these 44 derivations will be built:
  /nix/store/002fkkc4qws591jghypmy48812j723yl-decrypt-age-secrets.drv
  /nix/store/sidw340179706sq5nn0vcgbiy6fiysdf-system-path.drv
  /nix/store/hkgi3qjkvz2480izgs9lr8ai8h0fvv9m-dbus-1.drv
  /nix/store/z96h6f3sw18q4p4p460y1478c2ix57i2-X-Restart-Triggers-dbus-broker.drv
  /nix/store/xxz15skk85mw7x9r5708zaxld7barxbr-unit-dbus-broker.service.drv
  /nix/store/63cmqd8g5f5wixabwv8v3c0a7pc09pra-user-units.drv
  /nix/store/gcn9b4wn0x93myydhyww8gai01bi0qx5-unit-dbus-broker.service.drv
  /nix/store/jn1z6h07s1dk24qx26kps0dg19fkmkms-unit-nix-daemon.service.drv
  /nix/store/f8wf2mzk7qqhk8p9wffyf5p34w0is934-system-units.drv
  /nix/store/zgn8l3zykpfi77634937kwqpd6ajsh3z-vars-check-certificates.drv
  /nix/store/0q6cb7lqys60wp4chs6bvn0gg93r349q-etc.drv
  /nix/store/4gnby7kc3zr53xa6ckr4vwcxj7pmszi0-activate.drv
  /nix/store/ib0xy0wlyldh3y96pcff4vsrj73my5h5-nixos-system-client-test.drv
  /nix/store/1xvxh95axgypjmrsrnigi6p0g5fl608y-run-client-nspawn.drv
  /nix/store/9s6z42mqv300c0zqsy258gi9lpdmq6my-users-groups.json.drv
  /nix/store/y37smfm18fsf3y82w5ws00qa8cfib0gn-system-path.drv
  /nix/store/cz710laxjins4p2h5f454xlvyhxd2pnr-dbus-1.drv
  /nix/store/36rdi59h65dzw37b9nwsd3h22xgvk9pf-X-Restart-Triggers-dbus-broker.drv
  /nix/store/d5wav7y990vifvf36rawbk84glbk8z3r-unit-dbus-broker.service.drv
  /nix/store/7zhvr35hdhl24hrykqsgqbkvxjngn08a-system-units.drv
  /nix/store/m2k8zda8pv8xc5hh7wpcp8mzshlgmkcn-unit-dbus-broker.service.drv
  /nix/store/hlvl5mjwv0r4nsf5ny9rw06vqyln9i1y-user-units.drv
  /nix/store/dn31jjamigx9h07bplqz12wsx56r49l1-etc.drv
  /nix/store/80fjpwmfd6yw539sm6fhq04hjyqicyxb-activate.drv
  /nix/store/varyvj2bd1w0xikmym53l2lbay5pcz6z-dry-activate.drv
  /nix/store/r65aqv4ayfzhw1q7sbvij76yq03vaavs-nixos-system-ca-test.drv
  /nix/store/fgix49y7nb2cxrfg4p43yq4y25hhl0xz-run-ca-nspawn.drv
  /nix/store/qq6ms440xlly2q027kys1f9j2bh6yy0i-test-script.drv
  /nix/store/0dazh70qwhpgsvnf5ws7zfdbrmzlhg6l-users-groups.json.drv
  /nix/store/rdnrxv2a04ws792wyvvrg6xwwwcpv1mk-system-path.drv
  /nix/store/xjhb50h3nrcg7dv6cgzg3g6vdfdwa52r-dbus-1.drv
  /nix/store/kwxpg8872m49xkp7s3gzp44z607q5apc-X-Restart-Triggers-dbus-broker.drv
  /nix/store/pn055kafbhbkc2i317fklfa77hwhb78q-unit-dbus-broker.service.drv
  /nix/store/3921dn8735naqax6b1r137mkmh77g2z9-user-units.drv
  /nix/store/p38ds1kkxy936lj1phr4wjzjyirp4irk-unit-dbus-broker.service.drv
  /nix/store/f9pil85iw8ci3cp3hs2vgsvnn11nc5zs-system-units.drv
  /nix/store/qwkjz6qcpsrc19v5z99nskil0n2hd96k-etc.drv
  /nix/store/81kw1l94kaaipcsnygzcv1ndi58i7x4z-activate.drv
  /nix/store/p665x5g4cf75qyf0riiwhgjzp3qzi5c6-dry-activate.drv
  /nix/store/vvlxfkf00q0562jxx702yj0icc3f9jnc-nixos-system-server-test.drv
  /nix/store/xqzg6cdf51wb5wggqjyrasrw2735vmc9-run-server-nspawn.drv
  /nix/store/f9zk5wdg81022wriqcbhmf7l0fw15ckg-driverConfiguration.json.drv
  /nix/store/03dz46q39vh5baa0yrd75nswbhz5wcvg-nixos-test-driver-certificates.drv
  /nix/store/b30y39qir1mxz5kga954w5sdhi5p07ga-container-test-run-certificates.drv
building '/nix/store/qq6ms440xlly2q027kys1f9j2bh6yy0i-test-script.drv'
building '/nix/store/rdnrxv2a04ws792wyvvrg6xwwwcpv1mk-system-path.drv'
building '/nix/store/sidw340179706sq5nn0vcgbiy6fiysdf-system-path.drv'
building '/nix/store/y37smfm18fsf3y82w5ws00qa8cfib0gn-system-path.drv'
building '/nix/store/jn1z6h07s1dk24qx26kps0dg19fkmkms-unit-nix-daemon.service.drv'
system-path> structuredAttrs is enabled
system-path> created 1723 symlinks in user environment
system-path> structuredAttrs is enabled
system-path> created 1723 symlinks in user environment
system-path> structuredAttrs is enabled
system-path> created 1723 symlinks in user environment
unit-nix-daemon.service> structuredAttrs is enabled
building '/nix/store/zgn8l3zykpfi77634937kwqpd6ajsh3z-vars-check-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol'
building '/nix/store/0dazh70qwhpgsvnf5ws7zfdbrmzlhg6l-users-groups.json.drv'
building '/nix/store/9s6z42mqv300c0zqsy258gi9lpdmq6my-users-groups.json.drv'
building '/nix/store/cz710laxjins4p2h5f454xlvyhxd2pnr-dbus-1.drv'
building '/nix/store/hkgi3qjkvz2480izgs9lr8ai8h0fvv9m-dbus-1.drv'
building '/nix/store/xjhb50h3nrcg7dv6cgzg3g6vdfdwa52r-dbus-1.drv'
building '/nix/store/36rdi59h65dzw37b9nwsd3h22xgvk9pf-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/z96h6f3sw18q4p4p460y1478c2ix57i2-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/p665x5g4cf75qyf0riiwhgjzp3qzi5c6-dry-activate.drv'
building '/nix/store/kwxpg8872m49xkp7s3gzp44z607q5apc-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/d5wav7y990vifvf36rawbk84glbk8z3r-unit-dbus-broker.service.drv'
building '/nix/store/m2k8zda8pv8xc5hh7wpcp8mzshlgmkcn-unit-dbus-broker.service.drv'
building '/nix/store/002fkkc4qws591jghypmy48812j723yl-decrypt-age-secrets.drv' on 'ssh-ng://builder@build-x86-01.clan.lol'
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/gcn9b4wn0x93myydhyww8gai01bi0qx5-unit-dbus-broker.service.drv'
building '/nix/store/p38ds1kkxy936lj1phr4wjzjyirp4irk-unit-dbus-broker.service.drv'
building '/nix/store/pn055kafbhbkc2i317fklfa77hwhb78q-unit-dbus-broker.service.drv'
building '/nix/store/xxz15skk85mw7x9r5708zaxld7barxbr-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/7zhvr35hdhl24hrykqsgqbkvxjngn08a-system-units.drv'
building '/nix/store/hlvl5mjwv0r4nsf5ny9rw06vqyln9i1y-user-units.drv'
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/f8wf2mzk7qqhk8p9wffyf5p34w0is934-system-units.drv'
building '/nix/store/f9pil85iw8ci3cp3hs2vgsvnn11nc5zs-system-units.drv'
building '/nix/store/3921dn8735naqax6b1r137mkmh77g2z9-user-units.drv'
building '/nix/store/63cmqd8g5f5wixabwv8v3c0a7pc09pra-user-units.drv'
building '/nix/store/zgn8l3zykpfi77634937kwqpd6ajsh3z-vars-check-certificates.drv'
vars-check-certificates> Running vars check using Nix-based executor...
