container-test-run-certificates
checks.aarch64-linux.certificates
· build #451
· raw
1Machine state will be reset. To keep it, pass --keep-machine-state2start all VLans3(finished: start all VLans, in 0.00 seconds)45Test will time out and terminate in 3600.0 seconds6run the VM test script7additionally exposed symbols:8 ca, client, server,9 vlan1,10 start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh11start all VMs12client: systemd-nspawn running (pid 54)13ca: systemd-nspawn running (pid 53)14server: systemd-nspawn running (pid 55)15client: Waiting for journal at /build/vm-state-client/var/log/journal...16server: Waiting for journal at /build/vm-state-server/var/log/journal...17ca: Waiting for journal at /build/vm-state-ca/var/log/journal...18(finished: start all VMs, in 0.00 seconds)19nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE20nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.21nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE22nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.23nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE24nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.25Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.26Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.27░ Spawning container client on /build/vm-state-client.28Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.29░ Spawning container ca on /build/vm-state-ca.30░ Spawning container server on /build/vm-state-server.31server # [6334107.972227] server systemd-journald[69]: Journal started32server # [6334107.972281] server systemd-journald[69]: Runtime Journal (/run/log/journal/aa649514f2cf435da6d2a208176a17ba) is 8M, max 2.5G, 2.4G free.33server # [6334107.973683] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.34server # [6334107.982043] server systemd[1]: Starting Flush Journal to Persistent Storage...35server # [6334107.983060] server systemd[1]: Starting Network Name Resolution...36server # [6334107.983675] server systemd[1]: Starting Create Static Device Nodes in /dev...37server # [6334107.992696] server systemd-journald[69]: Time spent on flushing to /var/log/journal/aa649514f2cf435da6d2a208176a17ba is 1.474ms for 6 entries.38server # [6334107.992696] server systemd-journald[69]: System Journal (/var/log/journal/aa649514f2cf435da6d2a208176a17ba) is 8M, max 4G, 3.9G free.39server # [6334107.998649] server systemd[1]: Finished Create Static Device Nodes in /dev.40server # [6334107.999291] server systemd[1]: Reached target Preparation for Local File Systems.41server # [6334107.999395] server systemd[1]: Reached target Local File Systems.42server # [6334108.000212] server systemd[1]: Listening on Boot Loader Control Service Socket.43server # [6334108.000254] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container44server # [6334108.001041] server systemd[1]: Starting Save Transient machine-id to Disk...45server # [6334108.001071] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys46server # [6334108.022195] server systemd[1]: Finished Flush Journal to Persistent Storage.47server # [6334108.023907] server systemd[1]: Starting Create System Files and Directories...48server # [6334108.039003] server systemd-tmpfiles[122]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted49server # [6334108.039182] server systemd-tmpfiles[122]: fchmod() of /var/log/journal failed: Operation not permitted50server # [6334108.039300] server systemd-tmpfiles[122]: fchmod() of /var/log/journal/aa649514f2cf435da6d2a208176a17ba failed: Operation not permitted51server # [6334108.039474] server systemd-tmpfiles[122]: fchmod() of /run/log/journal failed: Operation not permitted52server # [6334108.040736] server systemd[1]: Finished Create System Files and Directories.53server # [6334108.041813] server systemd[1]: Starting Rebuild Journal Catalog...54server # [6334108.042506] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...55server # [6334108.053735] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.56server # [6334108.060171] server systemd[1]: Finished Rebuild Journal Catalog.57server # [6334108.061136] server systemd[1]: Starting Update is Completed...58server # [6334108.071774] server systemd[1]: Finished Update is Completed.59server # [6334108.118649] server systemd[1]: Finished Firewall.60server # [6334108.118760] server systemd[1]: Reached target Preparation for Network.61server # [6334108.118971] server systemd[1]: Listening on Network Management Resolve Hook Socket.62server # [6334108.119939] server systemd[1]: Starting Network Management...63client # [6334107.971867] client systemd-journald[69]: Journal started64client # [6334107.971936] client systemd-journald[69]: Runtime Journal (/run/log/journal/b5450de641364331b4cc176738266903) is 8M, max 2.5G, 2.4G free.65client # [6334107.979645] client systemd[1]: Starting Flush Journal to Persistent Storage...66client # [6334107.980526] client systemd[1]: Starting Network Name Resolution...67client # [6334107.981287] client systemd[1]: Starting Create Static Device Nodes in /dev...68client # [6334107.990303] client systemd-journald[69]: Time spent on flushing to /var/log/journal/b5450de641364331b4cc176738266903 is 1.775ms for 5 entries.69client # [6334107.990303] client systemd-journald[69]: System Journal (/var/log/journal/b5450de641364331b4cc176738266903) is 8M, max 4G, 3.9G free.70client # [6334107.994132] client systemd[1]: Finished Create Static Device Nodes in /dev.71client # [6334107.994363] client systemd[1]: Reached target Preparation for Local File Systems.72client # [6334107.994450] client systemd[1]: Reached target Local File Systems.73client # [6334107.995168] client systemd[1]: Listening on Boot Loader Control Service Socket.74client # [6334107.995210] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container75client # [6334107.996076] client systemd[1]: Starting Save Transient machine-id to Disk...76client # [6334107.996111] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys77client # [6334108.022298] client systemd[1]: Finished Flush Journal to Persistent Storage.78client # [6334108.023885] client systemd[1]: Starting Create System Files and Directories...79client # [6334108.038010] client systemd-tmpfiles[126]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted80client # [6334108.038173] client systemd-tmpfiles[126]: fchmod() of /var/log/journal failed: Operation not permitted81client # [6334108.038280] client