspawnMachine (pid 55)
container-test-run-certificates> Container client terminated by signal KILL.
container-test-run-certificates> Container server terminated by signal KILL.
container-test-run-certificates> (finished: cleanup, in 0.29 seconds)

post-build step Upload to niks3: ok
time=2026-08-10T11:04:29.183Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)"
time=2026-08-10T11:04:29.402Z level=INFO msg="Uploading 1 narinfos"
time=2026-08-10T11:04:29.664Z level=INFO msg="Upload complete. (578ms)"