vars-check-certificates> ✓ All vars checks completed successfully
building '/nix/store/0q6cb7lqys60wp4chs6bvn0gg93r349q-etc.drv'
building '/nix/store/dn31jjamigx9h07bplqz12wsx56r49l1-etc.drv'
building '/nix/store/qwkjz6qcpsrc19v5z99nskil0n2hd96k-etc.drv'
building '/nix/store/4gnby7kc3zr53xa6ckr4vwcxj7pmszi0-activate.drv'
building '/nix/store/81kw1l94kaaipcsnygzcv1ndi58i7x4z-activate.drv'
building '/nix/store/ib0xy0wlyldh3y96pcff4vsrj73my5h5-nixos-system-client-test.drv'
building '/nix/store/vvlxfkf00q0562jxx702yj0icc3f9jnc-nixos-system-server-test.drv'
nixos-system-client-test> structuredAttrs is enabled
building '/nix/store/1xvxh95axgypjmrsrnigi6p0g5fl608y-run-client-nspawn.drv'
nixos-system-server-test> structuredAttrs is enabled
building '/nix/store/xqzg6cdf51wb5wggqjyrasrw2735vmc9-run-server-nspawn.drv'
building '/nix/store/002fkkc4qws591jghypmy48812j723yl-decrypt-age-secrets.drv'
building '/nix/store/80fjpwmfd6yw539sm6fhq04hjyqicyxb-activate.drv'
building '/nix/store/varyvj2bd1w0xikmym53l2lbay5pcz6z-dry-activate.drv'
building '/nix/store/r65aqv4ayfzhw1q7sbvij76yq03vaavs-nixos-system-ca-test.drv'
nixos-system-ca-test> structuredAttrs is enabled
building '/nix/store/fgix49y7nb2cxrfg4p43yq4y25hhl0xz-run-ca-nspawn.drv'
building '/nix/store/f9zk5wdg81022wriqcbhmf7l0fw15ckg-driverConfiguration.json.drv'
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/03dz46q39vh5baa0yrd75nswbhz5wcvg-nixos-test-driver-certificates.drv'
nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-certificates> All checks passed!
nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-certificates> All checks passed!
building '/nix/store/b30y39qir1mxz5kga954w5sdhi5p07ga-container-test-run-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol'
building '/nix/store/b30y39qir1mxz5kga954w5sdhi5p07ga-container-test-run-certificates.drv'
container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-certificates> start all VLans
container-test-run-certificates> (finished: start all VLans, in 0.00 seconds)
container-test-run-certificates> 
container-test-run-certificates> Test will time out and terminate in 3600.0 seconds
container-test-run-certificates> run the VM test script
container-test-run-certificates> additionally exposed symbols:
container-test-run-certificates>     ca, client, server,
container-test-run-certificates>     vlan1,
container-test-run-certificates>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-certificates> start all VMs
container-test-run-certificates> ca: systemd-nspawn running (pid 53)
container-test-run-certificates> client: systemd-nspawn running (pid 54)
container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal...
container-test-run-certificates> server: systemd-nspawn running (pid 56)
container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal...
container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal...
container-test-run-certificates> (finished: start all VMs, in 0.00 seconds)
container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container client on /build/vm-state-client.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container server on /build/vm-state-server.
container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca.
container-test-run-certificates> client # [6400284.788617] client systemd-journald[69]: Journal started
container-test-run-certificates> client # [6400284.788651] client systemd-journald[69]: Runtime Journal (/run/log/journal/d3d79485a6a04e478f85f02a19c325e5) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> server # [6400284.786791] server systemd-journald[69]: Journal started
container-test-run-certificates> client # [6400284.792884] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [6400284.786826] server systemd-journald[69]: Runtime Journal (/run/log/journal/6e6e1ee40b5a44a2b5251f42e54f5a0e) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> client # [6400284.799755] client systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> server # [6400284.790663] server systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> client # [6400284.800141] client systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> server # [6400284.797916] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> ca # [6400284.798966] ca systemd-journald[78]: Journal started
container-test-run-certificates> server # [6400284.807538] server systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> ca # [6400284.799007] ca systemd-journald[78]: Runtime Journal (/run/log/journal/91f8b02754954cd3923cac48eea45e9b) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> server # [6400284.808164] server systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [6400284.800553] client systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> server # [6400284.808620] server systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> client # [6400284.805709] client systemd-journald[69]: Time spent on flushing to /var/log/journal/d3d79485a6a04e478f85f02a19c325e5 is 1.442ms for 6 entries.
container-test-run-certificates> server # [6400284.815899] server systemd-journald[69]: Time spent on flushing to /var/log/journal/6e6e1ee40b5a44a2b5251f42e54f5a0e is 1.633ms for 7 entries.
container-test-run-certificates> client # [6400284.805709] client systemd-journald[69]: System Journal (/var/log/journal/d3d79485a6a04e478f85f02a19c325e5) is 8M, max 4G, 3.9G free.
container-test-run-certificates> server # [6400284.815899] server systemd-journald[69]: System Journal (/var/log/journal/6e6e1ee40b5a44a2b5251f42e54f5a0e) is 8M, max 4G, 3.9G free.
container-test-run-certificates> client # [6400284.812466] client systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> ca # [6400284.804809] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> client # [6400284.812616] client systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> ca # [6400284.817025] ca systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> client # [6400284.812686] client systemd[1]: Reached target Local File Systems.
container-test-run-certificates> ca # [6400284.817875] ca systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [6400284.813173] client systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> server # [6400284.822462] server systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> client # [6400284.813202] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [6400284.823279] server systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> ca # [6400284.818519] ca systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> server # [6400284.823450] server systemd[1]: Reached target Local File Systems.
container-test-run-certificates> ca # [6400284.823179] ca systemd-journald[78]: Time spent on flushing to /var/log/journal/91f8b02754954cd3923cac48eea45e9b is 1.245ms for 6 entries.
container-test-run-certificates> client # [6400284.816125] client systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> ca # [6400284.823179] ca systemd-journald[78]: System Journal (/var/log/journal/91f8b02754954cd3923cac48eea45e9b) is 8M, max 4G, 3.9G free.
container-test-run-certificates> client # [6400284.816144] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> ca # [6400284.853143] ca systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> server # [6400284.824148] server systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> ca # [6400284.853497] ca systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> client # [6400284.855312] client systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> ca # [6400284.853566] ca systemd[1]: Reached target Local File Systems.
container-test-run-certificates> client # [6400284.855979] client systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> ca # [6400284.854264] ca systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> server # [6400284.824183] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [6400284.870807] client systemd-tmpfiles[130]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> server # [6400284.824948] server systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> client # [6400284.871003] client systemd-tmpfiles[130]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [6400284.854306] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [6400284.824971] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> ca # [6400284.855213] ca systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> server # [6400284.854678] server systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> ca # [6400284.855235] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> client # [6400284.871141] client systemd-tmpfiles[130]: fchmod() of /var/log/journal/d3d79485a6a04e478f85f02a19c325e5 failed: Operation not permitted
container-test-run-certificates> ca # [6400284.870900] ca systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> server # [6400284.856141] server systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> ca # [6400284.871643] ca systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> server # [6400284.870462] server systemd-tmpfiles[131]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> client # [6400284.871347] client systemd-tmpfiles[130]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6400284.872519] client systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> ca # [6400284.884054] ca systemd-tmpfiles[151]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> server # [6400284.870627] server systemd-tmpfiles[131]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6400284.873301] client systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [6400284.873829] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> server # [6400284.870731] server systemd-tmpfiles[131]: fchmod() of /var/log/journal/6e6e1ee40b5a44a2b5251f42e54f5a0e failed: Operation not permitted
container-test-run-certificates> ca # [6400284.884219] ca systemd-tmpfiles[151]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [6400284.884329] ca systemd-tmpfiles[151]: fchmod() of /var/log/journal/91f8b02754954cd3923cac48eea45e9b failed: Operation not permitted
container-test-run-certificates> server # [6400284.870883] server systemd-tmpfiles[131]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6400284.884134] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> client # [6400284.891966] client systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> client # [6400284.892782] client systemd[1]: Starting Update is Completed...
container-test-run-certificates> server # [6400284.871579] server systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> client # [6400284.903949] client systemd[1]: Finished Update is Completed.
container-test-run-certificates> server # [6400284.873269] server systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [6400284.912179] client systemd[1]: Finished Firewall.
container-test-run-certificates> ca # [6400284.884481] ca systemd-tmpfiles[151]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6400284.912339] client systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> server # [6400284.873824] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [6400284.885416] ca systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> client # [6400284.912584] client systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> ca # [6400284.886126] ca systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [6400284.914079] client systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [6400284.886581] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [6400284.893731] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> server # [6400284.883190] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> ca # [6400284.899841] ca systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> server # [6400284.894799] server systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> ca # [6400284.900415] ca systemd[1]: Starting Update is Completed...
container-test-run-certificates> server # [6400284.895730] server systemd[1]: Starting Update is Completed...
container-test-run-certificates> ca # [6400284.906304] ca systemd[1]: Finished Update is Completed.
container-test-run-certificates> server # [6400284.902458] server systemd[1]: Finished Update is Completed.
container-test-run-certificates> ca # [6400284.915606] ca systemd[1]: Finished Firewall.
container-test-run-certificates> server # [6400284.920745] server systemd[1]: Finished Firewall.
container-test-run-certificates> ca # [6400284.915716] ca systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> server # [6400284.920839] server systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> ca # [6400284.915896] ca systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> server # [6400284.921038] server systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> ca # [6400284.916562] ca systemd[1]: Starting Network Management...
container-test-run-certificates> server # [6400284.921932] server systemd[1]: Starting Network Management...
container-test-run-certificates> client # [6400285.250220] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [6400285.250335] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [6400285.258162] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [6400285.258355] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [6400285.258523] client systemd-networkd[182]: lo: Link UP
container-test-run-certificates> client # [6400285.258527] client systemd-networkd[182]: lo: Gained carrier
container-test-run-certificates> client # [6400285.258763] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> client # [6400285.259203] client systemd[1]: Started Network Management.