systemd-tmpfiles[126]: fchmod() of /var/log/journal/b5450de641364331b4cc176738266903 failed: Operation not permitted82client # [6334108.038439] client systemd-tmpfiles[126]: fchmod() of /run/log/journal failed: Operation not permitted83client # [6334108.040288] client systemd[1]: Finished Create System Files and Directories.84client # [6334108.041371] client systemd[1]: Starting Rebuild Journal Catalog...85client # [6334108.042160] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...86client # [6334108.054084] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.87ca # [6334107.971390] ca systemd-journald[78]: Journal started88client # [6334108.059970] client systemd[1]: Finished Rebuild Journal Catalog.89ca # [6334107.971444] ca systemd-journald[78]: Runtime Journal (/run/log/journal/1dfb6be1eaa447178d71f30ea0c1436f) is 8M, max 2.5G, 2.4G free.90client # [6334108.061075] client systemd[1]: Starting Update is Completed...91ca # [6334107.973624] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully.92client # [6334108.070693] client systemd[1]: Finished Update is Completed.93ca # [6334107.982032] ca systemd[1]: Starting Flush Journal to Persistent Storage...94client # [6334108.104166] client systemd[1]: Finished Firewall.95ca # [6334107.984153] ca systemd[1]: Starting Network Name Resolution...96client # [6334108.104321] client systemd[1]: Reached target Preparation for Network.97ca # [6334107.984785] ca systemd[1]: Starting Create Static Device Nodes in /dev...98client # [6334108.104527] client systemd[1]: Listening on Network Management Resolve Hook Socket.99ca # [6334107.990302] ca systemd-journald[78]: Time spent on flushing to /var/log/journal/1dfb6be1eaa447178d71f30ea0c1436f is 1.609ms for 6 entries.100client # [6334108.105576] client systemd[1]: Starting Network Management...101ca # [6334107.990302] ca systemd-journald[78]: System Journal (/var/log/journal/1dfb6be1eaa447178d71f30ea0c1436f) is 8M, max 4G, 3.9G free.102ca # [6334108.000075] ca systemd[1]: Finished Create Static Device Nodes in /dev.103ca # [6334108.000713] ca systemd[1]: Reached target Preparation for Local File Systems.104ca # [6334108.000825] ca systemd[1]: Reached target Local File Systems.105ca # [6334108.001623] ca systemd[1]: Listening on Boot Loader Control Service Socket.106ca # [6334108.001668] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container107ca # [6334108.002482] ca systemd[1]: Starting Save Transient machine-id to Disk...108ca # [6334108.002517] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys109ca # [6334108.021603] ca systemd[1]: Finished Flush Journal to Persistent Storage.110ca # [6334108.023240] ca systemd[1]: Starting Create System Files and Directories...111ca # [6334108.039573] ca systemd-tmpfiles[131]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted112ca # [6334108.039751] ca systemd-tmpfiles[131]: fchmod() of /var/log/journal failed: Operation not permitted113ca # [6334108.039866] ca systemd-tmpfiles[131]: fchmod() of /var/log/journal/1dfb6be1eaa447178d71f30ea0c1436f failed: Operation not permitted114ca # [6334108.040055] ca systemd-tmpfiles[131]: fchmod() of /run/log/journal failed: Operation not permitted115ca # [6334108.041524] ca systemd[1]: Finished Create System Files and Directories.116ca # [6334108.042550] ca systemd[1]: Starting Rebuild Journal Catalog...117ca # [6334108.043228] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...118ca # [6334108.054612] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.119ca # [6334108.062463] ca systemd[1]: Finished Rebuild Journal Catalog.120ca # [6334108.063481] ca systemd[1]: Starting Update is Completed...121ca # [6334108.072619] ca systemd[1]: Finished Update is Completed.122ca # [6334108.113428] ca systemd[1]: Finished Firewall.123ca # [6334108.113579] ca systemd[1]: Reached target Preparation for Network.124ca # [6334108.113784] ca systemd[1]: Listening on Network Management Resolve Hook Socket.125ca # [6334108.114772] ca systemd[1]: Starting Network Management...126client # [6334108.243225] client systemd[1]: Finished Save Transient machine-id to Disk.127server # [6334108.244254] server systemd[1]: Finished Save Transient machine-id to Disk.128ca # [6334108.243998] ca systemd[1]: Finished Save Transient machine-id to Disk.129client # [6334108.503494] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted130client # [6334108.503583] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted131client # [6334108.511499] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.132ca # [6334108.509555] ca systemd-networkd[195]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted133client # [6334108.511671] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.134ca # [6334108.509635] ca systemd-networkd[195]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted135client # [6334108.511826] client systemd-networkd[182]: lo: Link UP136ca # [6334108.517715] ca systemd-networkd[195]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.137client # [6334108.511830] client systemd-networkd[182]: lo: Gained carrier138ca # [6334108.517874] ca systemd-networkd[195]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.139client # [6334108.512037] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network.140ca # [6334108.518023] ca systemd-networkd[195]: lo: Link UP141client # [6334108.512417] client systemd[1]: Started Network Management.142ca # [6334108.518026] ca systemd-networkd[195]: lo: Gained carrier143client # [6334108.532482] client systemd-networkd[182]: eth1: Link UP144ca # [6334108.518197] ca systemd-networkd[195]: eth1: Configuring with /etc/systemd/network/40-eth1.network.145client # [6334108.532939] client systemd-networkd[182]: eth1: Gained carrier146ca # [6334108.518553] ca systemd[1]: Started Network Management.147client # [6334108.532950] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...148ca # [6334108.532898] ca systemd-networkd[195]: eth1: Link UP149client # [6334108.546675] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.150ca # [6334108.532980] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...151client # [6334108.666444] client systemd-resolved[94]: Positive Trust Anchors:152ca # [6334108.533395] ca systemd-networkd[195]: eth1: Gained carrier153client # [6334108.666457] client systemd-resolved[94]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d154ca # [6334108.569937] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.155client # [6334108.666460] client systemd-resolved[94]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16156ca # [6334108.659926] ca systemd-resolved[100]: Positive Trust Anchors:157client # [6334108.666495] client systemd-resolved[94]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test158ca # [6334108.659937] ca systemd-resolved[100]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d159client # [6334108.688611] client systemd-resolved[94]: Using system hostname 'client'.160ca # [6334108.659941] ca systemd-resolved[100]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16161client # [6334108.690041] client systemd[1]: Started Network Name Resolution.162ca # [6334108.659975] ca systemd-resolved[100]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test163client # [6334108.690166] client systemd[1]: Reached target Network.164ca # [6334108.682116] ca systemd-resolved[100]: Using system hostname 'ca'.165client # [6334108.690282] client systemd[1]: Reached target System Initialization.166ca # [6334108.683528] ca systemd[1]: Started Network Name Resolution.167server # [6334108.507897] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted168client # [6334108.690374] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container169server # [6334108.507981] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted170ca # [6334108.683657] ca systemd[1]: Reached target Network.171server # [6334108.516647] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.172client # [6334108.690424] client systemd[1]: Started Daily Cleanup of Temporary Directories.173server # [6334108.516810] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.174ca # [6334108.683763] ca systemd[1]: Reached target Network is Online.175server # [6334108.516962] server systemd-networkd[186]: lo: Link UP176client # [6334108.690458] client systemd[1]: Reached target Timer Units.177server # [6334108.516965] server systemd-networkd[186]: lo: Gained carrier178ca # [6334108.683858] ca systemd[1]: Reached target System Initialization.179server # [6334108.517125] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network.180client # [6334108.690684] client systemd[1]: Listening on D-Bus System Message Bus Socket.181server # [6334108.517575] server systemd[1]: Started Network Management.182ca # [6334108.684269] ca systemd[1]: Started Renew ACME Certificate for ca.foo.183server # [6334108.532828] server systemd-networkd[186]: eth1: Link UP184client # [6334108.690888] client systemd[1]: Listening on Nix Daemon Socket.185server # [6334108.533326] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...186ca # [6334108.684334] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container187server # [6334108.533382] server systemd-networkd[186]: eth1: Gained carrier188client # [6334108.691095] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.189server # [6334108.570239] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.190ca # [6334108.684383] ca systemd[1]: Started Daily Cleanup of Temporary Directories.191server # [6334108.675140] server systemd-resolved[91]: Positive Trust Anchors:192client # [6334108.691147] client systemd[1]: Reached target Socket Units.193server # [6334108.675150] server systemd-resolved[91]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d194ca # [6334108.684420] ca systemd[1]: Reached target Timer Units.195server # [6334108.675153] server systemd-resolved[91]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16196client # [6334108.691223] client systemd[1]: Reached target Basic System.197server # [6334108.675214] server systemd-resolved[91]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test198client # [6334108.705916] client systemd[1]: Starting Import lastlog data into lastlog2 database...199ca # [6334108.684654] ca systemd[1]: Listening on D-Bus System Message Bus Socket.200client # [6334108.707455] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...201ca # [6334108.684840] ca systemd[1]: Listening on Nix Daemon Socket.202client # [6334108.709786] client systemd[1]: Starting D-Bus System Message Bus...203ca # [6334108.685069] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.204client # [6334108.727687] client systemd[1]: Finished Import lastlog data into lastlog2 database.205ca # [6334108.685116] ca systemd[1]: Reached target Socket Units.206server # [6334108.698888] server systemd-resolved[91]: Using system hostname 'server'.207ca # [6334108.685193] ca systemd[1]: Reached target Basic System.208server # [6334108.700230] server systemd[1]: Started Network Name Resolution.209ca # [6334108.705691] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...210server # [6334108.700304] server systemd[1]: Reached target Network.211ca # [6334108.707229] ca systemd[1]: Starting Import lastlog data into lastlog2 database...212server # [6334108.700358] server systemd[1]: Reached target Network is Online.213ca # [6334108.707312] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem214server # [6334108.700399] server systemd[1]: Reached target System Initialization.215ca # [6334108.708885] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...216server # [6334108.700604] server systemd[1]: Started Renew ACME Certificate for test.foo.217ca # [6334108.710564] ca systemd[1]: Starting step-ca service...218server # [6334108.700643] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container219ca # [6334108.712772] ca systemd[1]: Starting D-Bus System Message Bus...220server # [6334108.700667] server systemd[1]: Started Daily Cleanup of Temporary Directories.221ca # [6334108.728208] ca systemd[1]: Finished Import lastlog data into lastlog2 database.222server # [6334108.700684] server systemd[1]: Reached target Timer Units.223server # [6334108.700803] server systemd[1]: Listening on D-Bus System Message Bus Socket.224server # [6334108.700899] server systemd[1]: Listening on Nix Daemon Socket.225server # [6334108.700993] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.226server # [6334108.701018] server systemd[1]: Reached target Socket Units.227server # [6334108.701051] server systemd[1]: Reached target Basic System.228server # [6334108.705249] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...229server # [6334108.706273] server systemd[1]: Starting Import lastlog data into lastlog2 database...230server # [6334108.706312] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem231server # [6334108.707066] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...232server # [6334108.708318] server systemd[1]: Starting D-Bus System Message Bus...233server # [6334108.728510] server systemd[1]: Finished Import lastlog data into lastlog2 database.234server # [6334108.822606] server acme-setup-privileged[192]: + set -euo pipefail235server # [6334108.822606] server acme-setup-privileged[192]: + cd /var/lib/acme236server # [6334108.822606] server acme-setup-privileged[192]: + chmod -R u=rwX,g=,o= .lego/accounts237server # [6334108.824491] server acme-setup-privileged[192]: + chown -R acme .lego/accounts238server # [6334108.826129] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo239server # [6334108.826187] server acme-setup-privileged[192]: + '[' -d test.foo ']'240server # [6334108.826187] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo241server # [6334108.826187] server acme-setup-privileged[192]: + '[' -d .lego/test.foo ']'242server # [6334108.848136] server nsncd[194]: Aug 21 06:52:14.901 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"243server # [6334108.860691] server systemd[1]: Started Name Service Cache Daemon (nsncd).244server # [6334108.860847] server systemd[1]: Reached target Host and Network Name Lookups.245server # [6334108.860911] server systemd[1]: Reached target User and Group Name Lookups.246server # [6334108.862196] server systemd[1]: Starting User Login Management...247server # [6334108.863059] server systemd[1]: Starting Permit User Sessions...248server # [6334108.874773] server systemd[1]: Finished Permit User Sessions.249server # [6334108.876613] server systemd[1]: Started Console Getty.250server # [6334108.876690] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0251server # [6334108.876733] server systemd[1]: Reached target Login Prompts.252server # [6334108.953743] server dbus-broker-launch[195]: Looking up NSS user entry for 'systemd-timesync'...253server # [6334108.963503] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.254server # [6334108.964935] server dbus-broker-launch[195]: NSS returned no entry for 'systemd-timesync'255server # [6334108.964935] server dbus-broker-launch[195]: Invalid user-name in /nix/store/3mkgnlb89jy49c4a1z0swjahhcvmnw8p-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"256server # [6334108.965375] server systemd[1]: Started D-Bus System Message Bus.257server # [6334108.973730] server dbus-broker-launch[195]: Ready258ca # [6334108.824737] ca acme-setup-privileged[201]: + set -euo pipefail259ca # [6334108.824737] ca acme-setup-privileged[201]: + cd /var/lib/acme260ca # [6334108.824737] ca acme-setup-privileged[201]: + chmod -R u=rwX,g=,o= .lego/accounts261ca # [6334108.826193] ca acme-setup-privileged[201]: + chown -R acme .lego/accounts262ca # [6334108.828178] ca acme-setup-privileged[201]: + for fixpath in ca.foo .lego/ca.foo263ca # [6334108.828223] ca acme-setup-privileged[201]: + '[' -d ca.foo ']'264ca # [6334108.828223] ca acme-setup-privileged[201]: + for fixpath in ca.foo .lego/ca.foo265ca # [6334108.828223] ca acme-setup-privileged[201]: + '[' -d .lego/ca.foo ']'266ca # [6334108.879542] ca nsncd[203]: Aug 21 06:52:14.932 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"267ca # [6334108.879622] ca systemd[1]: Started Name Service Cache Daemon (nsncd).268ca # [6334108.879692] ca systemd[1]: Reached target Host and Network Name Lookups.269ca # [6334108.879762] ca systemd[1]: Reached target User and Group Name Lookups.270ca # [6334108.881032] ca systemd[1]: Starting User Login Management...271client # [6334108.863640] client systemd[1]: Started Name Service Cache Daemon (nsncd).272client # [6334108.864186] client nsncd[189]: Aug 21 06:52:14.916 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"273client # [6334108.863756] client systemd[1]: Reached target Host and Network Name Lookups.274client # [6334108.863866] client systemd[1]: Reached target User and Group Name Lookups.275client # [6334108.865968] client systemd[1]: Starting User Login Management...276client # [6334108.867432] client systemd[1]: Starting Permit User Sessions...277ca # [6334108.881929] ca systemd[1]: Starting Permit User Sessions...278client # [6334108.879358] client systemd[1]: Finished Permit User Sessions.279ca # [6334108.892250] ca systemd[1]: Finished Permit User Sessions.280client # [6334108.881001] client systemd[1]: Started Console Getty.281ca # [6334108.893782] ca systemd[1]: Started Console Getty.282client # [6334108.881057] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0283ca # [6334108.893832] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0284client # [6334108.881079] client systemd[1]: Reached target Login Prompts.285ca # [6334108.893849] ca systemd[1]: Reached target Login Prompts.286client # [6334108.966123] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.287ca # [6334108.960959] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.288client # [6334108.972411] client dbus-broker-launch[190]: Looking up NSS user entry for 'systemd-timesync'...289ca # [6334108.978006] ca dbus-broker-launch[206]: Looking up NSS user entry for 'systemd-timesync'...290client # [6334108.973784] client dbus-broker-launch[190]: NSS returned no entry for 'systemd-timesync'291ca # [6334108.979046] ca dbus-broker-launch[206]: NSS returned no entry for 'systemd-timesync'292client # [6334108.973784] client dbus-broker-launch[190]: Invalid user-name in /nix/store/71vmh4xl6s5dgp2wq5sm5rdd4lr016c0-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"293ca # [6334108.979093] ca dbus-broker-launch[206]: Invalid user-name in /nix/store/bz7ygr15ilclf6krkxd1w5j7l4dw4kny-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"294client # [6334108.974531] client systemd[1]: Started D-Bus System Message Bus.295ca # [6334108.979529] ca systemd[1]: Started D-Bus System Message Bus.296client # [6334108.982209] client dbus-broker-launch[190]: Ready297ca # [6334108.986327] ca dbus-broker-launch[206]: Ready298ca # [6334109.357157] ca systemd-logind[235]: New seat seat0.299ca # [6334109.357415] ca systemd[1]: Started User Login Management.300ca # [6334109.359576] ca systemd[1]: Starting linger-users.service...301ca # [6334109.398276] ca systemd[1]: linger-users.service: Deactivated successfully.302ca # [6334109.398425] ca systemd[1]: Finished linger-users.service.303ca # [6334109.413118] ca acme-setup-start[219]: + set -euo pipefail304ca # [6334109.413344] ca