container-test-run-certificates> client # [6400285.259301] client systemd-networkd[182]: eth1: Link UP
container-test-run-certificates> client # [6400285.259497] client systemd-networkd[182]: eth1: Gained carrier
container-test-run-certificates> client # [6400285.260436] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> client # [6400285.286800] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> client # [6400285.497257] client systemd-resolved[96]: Positive Trust Anchors:
container-test-run-certificates> client # [6400285.497269] client systemd-resolved[96]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> client # [6400285.497274] client systemd-resolved[96]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> client # [6400285.497301] client systemd-resolved[96]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> client # [6400285.509465] client systemd-resolved[96]: Using system hostname 'client'.
container-test-run-certificates> ca # [6400285.298440] ca systemd-networkd[195]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [6400285.298553] ca systemd-networkd[195]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [6400285.306282] ca systemd-networkd[195]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [6400285.306486] ca systemd-networkd[195]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [6400285.306643] ca systemd-networkd[195]: lo: Link UP
container-test-run-certificates> ca # [6400285.306648] ca systemd-networkd[195]: lo: Gained carrier
container-test-run-certificates> ca # [6400285.306897] ca systemd-networkd[195]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> ca # [6400285.307320] ca systemd[1]: Started Network Management.
container-test-run-certificates> ca # [6400285.307392] ca systemd-networkd[195]: eth1: Link UP
container-test-run-certificates> ca # [6400285.307573] ca systemd-networkd[195]: eth1: Gained carrier
container-test-run-certificates> ca # [6400285.308308] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> ca # [6400285.340724] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [6400285.330150] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [6400285.330242] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [6400285.336253] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [6400285.336408] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [6400285.336816] server systemd-networkd[186]: lo: Link UP
container-test-run-certificates> server # [6400285.336820] server systemd-networkd[186]: lo: Gained carrier
container-test-run-certificates> server # [6400285.337063] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> server # [6400285.337421] server systemd[1]: Started Network Management.
container-test-run-certificates> server # [6400285.337487] server systemd-networkd[186]: eth1: Link UP
container-test-run-certificates> server # [6400285.337738] server systemd-networkd[186]: eth1: Gained carrier
container-test-run-certificates> server # [6400285.338351] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> server # [6400285.367386] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> client # [6400285.510641] client systemd[1]: Started Network Name Resolution.
container-test-run-certificates> client # [6400285.510727] client systemd[1]: Reached target Network.
container-test-run-certificates> client # [6400285.510776] client systemd[1]: Reached target System Initialization.
container-test-run-certificates> client # [6400285.510823] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [6400285.510847] client systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> client # [6400285.510860] client systemd[1]: Reached target Timer Units.
container-test-run-certificates> client # [6400285.510976] client systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> client # [6400285.511081] client systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> client # [6400285.511181] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> client # [6400285.511194] client systemd[1]: Reached target Socket Units.
container-test-run-certificates> client # [6400285.511222] client systemd[1]: Reached target Basic System.
container-test-run-certificates> client # [6400285.512369] client systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> client # [6400285.513209] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> client # [6400285.514190] client systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> client # [6400285.543692] client systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> client # [6400285.671512] client nsncd[188]: Aug 13 11:52:23.037 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> client # [6400285.671644] client systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> client # [6400285.671718] client systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> client # [6400285.671772] client systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> client # [6400285.672936] client systemd[1]: Starting User Login Management...
container-test-run-certificates> client # [6400285.673657] client systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> client # [6400285.691430] client systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> client # [6400285.692322] client systemd[1]: Started Console Getty.
container-test-run-certificates> client # [6400285.692346] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> client # [6400285.692358] client systemd[1]: Reached target Login Prompts.
container-test-run-certificates> ca # [6400285.562566] ca systemd-resolved[108]: Positive Trust Anchors:
container-test-run-certificates> ca # [6400285.562575] ca systemd-resolved[108]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> ca # [6400285.562578] ca systemd-resolved[108]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> ca # [6400285.562600] ca systemd-resolved[108]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> ca # [6400285.579140] ca systemd-resolved[108]: Using system hostname 'ca'.
container-test-run-certificates> ca # [6400285.580502] ca systemd[1]: Started Network Name Resolution.
container-test-run-certificates> ca # [6400285.580589] ca systemd[1]: Reached target Network.
container-test-run-certificates> ca # [6400285.580649] ca systemd[1]: Reached target Network is Online.
container-test-run-certificates> ca # [6400285.580698] ca systemd[1]: Reached target System Initialization.
container-test-run-certificates> ca # [6400285.580912] ca systemd[1]: Started Renew ACME Certificate for ca.foo.
container-test-run-certificates> ca # [6400285.580936] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [6400285.580958] ca systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> ca # [6400285.580973] ca systemd[1]: Reached target Timer Units.
container-test-run-certificates> ca # [6400285.581110] ca systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> ca # [6400285.581219] ca systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> ca # [6400285.581311] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> ca # [6400285.581325] ca systemd[1]: Reached target Socket Units.
container-test-run-certificates> ca # [6400285.581350] ca systemd[1]: Reached target Basic System.
container-test-run-certificates> ca # [6400285.582452] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> ca # [6400285.582887] ca systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> ca # [6400285.582909] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem
container-test-run-certificates> ca # [6400285.583376] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> ca # [6400285.584004] ca systemd[1]: Starting step-ca service...
container-test-run-certificates> ca # [6400285.585007] ca systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> ca # [6400285.609638] ca systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> ca # [6400285.722501] ca acme-setup-privileged[200]: + set -euo pipefail
container-test-run-certificates> ca # [6400285.722501] ca acme-setup-privileged[200]: + cd /var/lib/acme
container-test-run-certificates> ca # [6400285.722501] ca acme-setup-privileged[200]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> ca # [6400285.723786] ca acme-setup-privileged[200]: + chown -R acme .lego/accounts
container-test-run-certificates> ca # [6400285.724842] ca acme-setup-privileged[200]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [6400285.724883] ca acme-setup-privileged[200]: + '[' -d ca.foo ']'
container-test-run-certificates> ca # [6400285.724883] ca acme-setup-privileged[200]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [6400285.724883] ca acme-setup-privileged[200]: + '[' -d .lego/ca.foo ']'
container-test-run-certificates> ca # [6400285.761650] ca nsncd[202]: Aug 13 11:52:23.127 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> ca # [6400285.761623] ca systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> ca # [6400285.761698] ca systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> ca # [6400285.761747] ca systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> ca # [6400285.762685] ca systemd[1]: Starting User Login Management...
container-test-run-certificates> ca # [6400285.763315] ca systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> ca # [6400285.797065] ca systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> ca # [6400285.798076] ca systemd[1]: Started Console Getty.
container-test-run-certificates> ca # [6400285.798097] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> ca # [6400285.798105] ca systemd[1]: Reached target Login Prompts.
container-test-run-certificates> client # [6400285.817569] client dbus-broker-launch[189]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> client # [6400285.818339] client dbus-broker-launch[189]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> client # [6400285.818339] client dbus-broker-launch[189]: Invalid user-name in /nix/store/g0ax0f4rmfxkcx9lnwf8gpdq0a1by0nn-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> client # [6400285.818610] client systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> client # [6400285.823123] client dbus-broker-launch[189]: Ready
container-test-run-certificates> server # [6400285.821110] server systemd-resolved[98]: Positive Trust Anchors:
container-test-run-certificates> server # [6400285.821120] server systemd-resolved[98]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> server # [6400285.821123] server systemd-resolved[98]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> server # [6400285.821145] server systemd-resolved[98]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> server # [6400285.834147] server systemd-resolved[98]: Using system hostname 'server'.
container-test-run-certificates> server # [6400285.835234] server systemd[1]: Started Network Name Resolution.
container-test-run-certificates> server # [6400285.835291] server systemd[1]: Reached target Network.
container-test-run-certificates> server # [6400285.835321] server systemd[1]: Reached target Network is Online.
container-test-run-certificates> server # [6400285.835354] server systemd[1]: Reached target System Initialization.
container-test-run-certificates> server # [6400285.835523] server systemd[1]: Started Renew ACME Certificate for test.foo.
container-test-run-certificates> server # [6400285.835542] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [6400285.835557] server systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> server # [6400285.835572] server systemd[1]: Reached target Timer Units.
container-test-run-certificates> server # [6400285.835671] server systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> server # [6400285.835751] server systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> server # [6400285.835834] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> server # [6400285.835846] server systemd[1]: Reached target Socket Units.
container-test-run-certificates> server # [6400285.835868] server systemd[1]: Reached target Basic System.
container-test-run-certificates> server # [6400285.837136] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> server # [6400285.837575] server systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> server # [6400285.837597] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem
container-test-run-certificates> server # [6400285.838081] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> server # [6400285.838843] server systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> server # [6400285.859199] server systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> server # [6400285.941019] server acme-setup-privileged[191]: + set -euo pipefail
container-test-run-certificates> server # [6400285.941532] server acme-setup-privileged[191]: + cd /var/lib/acme
container-test-run-certificates> server # [6400285.941532] server acme-setup-privileged[191]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> server # [6400285.942539] server acme-setup-privileged[191]: + chown -R acme .lego/accounts
container-test-run-certificates> server # [6400285.943783] server acme-setup-privileged[191]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [6400285.943850] server acme-setup-privileged[191]: + '[' -d test.foo ']'
container-test-run-certificates> server # [6400285.943850] server acme-setup-privileged[191]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [6400285.943850] server acme-setup-privileged[191]: + '[' -d .lego/test.foo ']'
container-test-run-certificates> server # [6400285.966040] server nsncd[193]: Aug 13 11:52:23.331 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> server # [6400285.966065] server systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> server # [6400285.966115] server systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> server # [6400285.966153] server systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> server # [6400285.966820] server systemd[1]: Starting User Login Management...
container-test-run-certificates> server # [6400285.967161] server systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> server # [6400285.972814] server systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> server # [6400285.973487] server systemd[1]: Started Console Getty.
container-test-run-certificates> server # [6400285.973509] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> server # [6400285.973523] server systemd[1]: Reached target Login Prompts.
container-test-run-certificates> ca # [6400285.896059] ca dbus-broker-launch[204]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> ca # [6400285.896680] ca dbus-broker-launch[204]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> ca # [6400285.896680] ca dbus-broker-launch[204]: Invalid user-name in /nix/store/jcywaks9vp2cnydrgh0aixldiymc0mg6-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> ca # [6400285.897031] ca systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> ca # [6400285.900980] ca dbus-broker-launch[204]: Ready
container-test-run-certificates> server # [6400286.085631] server dbus-broker-launch[194]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> server # [6400286.086171] server dbus-broker-launch[194]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> server # [6400286.086171] server dbus-broker-launch[194]: Invalid user-name in /nix/store/lv2ybi2iyvgvw7kwymvj2q0xss6yq3k7-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> server # [6400286.086484] server systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> server # [6400286.090322] server dbus-broker-launch[194]: Ready
container-test-run-certificates> client # [6400286.238244] client systemd-logind[204]: New seat seat0.
container-test-run-certificates> client # [6400286.238436] client systemd[1]: Started User Login Management.
container-test-run-certificates> client # [6400286.239664] client systemd[1]: Starting linger-users.service...
container-test-run-certificates> client # [6400286.263827] client systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> client # [6400286.263977] client systemd[1]: Finished linger-users.service.
container-test-run-certificates> client # [6400286.264354] client systemd[1]: Reached target Multi-User System.
container-test-run-certificates> ca # [6400286.301008] ca systemd-logind[234]: New seat seat0.
container-test-run-certificates> ca # [6400286.301193] ca systemd[1]: Started User Login Management.
container-test-run-certificates> ca # [6400286.302160] ca systemd[1]: Starting linger-users.service...
container-test-run-certificates> ca # [6400286.311761] ca acme-setup-start[218]: + set -euo pipefail
container-test-run-certificates> ca # [6400286.311761] ca acme-setup-start[218]: + test -e ca/key.pem
container-test-run-certificates> ca # [6400286.312158] ca acme-setup-start[218]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> ca # [6400286.324123] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> ca # [6400286.325301] ca systemd[1]: Starting Ensure certificate for ca.foo...
container-test-run-certificates> ca # [6400286.329522] ca systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> ca # [6400286.329656] ca systemd[1]: Finished linger-users.service.
container-test-run-certificates> server # [6400286.402506] server systemd-logind[223]: New seat seat0.
container-test-run-certificates> server # [6400286.402684] server systemd[1]: Started User Login Management.
container-test-run-certificates> server # [6400286.403963] server systemd[1]: Starting linger-users.service...
container-test-run-certificates> server # [6400286.420166] server systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> server # [6400286.420313] server systemd[1]: Finished linger-users.service.
container-test-run-certificates> server # [6400286.454912] server acme-setup-start[207]: + set -euo pipefail
container-test-run-certificates> server # [6400286.454912] server acme-setup-start[207]: + test -e ca/key.pem
container-test-run-certificates> server # [6400286.455264] server acme-setup-start[207]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> server # [6400286.463160] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> server # [6400286.464414] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> ca # [6400286.573733] ca step-ca[203]: badger 2026/08/13 11:52:23 INFO: All 0 tables opened in 0s
container-test-run-certificates> ca # [6400286.578143] ca step-ca[203]: 2026/08/13 11:52:23 Building new tls configuration using step-ca x509 Signer Interface
container-test-run-certificates> ca # [6400286.585696] ca step-ca[203]: 2026/08/13 11:52:23 Starting Smallstep CA/0.30.2 (linux/amd64)
container-test-run-certificates> ca # [6400286.585696] ca step-ca[203]: 2026/08/13 11:52:23 Documentation: https://u.step.sm/docs/ca
container-test-run-certificates> ca # [6400286.585696] ca step-ca[203]: 2026/08/13 11:52:23 Community Discord: https://u.step.sm/discord
container-test-run-certificates> ca # [6400286.585696] ca step-ca[203]: 2026/08/13 11:52:23 Config file: /etc/smallstep/ca.json
container-test-run-certificates> ca # [6400286.585696] ca step-ca[203]: 2026/08/13 11:52:23 The primary server URL is https://ca.foo:1443
container-test-run-certificates> ca # [6400286.585696] ca step-ca[203]: 2026/08/13 11:52:23 Root certificates are available at https://ca.foo:1443/roots.pem
container-test-run-certificates> ca # [6400286.585876] ca step-ca[203]: 2026/08/13 11:52:23 X.509 Root Fingerprint: 81b2623ca599605bd67e7801a781764313eb5155ceaedf3a5708d3a695a044b9
container-test-run-certificates> ca # [6400286.585905] ca systemd[1]: Started step-ca service.
container-test-run-certificates> ca # [6400286.586044] ca step-ca[203]: 2026/08/13 11:52:23 Serving HTTPS on 0.0.0.0:1443 ...
container-test-run-certificates> ca # [6400286.590097] ca systemd-networkd[195]: eth1: Gained IPv6LL
container-test-run-certificates> ca # [6400286.731989] ca acme-ca.foo-start[254]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6400286.733466] ca acme-ca.foo-start[254]: + '[' -e out/acme-success ']'
container-test-run-certificates> ca # [6400286.733497] ca acme-ca.foo-start[254]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=
container-test-run-certificates> ca # [6400286.738527] ca acme-ca.foo-start[280]: + cd ca.foo
container-test-run-certificates> ca # [6400286.738757] ca acme-ca.foo-start[280]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> ca # [6400286.739592] ca acme-ca.foo-start[281]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> ca # [6400286.739742] ca acme-ca.foo-start[280]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> ca # [6400286.740875] ca acme-ca.foo-start[280]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> ca # [6400286.740999] ca acme-ca.foo-start[254]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> ca # [6400286.742017] ca acme-ca.foo-start[254]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> ca # [6400286.743025] ca acme-ca.foo-start[254]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [6400286.743849] ca acme-ca.foo-start[254]: + for fixpath in out certificates
container-test-run-certificates> ca # [6400286.743849] ca acme-ca.foo-start[254]: + '[' -d out ']'
container-test-run-certificates> ca # [6400286.743907] ca acme-ca.foo-start[254]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6400286.744762] ca acme-ca.foo-start[254]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6400286.746909] ca acme-ca.foo-start[254]: + for fixpath in out certificates
container-test-run-certificates> ca # [6400286.746909] ca acme-ca.foo-start[254]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6400286.748572] ca systemd[1]: Finished Ensure certificate for ca.foo.
container-test-run-certificates> ca # [6400286.749508] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> client # [6400286.654090] client systemd-networkd[182]: eth1: Gained IPv6LL
container-test-run-certificates> ca: must succeed: systemctl restart acme-order-renew-ca.foo.service 
container-test-run-certificates> server # [6400286.875546] server acme-test.foo-start[244]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6400286.879515] server acme-test.foo-start[244]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [6400286.881664] server acme-test.foo-start[244]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [6400286.884483] server acme-test.foo-start[254]: + cd test.foo
container-test-run-certificates> server # [6400286.884754] server acme-test.foo-start[254]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [6400286.885444] server acme-test.foo-start[255]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [6400286.885624] server acme-test.foo-start[254]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [6400286.886360] server acme-test.foo-start[254]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [6400286.886484] server acme-test.foo-start[244]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [6400286.888009] server acme-test.foo-start[244]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [6400286.889028] server acme-test.foo-start[244]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6400286.890297] server acme-test.foo-start[244]: + for fixpath in out certificates
container-test-run-certificates> server # [6400286.890342] server acme-test.foo-start[244]: + '[' -d out ']'
container-test-run-certificates> server # [6400286.890342] server acme-test.foo-start[244]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6400286.891413] server acme-test.foo-start[244]: + chown -R acme:nginx out
container-test-run-certificates> server # [6400286.893278] server acme-test.foo-start[244]: + for fixpath in out certificates
container-test-run-certificates> server # [6400286.893278] server acme-test.foo-start[244]: + '[' -d certificates ']'
container-test-run-certificates> server # [6400286.895587] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [6400286.896661] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server # [6400287.294144] server systemd-networkd[186]: eth1: Gained IPv6LL
container-test-run-certificates> server # [6400287.324747] server nginx-pre-start[266]: nginx: the configuration file /nix/store/wkxz4hka5qs8dgkzynp4dx3grs3s3mw2-nginx.conf syntax is ok
container-test-run-certificates> server # [6400287.325110] server nginx-pre-start[266]: nginx: configuration file /nix/store/wkxz4hka5qs8dgkzynp4dx3grs3s3mw2-nginx.conf test is successful
container-test-run-certificates> server # [6400287.328144] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [6400287.328448] server systemd[1]: Reached target Multi-User System.