acme-setup-start[219]: + test -e ca/key.pem305ca # [6334109.413344] ca acme-setup-start[219]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local306ca # [6334109.438968] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.307ca # [6334109.440652] ca systemd[1]: Starting Ensure certificate for ca.foo...308ca # [6334109.603547] ca step-ca[204]: badger 2026/08/21 06:52:15 INFO: All 0 tables opened in 0s309ca # [6334109.607935] ca step-ca[204]: 2026/08/21 06:52:15 Building new tls configuration using step-ca x509 Signer Interface310client # [6334109.369401] client systemd-logind[205]: New seat seat0.311client # [6334109.369571] client systemd[1]: Started User Login Management.312client # [6334109.388687] client systemd[1]: Starting linger-users.service...313client # [6334109.402237] client systemd[1]: linger-users.service: Deactivated successfully.314client # [6334109.402346] client systemd[1]: Finished linger-users.service.315client # [6334109.403513] client systemd[1]: Reached target Multi-User System.316client # [6334109.403760] client systemd[1]: Startup finished in 1.829s.317server # [6334109.365166] server systemd-logind[219]: New seat seat0.318server # [6334109.365316] server systemd[1]: Started User Login Management.319server # [6334109.388482] server systemd[1]: Starting linger-users.service...320server # [6334109.401996] server systemd[1]: linger-users.service: Deactivated successfully.321server # [6334109.402209] server systemd[1]: Finished linger-users.service.322server # [6334109.402662] server acme-setup-start[208]: + set -euo pipefail323server # [6334109.402941] server acme-setup-start[208]: + test -e ca/key.pem324server # [6334109.402941] server acme-setup-start[208]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local325server # [6334109.421461] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.326server # [6334109.423999] server systemd[1]: Starting Ensure certificate for test.foo...327ca # [6334109.615702] ca step-ca[204]: 2026/08/21 06:52:15 Starting Smallstep CA/0.30.2 (linux/arm64)328ca # [6334109.615702] ca step-ca[204]: 2026/08/21 06:52:15 Documentation: https://u.step.sm/docs/ca329ca # [6334109.615702] ca step-ca[204]: 2026/08/21 06:52:15 Community Discord: https://u.step.sm/discord330ca # [6334109.615702] ca step-ca[204]: 2026/08/21 06:52:15 Config file: /etc/smallstep/ca.json331ca # [6334109.615702] ca step-ca[204]: 2026/08/21 06:52:15 The primary server URL is https://ca.foo:1443332ca # [6334109.615966] ca step-ca[204]: 2026/08/21 06:52:15 Root certificates are available at https://ca.foo:1443/roots.pem333ca # [6334109.615966] ca step-ca[204]: 2026/08/21 06:52:15 X.509 Root Fingerprint: 1a7ad12f92f4a81d1038b71212f5a044a8d7b0fb93aa69f507b3d4033bfed054334ca # [6334109.616394] ca systemd[1]: Started step-ca service.335ca # [6334109.616695] ca step-ca[204]: 2026/08/21 06:52:15 Serving HTTPS on 0.0.0.0:1443 ...336server # [6334109.764451] server systemd-networkd[186]: eth1: Gained IPv6LL337server # [6334109.903573] server acme-test.foo-start[245]: Waiting to acquire lock in /run/acme/338server # [6334109.906532] server acme-test.foo-start[245]: + '[' -e out/acme-success ']'339server # [6334109.906628] server acme-test.foo-start[245]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=340server # [6334109.921473] server acme-test.foo-start[255]: + cd test.foo341server # [6334109.922026] server acme-test.foo-start[255]: + cp -vp cert.pem ../out/cert.pem342server # [6334109.923082] server acme-test.foo-start[256]: 'cert.pem' -> '../out/cert.pem'343server # [6334109.923426] server acme-test.foo-start[255]: + cp -vp key.pem ../out/key.pem344server # [6334109.924572] server acme-test.foo-start[255]: 'key.pem' -> '../out/key.pem'345server # [6334109.924815] server acme-test.foo-start[245]: + cat out/cert.pem ca/cert.pem346server # [6334109.926250] server acme-test.foo-start[245]: + cp ca/cert.pem out/chain.pem347server # [6334109.927632] server acme-test.foo-start[245]: + cat out/key.pem out/fullchain.pem348server # [6334109.929505] server acme-test.foo-start[245]: + for fixpath in out certificates349server # [6334109.929505] server acme-test.foo-start[245]: + '[' -d out ']'350server # [6334109.929621] server acme-test.foo-start[245]: + chmod -R u=rwX,g=rX,o= out351server # [6334109.930942] server acme-test.foo-start[245]: + chown -R acme:nginx out352server # [6334109.934918] server acme-test.foo-start[245]: + for fixpath in out certificates353server # [6334109.934918] server acme-test.foo-start[245]: + '[' -d certificates ']'354server # [6334109.940260] server systemd[1]: Finished Ensure certificate for test.foo.355server # [6334109.942014] server systemd[1]: Starting Nginx Web Server...356ca: must succeed: systemctl restart acme-order-renew-ca.foo.service 357client # [6334109.920287] client systemd-networkd[182]: eth1: Gained IPv6LL358ca # [6334109.913807] ca acme-ca.foo-start[256]: Waiting to acquire lock in /run/acme/359ca # [6334109.916845] ca acme-ca.foo-start[256]: + '[' -e out/acme-success ']'360ca # [6334109.916845] ca acme-ca.foo-start[256]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=361ca # [6334109.931569] ca acme-ca.foo-start[292]: + cd ca.foo362ca # [6334109.932018] ca acme-ca.foo-start[292]: + cp -vp cert.pem ../out/cert.pem363ca # [6334109.933320] ca acme-ca.foo-start[293]: 'cert.pem' -> '../out/cert.pem'364ca # [6334109.933558] ca acme-ca.foo-start[292]: + cp -vp key.pem ../out/key.pem365ca # [6334109.934906] ca acme-ca.foo-start[292]: 'key.pem' -> '../out/key.pem'366ca # [6334109.935231] ca acme-ca.foo-start[256]: + cat out/cert.pem ca/cert.pem367ca # [6334109.937386] ca acme-ca.foo-start[256]: + cp ca/cert.pem out/chain.pem368ca # [6334109.939441] ca acme-ca.foo-start[256]: + cat out/key.pem out/fullchain.pem369ca # [6334109.941226] ca acme-ca.foo-start[256]: + for fixpath in out certificates370ca # [6334109.941268] ca acme-ca.foo-start[256]: + '[' -d out ']'371ca # [6334109.941268] ca acme-ca.foo-start[256]: + chmod -R u=rwX,g=rX,o= out372ca # [6334109.942615] ca acme-ca.foo-start[256]: + chown -R acme:nginx out373ca # [6334109.946233] ca acme-ca.foo-start[256]: + for fixpath in out certificates374ca # [6334109.946233] ca acme-ca.foo-start[256]: + '[' -d certificates ']'375ca # [6334109.949963] ca systemd[1]: Finished Ensure certificate for ca.foo.376ca # [6334109.952443] ca systemd[1]: Starting Nginx Web Server...377ca # [6334110.240238] ca systemd-networkd[195]: eth1: Gained IPv6LL378ca # [6334110.442150] ca nginx-pre-start[304]: nginx: the configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf syntax is ok379ca # [6334110.442555] ca nginx-pre-start[304]: nginx: configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf test is successful380ca # [6334110.448210] ca systemd[1]: Started Nginx Web Server.381ca # [6334110.448620] ca systemd[1]: Reached target Multi-User System.382ca # [6334110.449756] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...383server # [6334110.441988] server nginx-pre-start[267]: nginx: the configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf syntax is ok384server # [6334110.442400] server nginx-pre-start[267]: nginx: configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf test is successful385server # [6334110.448465] server systemd[1]: Started Nginx Web Server.386server # [6334110.448999] server systemd[1]: Reached target Multi-User System.387server # [6334110.450632] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...388ca # [6334110.996210] ca acme-order-renew-ca.foo-start[307]: Waiting to acquire lock in /run/acme/389ca # [6334110.999129] ca acme-order-renew-ca.foo-start[307]: + set -euo pipefail390ca # [6334110.999203] ca acme-order-renew-ca.foo-start[307]: + echo 88dc4fc401a6091a1bd9391ca # [6334110.999320] ca acme-order-renew-ca.foo-start[307]: + cmp -s domainhash.txt certificates/domainhash.txt392ca # [6334111.000413] ca acme-order-renew-ca.foo-start[307]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run393ca # [6334111.029068] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 No key found for account none@none.tld. Generating a P256 key.394ca # [6334111.029403] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key395ca # [6334111.058771] ca step-ca[204]: time="2026-08-21T06:52:17Z" level=info duration="103.522µs" duration-ns=103522 fields.time="2026-08-21T06:52:17Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=9c8bb88a-d170-4c2d-a14d-423eaa595fc4 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=396ca # [6334111.059231] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] acme: Registering account for none@none.tld397ca # [6334111.063778] ca step-ca[204]: time="2026-08-21T06:52:17Z" level=info duration=4.381901ms duration-ns=4381901 fields.time="2026-08-21T06:52:17Z" method=HEAD name=ca nonce=MkEwNE51ZDFReUZ4NFRhZ3NyUlg5MEl3dnVBaDVPSzg path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=01a5c44b-bb61-4d09-91bb-79fcc9888213 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=398ca # [6334111.066177] ca step-ca[204]: time="2026-08-21T06:52:17Z" level=info duration=1.734144ms duration-ns=1734144 fields.time="2026-08-21T06:52:17Z" method=POST name=ca nonce=dGtDZjZlTTlGV0VoZUFPa0s0U0dSVlo1em5WRE5nQ0Y path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=819537b7-2593-4e94-811a-b0b95d9456c0 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/GZHSfNdybUqZ5a8lOVeSqijt88oA5KYY/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=399ca # [6334111.066683] ca acme-order-renew-ca.foo-start[318]: !!!! HEADS UP !!!!400ca # [6334111.066683] ca acme-order-renew-ca.foo-start[318]: Your account credentials have been saved in your401ca # [6334111.066683] ca acme-order-renew-ca.foo-start[318]: configuration directory at "accounts".402ca # [6334111.066683] ca acme-order-renew-ca.foo-start[318]: You should make a secure backup of this folder now. This403ca # [6334111.066683] ca acme-order-renew-ca.foo-start[318]: configuration directory will also contain private keys404ca # [6334111.066683] ca acme-order-renew-ca.foo-start[318]: generated by lego and certificates obtained from the ACME405ca # [6334111.066683] ca acme-order-renew-ca.foo-start[318]: server. Making regular backups of this folder is ideal.406ca # [6334111.066850] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate407ca # [6334111.070289] ca step-ca[204]: time="2026-08-21T06:52:17Z" level=info duration=2.93ms duration-ns=2930000 fields.time="2026-08-21T06:52:17Z" method=POST name=ca nonce=enQ2cngzUlVkVlhuYlBjbzZVQjRuWXBrODRLdjA4Zzk path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=63ce572e-4921-4182-8e29-9bcb32038492 response="{\"id\":\"AXwnZy43jnJTz9LEXaDSNfVkdPVwqUCf\",\"status\":\"pending\",\"expires\":\"2026-08-22T06:52:17Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-21T06:51:17Z\",\"notAfter\":\"2026-11-19T06:52:17Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/AXwnZy43jnJTz9LEXaDSNfVkdPVwqUCf/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=408ca # [6334111.131716] ca step-ca[204]: time="2026-08-21T06:52:17Z" level=info duration=4.526783ms duration-ns=4526783 fields.time="2026-08-21T06:52:17Z" method=POST name=ca nonce=cmtzZjZDcjY0aFJWRXhselFGa29jNXlQblhPSGxNbFU path=/acme/acme/authz/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b199a137-f85e-47fa-9b2a-82f282cd7d1c response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"9TDMuI7CKkkeWoQCoRd697SgBZQbSAt1\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP/alAbecbT4fVEqghp1sELrC9dh1oL73kh\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"9TDMuI7CKkkeWoQCoRd697SgBZQbSAt1\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP/Jrk9SFxEYCKioQBDyTkfEmGRXYXcfzxT\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"9TDMuI7CKkkeWoQCoRd697SgBZQbSAt1\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP/ylrrjv9KmrXmv7SF7runJ9t4XJByUIP0\"}],\"wildcard\":false,\"expires\":\"2026-08-22T06:52:17Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=409ca # [6334111.132102] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP410ca # [6334111.132102] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01411ca # [6334111.132102] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] [ca.foo] acme: use http-01 solver412ca # [6334111.132102] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] [ca.foo] acme: Trying to solve HTTP-01413ca # [6334111.136057] ca step-ca[204]: time="2026-08-21T06:52:17Z" level=info duration=3.507929ms duration-ns=3507929 fields.time="2026-08-21T06:52:17Z" method=POST name=ca nonce=STltRlhCRGUzSHdKVlRSZUY0UTI3b1lWRnUxMVE1N1g path=/acme/acme/challenge/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP/Jrk9SFxEYCKioQBDyTkfEmGRXYXcfzxT protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=32e7d03f-ff3d-4b5e-823f-2b0769d2c371 