container-test-run-certificates> server # [6400287.329448] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> ca # [6400287.160008] ca nginx-pre-start[292]: nginx: the configuration file /nix/store/zb89w1ys7kkrqjwj5z5awncaf9j5p74m-nginx.conf syntax is ok
container-test-run-certificates> ca # [6400287.160551] ca nginx-pre-start[292]: nginx: configuration file /nix/store/zb89w1ys7kkrqjwj5z5awncaf9j5p74m-nginx.conf test is successful
container-test-run-certificates> ca # [6400287.163621] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> ca # [6400287.163920] ca systemd[1]: Reached target Multi-User System.
container-test-run-certificates> ca # [6400287.164674] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> ca # [6400287.588935] ca acme-order-renew-ca.foo-start[295]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6400287.590434] ca acme-order-renew-ca.foo-start[295]: + set -euo pipefail
container-test-run-certificates> ca # [6400287.590477] ca acme-order-renew-ca.foo-start[295]: + echo 88dc4fc401a6091a1bd9
container-test-run-certificates> ca # [6400287.590535] ca acme-order-renew-ca.foo-start[295]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> ca # [6400287.591167] ca acme-order-renew-ca.foo-start[295]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run
container-test-run-certificates> ca # [6400287.601720] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:24 No key found for account none@none.tld. Generating a P256 key.
container-test-run-certificates> ca # [6400287.601996] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:24 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key
container-test-run-certificates> ca # [6400287.622743] ca step-ca[203]: time="2026-08-13T11:52:24Z" level=info duration="104.948µs" duration-ns=104948 fields.time="2026-08-13T11:52:24Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=500baebd-280a-408c-8c60-2c9791450575 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400287.623159] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:24 [INFO] acme: Registering account for none@none.tld
container-test-run-certificates> ca # [6400287.661489] ca step-ca[203]: time="2026-08-13T11:52:25Z" level=info duration=38.216ms duration-ns=38216000 fields.time="2026-08-13T11:52:24Z" method=HEAD name=ca nonce=ZlVvUzY5TldnZ1FNblRkNGVUYWt4WEZ5eEZpYVRwNks path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=21c5eb6f-9dc8-4d0d-8c7b-d8d5cb3af998 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400287.735765] ca step-ca[203]: time="2026-08-13T11:52:25Z" level=info duration=73.5007ms duration-ns=73500700 fields.time="2026-08-13T11:52:25Z" method=POST name=ca nonce=QjdvVUUzdVZpVUo3VHBKNG9xWHZaQkhLdk9hMVNJb28 path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=78a4a9df-65a2-45fd-a3f9-9859426cec53 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/V6mB32gosrZcTcDy2Lm9RQAjcooG9hcM/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400287.736208] ca acme-order-renew-ca.foo-start[307]: !!!! HEADS UP !!!!
container-test-run-certificates> ca # [6400287.736208] ca acme-order-renew-ca.foo-start[307]: Your account credentials have been saved in your
container-test-run-certificates> ca # [6400287.736208] ca acme-order-renew-ca.foo-start[307]: configuration directory at "accounts".
container-test-run-certificates> ca # [6400287.736208] ca acme-order-renew-ca.foo-start[307]: You should make a secure backup of this folder now. This
container-test-run-certificates> ca # [6400287.736208] ca acme-order-renew-ca.foo-start[307]: configuration directory will also contain private keys
container-test-run-certificates> ca # [6400287.736208] ca acme-order-renew-ca.foo-start[307]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> ca # [6400287.736208] ca acme-order-renew-ca.foo-start[307]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> ca # [6400287.736377] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:25 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate
container-test-run-certificates> ca # [6400287.809552] ca step-ca[203]: time="2026-08-13T11:52:25Z" level=info duration=72.945916ms duration-ns=72945916 fields.time="2026-08-13T11:52:25Z" method=POST name=ca nonce=ZlpDb29paVF2cGZaN2NoM0J1ZHI2ZlQyMWVwNnlsM0w path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a0d8fec5-03d8-4e42-ae53-ed3b4114e9b4 response="{\"id\":\"saIima800XkphUCq2pDVkMEfTVL9vX8V\",\"status\":\"pending\",\"expires\":\"2026-08-14T11:52:25Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-13T11:51:25Z\",\"notAfter\":\"2026-11-11T11:52:25Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/saIima800XkphUCq2pDVkMEfTVL9vX8V/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400287.876071] ca step-ca[203]: time="2026-08-13T11:52:25Z" level=info duration=9.140965ms duration-ns=9140965 fields.time="2026-08-13T11:52:25Z" method=POST name=ca nonce=dkJhQU9CS2ZsaDM4SW1DbHFRb0RNS1JIVUJGOEFTenc path=/acme/acme/authz/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f39ddc52-6840-4154-a776-e0469ec3addf response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"V26Jr8c71BlsKvAAu7aYzj54tVsAeNia\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f/IksBo0LaaIIziBLP94vOWe9QWUvS9eAA\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"V26Jr8c71BlsKvAAu7aYzj54tVsAeNia\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f/PmaIYpV0Lo3C0TklhSgL1v4Fqaf53dPP\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"V26Jr8c71BlsKvAAu7aYzj54tVsAeNia\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f/1ujYYCQGZCcM9tUYnwCoPP5v7VqEjqit\"}],\"wildcard\":false,\"expires\":\"2026-08-14T11:52:25Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400287.876295] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:25 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f
container-test-run-certificates> ca # [6400287.876327] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:25 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01
container-test-run-certificates> ca # [6400287.876327] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:25 [INFO] [ca.foo] acme: use http-01 solver
container-test-run-certificates> ca # [6400287.876327] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:25 [INFO] [ca.foo] acme: Trying to solve HTTP-01
container-test-run-certificates> server # [6400287.755084] server acme-order-renew-test.foo-start[269]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6400287.756674] server acme-order-renew-test.foo-start[269]: + set -euo pipefail
container-test-run-certificates> server # [6400287.756719] server acme-order-renew-test.foo-start[269]: + echo ad12aa6741ce4bd2c108
container-test-run-certificates> server # [6400287.756772] server acme-order-renew-test.foo-start[269]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> server # [6400287.757446] server acme-order-renew-test.foo-start[269]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run
container-test-run-certificates> server # [6400287.769188] server acme-order-renew-test.foo-start[281]: 2026/08/13 11:52:25 No key found for account none@none.tld. Generating a P256 key.
container-test-run-certificates> server # [6400287.773795] server acme-order-renew-test.foo-start[281]: 2026/08/13 11:52:25 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key
container-test-run-certificates> server # [6400287.790409] server acme-order-renew-test.foo-start[281]: 2026/08/13 11:52:25 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority
container-test-run-certificates> server # [6400287.790653] server acme-order-renew-test.foo-start[269]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.
container-test-run-certificates> server # [6400287.790653] server acme-order-renew-test.foo-start[269]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.
container-test-run-certificates> server # [6400287.790711] server acme-order-renew-test.foo-start[269]: + exit 10
container-test-run-certificates> server # [6400287.792010] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a
container-test-run-certificates> server # [6400287.792092] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'.
container-test-run-certificates> server # [6400287.792292] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> ca # [6400287.883490] ca step-ca[203]: time="2026-08-13T11:52:25Z" level=info duration=6.800727ms duration-ns=6800727 fields.time="2026-08-13T11:52:25Z" method=POST name=ca nonce=akR1QmpxUEVRYXZBeUZwMEk4bUo0emZmRUhwWXVEVHo path=/acme/acme/challenge/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f/PmaIYpV0Lo3C0TklhSgL1v4Fqaf53dPP protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=71d7da86-85f9-4d68-8110-db1487160d75 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"V26Jr8c71BlsKvAAu7aYzj54tVsAeNia\",\"validated\":\"2026-08-13T11:52:25Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f/PmaIYpV0Lo3C0TklhSgL1v4Fqaf53dPP\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400287.883700] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:25 [INFO] [ca.foo] The server validated our request
container-test-run-certificates> ca # [6400287.883751] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:25 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates
container-test-run-certificates> ca # [6400287.890058] ca step-ca[203]: time="2026-08-13T11:52:25Z" level=info duration=5.836763ms duration-ns=5836763 fields.time="2026-08-13T11:52:25Z" method=POST name=ca nonce=MDZkVGhKUGhPY1FPVzBiRFdEQTMySEp6WjkzQXlraTA path=/acme/acme/order/saIima800XkphUCq2pDVkMEfTVL9vX8V/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b55388c1-a6f1-4010-996e-e8ed16e8709b response="{\"id\":\"saIima800XkphUCq2pDVkMEfTVL9vX8V\",\"status\":\"valid\",\"expires\":\"2026-08-14T11:52:25Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-13T11:51:25Z\",\"notAfter\":\"2026-11-11T11:52:25Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/ZnrU6mjXJ6pnXVnvzjd5Os3altFGGg9f\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/saIima800XkphUCq2pDVkMEfTVL9vX8V/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/UoLS5C41J4G2uxFEULJ9mm9IxKMIjNVO\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400287.891643] ca step-ca[203]: time="2026-08-13T11:52:25Z" level=info certificate="MIIB0jCCAXmgAwIBAgIQDmt1oqBHh1rlJ0R2NRDJLzAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA4MTMxMTUxMjVaFw0yNjExMTExMTUyMjVaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABC/vjT3KZKa8xG2DcFJVmYPyoYCLrngxSN0ctRPgMcB9bnDI/BFPQXyGrvIT+Lna9zS9emEmmOJLBr8/7/D9dj+jgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUD34lg1obK2XlDP/rdUYSpC3YcNYwHwYDVR0jBBgwFoAUshRT5JBvr3gZz1Wx/KiFZW9C0b0wEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNHADBEAiALUqILf+SKKxwM70ftpkTVzQtBO6C385GazZ6u3IBbPAIgCPkdXR7jYdFcdIgh+5nZiTtBW427FbNKT57tuPvnNV0=" duration=1.189059ms duration-ns=1189059 fields.time="2026-08-13T11:52:25Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=V2xycXAyN2FNcm5hc1V0Z3lXR1M2NTBTOVFvV2lLUGg path=/acme/acme/certificate/UoLS5C41J4G2uxFEULJ9mm9IxKMIjNVO protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=06827722-94e8-4c48-a19a-64991c6ee20d sans="map[dns:[ca.foo]]" serial=19167153631342077833970599470268729647 size=1340 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= valid-from="2026-08-13T11:51:25Z" valid-to="2026-11-11T11:52:25Z"
container-test-run-certificates> ca # [6400287.891771] ca acme-order-renew-ca.foo-start[307]: 2026/08/13 11:52:25 [INFO] [ca.foo] Server responded with a certificate.
container-test-run-certificates> ca # [6400287.895584] ca acme-order-renew-ca.foo-start[295]: + mv domainhash.txt certificates/
container-test-run-certificates> ca # [6400287.896968] ca acme-order-renew-ca.foo-start[295]: + touch out/acme-success
container-test-run-certificates> ca # [6400287.897872] ca acme-order-renew-ca.foo-start[295]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6400287.898746] ca acme-order-renew-ca.foo-start[295]: + touch out/renewed
container-test-run-certificates> ca # [6400287.899670] ca acme-order-renew-ca.foo-start[295]: + echo Installing new certificate
container-test-run-certificates> ca # [6400287.899670] ca acme-order-renew-ca.foo-start[295]: Installing new certificate
container-test-run-certificates> ca # [6400287.899722] ca acme-order-renew-ca.foo-start[295]: + cp -vp certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6400287.900493] ca acme-order-renew-ca.foo-start[327]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> ca # [6400287.900701] ca acme-order-renew-ca.foo-start[295]: + cp -vp certificates/ca.foo.key out/key.pem
container-test-run-certificates> ca # [6400287.901488] ca acme-order-renew-ca.foo-start[328]: 'certificates/ca.foo.key' -> 'out/key.pem'
container-test-run-certificates> ca # [6400287.901678] ca acme-order-renew-ca.foo-start[295]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem
container-test-run-certificates> ca # [6400287.902609] ca acme-order-renew-ca.foo-start[329]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> ca # [6400287.902794] ca acme-order-renew-ca.foo-start[295]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> ca # [6400287.903697] ca acme-order-renew-ca.foo-start[295]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [6400287.904740] ca acme-order-renew-ca.foo-start[295]: + for fixpath in out certificates
container-test-run-certificates> ca # [6400287.904777] ca acme-order-renew-ca.foo-start[295]: + '[' -d out ']'
container-test-run-certificates> ca # [6400287.904777] ca acme-order-renew-ca.foo-start[295]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6400287.905757] ca acme-order-renew-ca.foo-start[295]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6400287.907885] ca acme-order-renew-ca.foo-start[295]: + for fixpath in out certificates
container-test-run-certificates> ca # [6400287.907911] ca acme-order-renew-ca.foo-start[295]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6400287.907911] ca acme-order-renew-ca.foo-start[295]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [6400287.908968] ca acme-order-renew-ca.foo-start[295]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [6400287.910789] ca acme-order-renew-ca.foo-start[295]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [6400288.012908] ca systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> ca # [6400288.015724] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [6400288.015900] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> ca # [6400288.429549] ca nginx[345]: nginx: the configuration file /nix/store/zb89w1ys7kkrqjwj5z5awncaf9j5p74m-nginx.conf syntax is ok
container-test-run-certificates> ca # [6400288.429886] ca nginx[345]: nginx: configuration file /nix/store/zb89w1ys7kkrqjwj5z5awncaf9j5p74m-nginx.conf test is successful
container-test-run-certificates> ca # [6400288.810202] ca systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> client # [6400295.722351] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [6400295.723415] client systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [6400295.723593] client systemd[1]: Startup finished in 11.231s.
container-test-run-certificates> server # [6400295.723148] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> server # [6400295.723855] server systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> server # [6400295.724044] server systemd[1]: Startup finished in 11.233s.
container-test-run-certificates> ca # [6400295.724478] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> ca # [6400295.725116] ca systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> ca # [6400295.725235] ca systemd[1]: Startup finished in 11.222s.
container-test-run-certificates> ca # [6400295.860898] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 9.17 seconds)
container-test-run-certificates> ca # [6400296.267793] ca acme-order-renew-ca.foo-start[361]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6400296.269546] ca acme-order-renew-ca.foo-start[361]: + set -euo pipefail
container-test-run-certificates> ca # [6400296.269588] ca acme-order-renew-ca.foo-start[361]: + echo 88dc4fc401a6091a1bd9
container-test-run-certificates> ca # [6400296.269645] ca acme-order-renew-ca.foo-start[361]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> ca # [6400296.270337] ca acme-order-renew-ca.foo-start[361]: + '[' -e certificates/ca.foo.key ']'
container-test-run-certificates> ca # [6400296.270366] ca acme-order-renew-ca.foo-start[361]: + '[' -e certificates/ca.foo.crt ']'
container-test-run-certificates> ca # [6400296.270591] ca acme-order-renew-ca.foo-start[369]: ++ find accounts -name none@none.tld.key
container-test-run-certificates> ca # [6400296.272045] ca acme-order-renew-ca.foo-start[361]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']'
container-test-run-certificates> ca # [6400296.272080] ca acme-order-renew-ca.foo-start[361]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic
container-test-run-certificates> ca # [6400296.293281] ca step-ca[203]: time="2026-08-13T11:52:33Z" level=info duration="44.093µs" duration-ns=44093 fields.time="2026-08-13T11:52:33Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b65bd2c5-2f47-49ee-9dba-b53eef0826ce response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400296.293648] ca acme-order-renew-ca.foo-start[370]: 2026/08/13 11:52:33 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint
container-test-run-certificates> ca # [6400296.293648] ca acme-order-renew-ca.foo-start[370]: 2026/08/13 11:52:33 [INFO] [ca.foo] The certificate expires at 2026-11-11T11:52:25Z, the renewal can be performed in 1439h59m31.340860069s: no renewal.
container-test-run-certificates> ca # [6400296.293746] ca acme-order-renew-ca.foo-start[361]: + mv domainhash.txt certificates/
container-test-run-certificates> ca # [6400296.294629] ca acme-order-renew-ca.foo-start[361]: + touch out/acme-success
container-test-run-certificates> ca # [6400296.295396] ca acme-order-renew-ca.foo-start[361]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6400296.295959] ca acme-order-renew-ca.foo-start[361]: + for fixpath in out certificates
container-test-run-certificates> ca # [6400296.295976] ca acme-order-renew-ca.foo-start[361]: + '[' -d out ']'
container-test-run-certificates> ca # [6400296.295976] ca acme-order-renew-ca.foo-start[361]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6400296.296755] ca acme-order-renew-ca.foo-start[361]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6400296.298307] ca acme-order-renew-ca.foo-start[361]: + for fixpath in out certificates
container-test-run-certificates> ca # [6400296.298323] ca acme-order-renew-ca.foo-start[361]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6400296.298323] ca acme-order-renew-ca.foo-start[361]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [6400296.299166] ca acme-order-renew-ca.foo-start[361]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [6400296.300418] ca acme-order-renew-ca.foo-start[361]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [6400296.383696] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [6400296.383869] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> server: must succeed: systemctl restart acme-test.foo.service
container-test-run-certificates> server # [6400299.393226] server systemd[1]: acme-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [6400299.393319] server systemd[1]: Stopped Ensure certificate for test.foo.
container-test-run-certificates> server # [6400299.393879] server systemd[1]: Stopping Ensure certificate for test.foo...
container-test-run-certificates> server # [6400299.394679] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.39 seconds)
container-test-run-certificates> client: waiting for success: curl -v https://test.foo
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [1008 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [111 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 13 11:52:24 2026 GMT
container-test-run-certificates> *   expire date: Sep 12 11:52:24 2028 GMT
container-test-run-certificates> *   issuer: CN=minica root ca 37b67b
container-test-run-certificates> *   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 13
container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html
container-test-run-certificates> 
container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not
container-test-run-certificates> establish a secure connection to it. To learn more about this situation and
container-test-run-certificates> how to fix it, please visit the webpage mentioned above.
container-test-run-certificates> server # [6400299.764658] server acme-test.foo-start[304]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6400299.765997] server acme-test.foo-start[304]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [6400299.766021] server acme-test.foo-start[304]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [6400299.770314] server acme-test.foo-start[314]: + cd test.foo
container-test-run-certificates> server # [6400299.770462] server acme-test.foo-start[314]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [6400299.771087] server acme-test.foo-start[315]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [6400299.771205] server acme-test.foo-start[314]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [6400299.771854] server acme-test.foo-start[314]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [6400299.771978] server acme-test.foo-start[304]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [6400299.772860] server acme-test.foo-start[304]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [6400299.773837] server acme-test.foo-start[304]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6400299.774685] server acme-test.foo-start[304]: + for fixpath in out certificates
container-test-run-certificates> server # [6400299.774685] server acme-test.foo-start[304]: + '[' -d out ']'
container-test-run-certificates> server # [6400299.774727] server acme-test.foo-start[304]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6400299.775580] server acme-test.foo-start[304]: + chown -R acme:nginx out
container-test-run-certificates> server # [6400299.776837] server acme-test.foo-start[304]: + for fixpath in out certificates
container-test-run-certificates> server # [6400299.776837] server acme-test.foo-start[304]: + '[' -d certificates ']'
container-test-run-certificates> server # [6400299.778200] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [6400299.779596] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> server # [6400300.150404] server acme-order-renew-test.foo-start[322]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6400300.151983] server acme-order-renew-test.foo-start[322]: + set -euo pipefail
container-test-run-certificates> server # [6400300.152034] server acme-order-renew-test.foo-start[322]: + echo ad12aa6741ce4bd2c108
container-test-run-certificates> server # [6400300.152082] server acme-order-renew-test.foo-start[322]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> server # [6400300.152706] server acme-order-renew-test.foo-start[322]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run
container-test-run-certificates> server # [6400300.176691] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] acme: Registering account for none@none.tld
container-test-run-certificates> server # [6400300.182590] server acme-order-renew-test.foo-start[330]: !!!! HEADS UP !!!!
container-test-run-certificates> server # [6400300.182590] server acme-order-renew-test.foo-start[330]: Your account credentials have been saved in your
container-test-run-certificates> server # [6400300.182590] server acme-order-renew-test.foo-start[330]: configuration directory at "accounts".
container-test-run-certificates> server # [6400300.182590] server acme-order-renew-test.foo-start[330]: You should make a secure backup of this folder now. This
container-test-run-certificates> server # [6400300.182590] server acme-order-renew-test.foo-start[330]: configuration directory will also contain private keys
container-test-run-certificates> server # [6400300.182590] server acme-order-renew-test.foo-start[330]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> server # [6400300.182590] server acme-order-renew-test.foo-start[330]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> server # [6400300.182760] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] [test.foo] acme: Obtaining bundled SAN certificate
container-test-run-certificates> server # [6400300.254235] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/HKjk62YxySFT1xjmw1p9nBplq88FgBiK
container-test-run-certificates> server # [6400300.254235] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01
container-test-run-certificates> server # [6400300.254235] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] [test.foo] acme: use http-01 solver
container-test-run-certificates> server # [6400300.254235] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] [test.foo] acme: Trying to solve HTTP-01
container-test-run-certificates> server # [6400300.258155] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] [test.foo] The server validated our request
container-test-run-certificates> server # [6400300.258223] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] [test.foo] acme: Validations succeeded; requesting certificates
container-test-run-certificates> server # [6400300.264248] server acme-order-renew-test.foo-start[330]: 2026/08/13 11:52:37 [INFO] [test.foo] Server responded with a certificate.
container-test-run-certificates> server # [6400300.266704] server acme-order-renew-test.foo-start[322]: + mv domainhash.txt certificates/
container-test-run-certificates> server # [6400300.268027] server acme-order-renew-test.foo-start[322]: + touch out/acme-success
container-test-run-certificates> server # [6400300.269152] server acme-order-renew-test.foo-start[322]: + cmp -s certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [6400300.269919] server acme-order-renew-test.foo-start[322]: + touch out/renewed
container-test-run-certificates> server # [6400300.270901] server acme-order-renew-test.foo-start[322]: + echo Installing new certificate
container-test-run-certificates> server # [6400300.270901] server acme-order-renew-test.foo-start[322]: Installing new certificate
container-test-run-certificates> server # [6400300.270954] server acme-order-renew-test.foo-start[322]: + cp -vp certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [6400300.271894] server acme-order-renew-test.foo-start[350]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> server # [6400300.272082] server acme-order-renew-test.foo-start[322]: + cp -vp certificates/test.foo.key out/key.pem
container-test-run-certificates> server # [6400300.272873] server acme-order-renew-test.foo-start[351]: 'certificates/test.foo.key' -> 'out/key.pem'
container-test-run-certificates> server # [6400300.273024] server acme-order-renew-test.foo-start[322]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem
container-test-run-certificates> server # [6400300.273953] server acme-order-renew-test.foo-start[352]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> server # [6400300.274147] server acme-order-renew-test.foo-start[322]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> server # [6400300.275119] server acme-order-renew-test.foo-start[322]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6400300.276116] server acme-order-renew-test.foo-start[322]: + for fixpath in out certificates
container-test-run-certificates> server # [6400300.276153] server acme-order-renew-test.foo-start[322]: + '[' -d out ']'
container-test-run-certificates> server # [6400300.276153] server acme-order-renew-test.foo-start[322]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6400300.277152] server acme-order-renew-test.foo-start[322]: + chown -R acme:nginx out
container-test-run-certificates> server # [6400300.278645] server acme-order-renew-test.foo-start[322]: + for fixpath in out certificates
container-test-run-certificates> server # [6400300.278679] server acme-order-renew-test.foo-start[322]: + '[' -d certificates ']'
container-test-run-certificates> server # [6400300.278679] server acme-order-renew-test.foo-start[322]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> server # [6400300.279502] server acme-order-renew-test.foo-start[322]: + chown -R acme:nginx certificates
container-test-run-certificates> server # [6400300.280754] server acme-order-renew-test.foo-start[322]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> server # [6400300.365132] server systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> server # [6400300.367410] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [6400300.367537] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> ca # [6400300.176392] ca step-ca[203]: time="2026-08-13T11:52:37Z" level=info duration="37.962µs" duration-ns=37962 fields.time="2026-08-13T11:52:37Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=7674b516-0e9d-4d49-be9d-9a984010bce3 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400300.179531] ca step-ca[203]: time="2026-08-13T11:52:37Z" level=info duration=1.957015ms duration-ns=1957015 fields.time="2026-08-13T11:52:37Z" method=HEAD name=ca nonce=U0R5cUFJdk9PQTN0VWlycEhYMFR1QThGN2pDeVBpWHI path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=310bef43-c39f-49c6-babb-785429f69117 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400300.182253] ca step-ca[203]: time="2026-08-13T11:52:37Z" level=info duration=1.687267ms duration-ns=1687267 fields.time="2026-08-13T11:52:37Z" method=POST name=ca nonce=Nk96N29acUVsWjBxSkxSU1p4MmtxTFlBS2lJQlVPblI path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=8549765c-28b0-4c40-8abd-82f9de4640ba response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/1zQRDdir17wpWschzLebzR2CJaufzOkG/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400300.186080] ca step-ca[203]: time="2026-08-13T11:52:37Z" level=info duration=2.62311ms duration-ns=2623110 fields.time="2026-08-13T11:52:37Z" method=POST name=ca nonce=dk5Yd2NMTG5sSmhPR3lEQmJ1dUhEeDZGdWRFWUppWFI path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=d2813dc0-fb93-4874-b263-b0dfeaa40dcf response="{\"id\":\"JpzsyUotYJegzmndUwnYwzjDMEvueVRs\",\"status\":\"pending\",\"expires\":\"2026-08-14T11:52:37Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-13T11:51:37Z\",\"notAfter\":\"2026-11-11T11:52:37Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/HKjk62YxySFT1xjmw1p9nBplq88FgBiK\"],\"finalize\":\"https://ca.foo/acme/acme/order/JpzsyUotYJegzmndUwnYwzjDMEvueVRs/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400300.253848] ca step-ca[203]: time="2026-08-13T11:52:37Z" level=info duration=9.917447ms duration-ns=9917447 fields.time="2026-08-13T11:52:37Z" method=POST name=ca nonce=N05lR2ljZ0x2eTZhRjhFeXdwaWZ5cUtWRGI1a0wyZ0c path=/acme/acme/authz/HKjk62YxySFT1xjmw1p9nBplq88FgBiK protocol=HTTP/1.1 referer= remote-address="::1" request-id=4f5cb65b-c8fe-442e-bbdf-9ef6ad79e095 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"w3QyW0ZOPtS25jPJ929RgAeuhqBKRAp6\",\"url\":\"https://ca.foo/acme/acme/challenge/HKjk62YxySFT1xjmw1p9nBplq88FgBiK/1DbHJQpgyg0J1BV3kfVzlz0iMQIxW1eI\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"w3QyW0ZOPtS25jPJ929RgAeuhqBKRAp6\",\"url\":\"https://ca.foo/acme/acme/challenge/HKjk62YxySFT1xjmw1p9nBplq88FgBiK/M3fac16k5ZN4Aj6vRQiggdT7Mg2l45X0\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"w3QyW0ZOPtS25jPJ929RgAeuhqBKRAp6\",\"url\":\"https://ca.foo/acme/acme/challenge/HKjk62YxySFT1xjmw1p9nBplq88FgBiK/IOy474QHOU7gvenzhI3JAOyfdzaOY4Cn\"}],\"wildcard\":false,\"expires\":\"2026-08-14T11:52:37Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400300.257691] ca step-ca[203]: time="2026-08-13T11:52:37Z" level=info duration=2.422011ms duration-ns=2422011 fields.time="2026-08-13T11:52:37Z" method=POST name=ca nonce=Vk9CVmFYakRva1p4Z01BSk5iV1BVazZXNDVsQVV1U08 path=/acme/acme/challenge/HKjk62YxySFT1xjmw1p9nBplq88FgBiK/M3fac16k5ZN4Aj6vRQiggdT7Mg2l45X0 protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=9ab74601-0b72-4570-82ae-6afe411e6f94 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"w3QyW0ZOPtS25jPJ929RgAeuhqBKRAp6\",\"validated\":\"2026-08-13T11:52:37Z\",\"url\":\"https://ca.foo/acme/acme/challenge/HKjk62YxySFT1xjmw1p9nBplq88FgBiK/M3fac16k5ZN4Aj6vRQiggdT7Mg2l45X0\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400300.262366] ca step-ca[203]: time="2026-08-13T11:52:37Z" level=info duration=3.097394ms duration-ns=3097394 fields.time="2026-08-13T11:52:37Z" method=POST name=ca nonce=QTJ3bld1UHJtRkN3YlJpTVZPTEhGYU5hcW9qaWNmNFM path=/acme/acme/order/JpzsyUotYJegzmndUwnYwzjDMEvueVRs/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=162bc20a-5e25-48cc-b415-25adbfb208a5 response="{\"id\":\"JpzsyUotYJegzmndUwnYwzjDMEvueVRs\",\"status\":\"valid\",\"expires\":\"2026-08-14T11:52:37Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-13T11:51:37Z\",\"notAfter\":\"2026-11-11T11:52:37Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/HKjk62YxySFT1xjmw1p9nBplq88FgBiK\"],\"finalize\":\"https://ca.foo/acme/acme/order/JpzsyUotYJegzmndUwnYwzjDMEvueVRs/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/OkJZ66CBEqdgn6M526XdGliGamlEhT0x\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [6400300.263982] ca step-ca[203]: time="2026-08-13T11:52:37Z" level=info certificate="MIIB2DCCAX6gAwIBAgIRANqQwnRDONt5k9kjUQ58KVkwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODEzMTE1MTM3WhcNMjYxMTExMTE1MjM3WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFHxbkxpx66mn6/id0qG9+VSgiLO9YhvAC5yQ21R2y9Tf+9tnAJBEbMneX9bM4mRBWI+G40+oRvHS0yQ9vLnw8ejgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUQ5NyUw+XQCm6mf8Y/sohJl69haIwHwYDVR0jBBgwFoAUshRT5JBvr3gZz1Wx/KiFZW9C0b0wEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0gAMEUCIQC4V3h7kIJvZ4zlWiQZxjcFlU588aqGI/+UvRXUg28XuwIgchIVq6Bpp1q7B6JXouOlOo8/hDAtTiK2rjQY4CPzRqo=" duration="777.815µs" duration-ns=777815 fields.time="2026-08-13T11:52:37Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=QXFKRWxyMUZDOUN6V2cwVWdOQVVpYkxQQjJJRE9kd0U path=/acme/acme/certificate/OkJZ66CBEqdgn6M526XdGliGamlEhT0x protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=8156c17b-0f5a-4ee4-84a1-81b257873da5 sans="map[dns:[test.foo]]" serial=290523337827474867495161642664435919193 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= valid-from="2026-08-13T11:51:37Z" valid-to="2026-11-11T11:52:37Z"
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [1008 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [111 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 13 11:52:24 2026 GMT
container-test-run-certificates> *   expire date: Sep 12 11:52:24 2028 GMT
container-test-run-certificates> *   issuer: CN=minica root ca 37b67b
container-test-run-certificates> *   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 13
container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html
container-test-run-certificates> 
container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not
container-test-run-certificates> establish a secure connection to it. To learn more about this situation and
container-test-run-certificates> how to fix it, please visit the webpage mentioned above.
container-test-run-certificates> server # [6400300.734167] server nginx[368]: nginx: the configuration file /nix/store/wkxz4hka5qs8dgkzynp4dx3grs3s3mw2-nginx.conf syntax is ok
container-test-run-certificates> server # [6400300.734373] server nginx[368]: nginx: configuration file /nix/store/wkxz4hka5qs8dgkzynp4dx3grs3s3mw2-nginx.conf test is successful
container-test-run-certificates> server # [6400301.109441] server systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [931 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [80 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 13 11:51:37 2026 GMT
container-test-run-certificates> *   expire date: Nov 11 11:52:37 2026 GMT
container-test-run-certificates> *   issuer: CN=Clan Intermediate CA
container-test-run-certificates> *   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 0
container-test-run-certificates> * SSL certificate verified via OpenSSL.
container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 46978 
container-test-run-certificates>   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
container-test-run-certificates>                                  Dload  Upload  Total   Spent   Left   Speed
container-test-run-certificates>   0      0   0      0   0      0      0      0                              0* using HTTP/2
container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/
container-test-run-certificates> * [HTTP/2] [1] [:method: GET]
container-test-run-certificates> * [HTTP/2] [1] [:scheme: https]
container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo]
container-test-run-certificates> * [HTTP/2] [1] [:path: /]
container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.21.0]
container-test-run-certificates> * [HTTP/2] [1] [accept: */*]
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> * Request completely sent off
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> 100     20 100     20   0      0   1624      0                              0
container-test-run-certificates> * Connection #0 to host test.foo:443 left intact
container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 2.07 seconds)
container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2
container-test-run-certificates> Certificate:
container-test-run-certificates>     Data:
container-test-run-certificates>         Version: 3 (0x2)
container-test-run-certificates>         Serial Number:
container-test-run-certificates>             da:90:c2:74:43:38:db:79:93:d9:23:51:0e:7c:29:59
container-test-run-certificates>         Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>         Issuer: CN=Clan Intermediate CA
container-test-run-certificates>         Validity
container-test-run-certificates>             Not Before: Aug 13 11:51:37 2026 GMT
container-test-run-certificates>             Not After : Nov 11 11:52:37 2026 GMT
container-test-run-certificates>         Subject: CN=test.foo
container-test-run-certificates>         Subject Public Key Info:
container-test-run-certificates>             Public Key Algorithm: id-ecPublicKey
container-test-run-certificates>                 Public-Key: (256 bit)
container-test-run-certificates>                 pub:
container-test-run-certificates>                     04:51:f1:6e:4c:69:c7:ae:a6:9f:af:e2:77:4a:86:
container-test-run-certificates>                     f7:e5:52:82:22:ce:f5:88:6f:00:2e:72:43:6d:51:
container-test-run-certificates>                     db:2f:53:7f:ef:6d:9c:02:41:11:b3:27:79:7f:5b:
container-test-run-certificates>                     33:89:91:05:62:3e:1b:8d:3e:a1:1b:c7:4b:4c:90:
container-test-run-certificates>                     f6:f2:e7:c3:c7
container-test-run-certificates>                 ASN1 OID: prime256v1
container-test-run-certificates>                 NIST CURVE: P-256
container-test-run-certificates>         X509v3 extensions:
container-test-run-certificates>             X509v3 Key Usage: critical
container-test-run-certificates>                 Digital Signature
container-test-run-certificates>             X509v3 Extended Key Usage: 
container-test-run-certificates>                 TLS Web Server Authentication, TLS Web Client Authentication
container-test-run-certificates>             X509v3 Subject Key Identifier: 
container-test-run-certificates>                 43:93:72:53:0F:97:40:29:BA:99:FF:18:FE:CA:21:26:5E:BD:85:A2
container-test-run-certificates>             X509v3 Authority Key Identifier: 
container-test-run-certificates>                 B2:14:53:E4:90:6F:AF:78:19:CF:55:B1:FC:A8:85:65:6F:42:D1:BD
container-test-run-certificates>             X509v3 Subject Alternative Name: 
container-test-run-certificates>                 DNS:test.foo
container-test-run-certificates>             1.3.6.1.4.1.37476.9000.64.1: 
container-test-run-certificates>                 0......acme..
container-test-run-certificates>     Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>     Signature Value:
container-test-run-certificates>         30:45:02:21:00:b8:57:78:7b:90:82:6f:67:8c:e5:5a:24:19:
container-test-run-certificates>         c6:37:05:95:4e:7c:f1:aa:86:23:ff:94:bd:15:d4:83:6f:17:
container-test-run-certificates>         bb:02:20:72:12:15:ab:a0:69:a7:5a:bb:07:a2:57:a2:e3:a5:
container-test-run-certificates>         3a:8f:3f:84:30:2d:4e:22:b6:ae:34:18:e0:23:f3:46:aa
container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.05 seconds)
container-test-run-certificates> (finished: run the VM test script, in 17.68 seconds)
container-test-run-certificates> test script finished in 21.35s
container-test-run-certificates> cleanup
container-test-run-certificates> kill NspawnMachine (pid 53)
container-test-run-certificates> kill NspawnMachine (pid 54)
container-test-run-certificates> Container ca terminated by signal KILL.
container-test-run-certificates> kill NspawnMachine (pid 56)
container-test-run-certificates> Container client terminated by signal KILL.
container-test-run-certificates> Container server terminated by signal KILL.
container-test-run-certificates> (finished: cleanup, in 0.29 seconds)

post-build step Upload to niks3: ok
time=2026-08-13T11:52:43.469Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)"
time=2026-08-13T11:52:43.963Z level=INFO msg="Uploading 1 narinfos"
time=2026-08-13T11:52:44.216Z level=INFO msg="Upload complete. (803ms)"