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"9TDMuI7CKkkeWoQCoRd697SgBZQbSAt1\",\"validated\":\"2026-08-21T06:52:17Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP/Jrk9SFxEYCKioQBDyTkfEmGRXYXcfzxT\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=414ca # [6334111.136273] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] [ca.foo] The server validated our request415ca # [6334111.136338] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates416ca # [6334111.145049] ca step-ca[204]: time="2026-08-21T06:52:17Z" level=info duration=7.979111ms duration-ns=7979111 fields.time="2026-08-21T06:52:17Z" method=POST name=ca nonce=MGkyQ3hiQzNiVFZxdnJDakRvRjQweE1Kd1hVMkR3d1A path=/acme/acme/order/AXwnZy43jnJTz9LEXaDSNfVkdPVwqUCf/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=5d82e61b-e6cb-45a9-93a1-dd43be5b47e4 response="{\"id\":\"AXwnZy43jnJTz9LEXaDSNfVkdPVwqUCf\",\"status\":\"valid\",\"expires\":\"2026-08-22T06:52:17Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-21T06:51:17Z\",\"notAfter\":\"2026-11-19T06:52:17Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/InWDfe6AR8j0b2Gz9bRRTpzzSO1XMiXP\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/AXwnZy43jnJTz9LEXaDSNfVkdPVwqUCf/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/Wjr8AJkVVjVIhJsrvqqKUzuhdto0Vf0D\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=417ca # [6334111.146862] ca step-ca[204]: time="2026-08-21T06:52:17Z" level=info certificate=MIIB0zCCAXqgAwIBAgIRALtw9Hlab3+xBqeKKSFhmBQwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODIxMDY1MTE3WhcNMjYxMTE5MDY1MjE3WjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ67LdM1kVYWCmdY2UsQ/VufDuU+oPmGwDqVUfKamZaaJyJ8UzitleHbSsn2As4P1S3MWW4A31Ht9u4S+5I/54lo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFPq0tmYr+wLx3MZmFak03/SRLi/aMB8GA1UdIwQYMBaAFKRym5lMRsWP2nBvfx8dseFDn8uXMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDRwAwRAIgX4Swy4SzZYA9qgGhy2GsIRibZ3ciAS+DVy/nnI+BQxcCIFw3lkT5VGDDUjQUN7iDZfTRzMnhwLTq5VApT9CFFV6a duration=1.200576ms duration-ns=1200576 fields.time="2026-08-21T06:52:17Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=QXhlUGtDQ3FsVlpmaE9kTEJzV0l6SW9xckFzQkpDSng path=/acme/acme/certificate/Wjr8AJkVVjVIhJsrvqqKUzuhdto0Vf0D protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=b1996c22-c3de-45d5-95b8-a2a7ae299875 sans="map[dns:[ca.foo]]" serial=249152130982474568816970437119180904468 size=1340 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-08-21T06:51:17Z" valid-to="2026-11-19T06:52:17Z"418ca # [6334111.147161] ca acme-order-renew-ca.foo-start[318]: 2026/08/21 06:52:17 [INFO] [ca.foo] Server responded with a certificate.419ca # [6334111.152587] ca acme-order-renew-ca.foo-start[307]: + mv domainhash.txt certificates/420ca # [6334111.154530] ca acme-order-renew-ca.foo-start[307]: + touch out/acme-success421ca # [6334111.156128] ca acme-order-renew-ca.foo-start[307]: + cmp -s certificates/ca.foo.crt out/fullchain.pem422ca # [6334111.157177] ca acme-order-renew-ca.foo-start[307]: + touch out/renewed423ca # [6334111.158667] ca acme-order-renew-ca.foo-start[307]: + echo Installing new certificate424ca # [6334111.158667] ca acme-order-renew-ca.foo-start[307]: Installing new certificate425ca # [6334111.158725] ca acme-order-renew-ca.foo-start[307]: + cp -vp certificates/ca.foo.crt out/fullchain.pem426ca # [6334111.160202] ca acme-order-renew-ca.foo-start[350]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'427ca # [6334111.160451] ca acme-order-renew-ca.foo-start[307]: + cp -vp certificates/ca.foo.key out/key.pem428ca # [6334111.161765] ca acme-order-renew-ca.foo-start[351]: 'certificates/ca.foo.key' -> 'out/key.pem'429ca # [6334111.161972] ca acme-order-renew-ca.foo-start[307]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem430ca # [6334111.163277] ca acme-order-renew-ca.foo-start[352]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'431ca # [6334111.163479] ca acme-order-renew-ca.foo-start[307]: + ln -sf fullchain.pem out/cert.pem432ca # [6334111.165260] ca acme-order-renew-ca.foo-start[307]: + cat out/key.pem out/fullchain.pem433ca # [6334111.166882] ca acme-order-renew-ca.foo-start[307]: + for fixpath in out certificates434ca # [6334111.166917] ca acme-order-renew-ca.foo-start[307]: + '[' -d out ']'435ca # [6334111.166917] ca acme-order-renew-ca.foo-start[307]: + chmod -R u=rwX,g=rX,o= out436ca # [6334111.168924] ca acme-order-renew-ca.foo-start[307]: + chown -R acme:nginx out437ca # [6334111.171501] ca acme-order-renew-ca.foo-start[307]: + for fixpath in out certificates438ca # [6334111.171531] ca acme-order-renew-ca.foo-start[307]: + '[' -d certificates ']'439ca # [6334111.171531] ca acme-order-renew-ca.foo-start[307]: + chmod -R u=rwX,g=rX,o= certificates440ca # [6334111.173191] ca acme-order-renew-ca.foo-start[307]: + chown -R acme:nginx certificates441ca # [6334111.175935] ca acme-order-renew-ca.foo-start[307]: + chmod -R u=rwX,g=,o= accounts/.442server # [6334111.030445] server acme-order-renew-test.foo-start[270]: Waiting to acquire lock in /run/acme/443server # [6334111.033353] server acme-order-renew-test.foo-start[270]: + set -euo pipefail444server # [6334111.033434] server acme-order-renew-test.foo-start[270]: + echo ad12aa6741ce4bd2c108445server # [6334111.033543] server acme-order-renew-test.foo-start[270]: + cmp -s domainhash.txt certificates/domainhash.txt446server # [6334111.034796] server acme-order-renew-test.foo-start[270]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run447server # [6334111.049124] server acme-order-renew-test.foo-start[282]: 2026/08/21 06:52:17 No key found for account none@none.tld. Generating a P256 key.448server # [6334111.049705] server acme-order-renew-test.foo-start[282]: 2026/08/21 06:52:17 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key449server # [6334111.083804] server acme-order-renew-test.foo-start[282]: 2026/08/21 06:52:17 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority450server # [6334111.084389] server acme-order-renew-test.foo-start[270]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.451server # [6334111.084389] server acme-order-renew-test.foo-start[270]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.452server # [6334111.084389] server acme-order-renew-test.foo-start[270]: + exit 10453server # [6334111.087439] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a454server # [6334111.087530] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'.455server # [6334111.104319] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo.456server # [6334111.104702] server systemd[1]: Startup finished in 3.523s.457ca # [6334111.317705] ca systemd[1]: Reloading Nginx Web Server...458ca # [6334111.321607] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.459ca # [6334111.321792] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.460ca # [6334111.844204] ca nginx[368]: nginx: the configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf syntax is ok461ca # [6334111.844495] ca nginx[368]: nginx: configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf test is successful462ca # [6334112.325834] ca systemd[1]: Reloaded Nginx Web Server.463ca # [6334112.326352] ca systemd[1]: Startup finished in 4.748s.464ca # [6334112.799466] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...465ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 3.44 seconds)466ca # [6334113.333753] ca acme-order-renew-ca.foo-start[383]: Waiting to acquire lock in /run/acme/467ca # [6334113.336143] ca acme-order-renew-ca.foo-start[383]: + set -euo pipefail468ca # [6334113.336203] ca acme-order-renew-ca.foo-start[383]: + echo 88dc4fc401a6091a1bd9469ca # [6334113.336298] ca acme-order-renew-ca.foo-start[383]: + cmp -s domainhash.txt certificates/domainhash.txt470ca # [6334113.337284] ca acme-order-renew-ca.foo-start[383]: + '[' -e certificates/ca.foo.key ']'471ca # [6334113.337284] ca acme-order-renew-ca.foo-start[383]: + '[' -e certificates/ca.foo.crt ']'472ca # [6334113.337644] ca acme-order-renew-ca.foo-start[391]: ++ find accounts -name none@none.tld.key473ca # [6334113.339716] ca acme-order-renew-ca.foo-start[383]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']'474ca # [6334113.339752] ca acme-order-renew-ca.foo-start[383]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic475ca # [6334113.379090] ca step-ca[204]: time="2026-08-21T06:52:19Z" level=info duration="67.361µs" duration-ns=67361 fields.time="2026-08-21T06:52:19Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=12ce56fd-40c6-48ba-b7c6-4e2cb31870d9 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=476ca # [6334113.379588] ca acme-order-renew-ca.foo-start[392]: 2026/08/21 06:52:19 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint477ca # [6334113.379819] ca acme-order-renew-ca.foo-start[392]: 2026/08/21 06:52:19 [INFO] [ca.foo] The certificate expires at 2026-11-19T06:52:17Z, the renewal can be performed in 1439h59m37.567233278s: no renewal.478ca # [6334113.380098] ca acme-order-renew-ca.foo-start[383]: + mv domainhash.txt certificates/479ca # [6334113.381665] ca acme-order-renew-ca.foo-start[383]: + touch out/acme-success480ca # [6334113.383284] ca acme-order-renew-ca.foo-start[383]: + cmp -s certificates/ca.foo.crt out/fullchain.pem481ca # [6334113.384459] ca acme-order-renew-ca.foo-start[383]: + for fixpath in out certificates482ca # [6334113.384483] ca acme-order-renew-ca.foo-start[383]: + '[' -d out ']'483ca # [6334113.384483] ca acme-order-renew-ca.foo-start[383]: + chmod -R u=rwX,g=rX,o= out484ca # [6334113.385858] ca acme-order-renew-ca.foo-start[383]: + chown -R acme:nginx out485ca # [6334113.388753] ca acme-order-renew-ca.foo-start[383]: + for fixpath in out certificates486ca # [6334113.388778] ca acme-order-renew-ca.foo-start[383]: + '[' -d certificates ']'487ca # [6334113.388778] ca acme-order-renew-ca.foo-start[383]: + chmod -R u=rwX,g=rX,o= certificates488ca # [6334113.390105] ca acme-order-renew-ca.foo-start[383]: + chown -R acme:nginx certificates489ca # [6334113.392491] ca acme-order-renew-ca.foo-start[383]: + chmod -R u=rwX,g=,o= accounts/.490ca # [6334113.531834] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.491ca # [6334113.564256] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.492server: must succeed: systemctl restart acme-test.foo.service493server # [6334116.595147] server systemd[1]: acme-test.foo.service: Deactivated successfully.494server # [6334116.595519] server systemd[1]: Stopped Ensure certificate for test.foo.495server # [6334116.596781] server systemd[1]: Stopping Ensure certificate for test.foo...496server # [6334116.599075] server systemd[1]: Starting Ensure certificate for test.foo...497server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.57 seconds)498client: waiting for success: curl -v https://test.foo499* Host test.foo:443 was resolved.500* IPv6: 2001:db8:1::3501* IPv4: 192.168.1.3502* Trying [2001:db8:1::3]:443...503* ALPN: curl offers h2,http/1.1504} [5 bytes data]505* TLSv1.3 (OUT), TLS handshake, Client hello (1):506} [1552 bytes data]507* SSL Trust Anchors:508* OpenSSL default paths (fallback)509{ [5 bytes data]510* TLSv1.3 (IN), TLS handshake, Server hello (2):511{ [1210 bytes data]512* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):513{ [1 bytes data]514* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):515{ [19 bytes data]516* TLSv1.3 (IN), TLS handshake, Certificate (11):517{ [1009 bytes data]518* TLSv1.3 (IN), TLS handshake, CERT verify (15):519{ [111 bytes data]520* TLSv1.3 (IN), TLS handshake, Finished (20):521{ [52 bytes data]522* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):523} [1 bytes data]524* TLSv1.3 (OUT), TLS handshake, Finished (20):525} [52 bytes data]526* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey527* ALPN: server accepted h2528* Server certificate:529* subject: CN=test.foo530* start date: Aug 21 06:52:15 2026 GMT531* expire date: Sep 20 06:52:15 2028 GMT532* issuer: CN=minica root ca 0e0d4c533* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384534* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384535* subjectAltName: "test.foo" matches cert's "test.foo"536* OpenSSL verify result: 13537* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)538* closing connection #0539curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)540More details here: https://curl.se/docs/sslcerts.html541542curl failed to verify the legitimacy of the server and therefore could not543establish a secure connection to it. To learn more about this situation and544how to fix it, please visit the webpage mentioned above.545server # [6334117.108270] server acme-test.foo-start[315]: Waiting to acquire lock in /run/acme/546server # [6334117.111642] server acme-test.foo-start[315]: + '[' -e out/acme-success ']'547server # [6334117.111642] server acme-test.foo-start[315]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=548server # [6334117.126825] server acme-test.foo-start[325]: + cd test.foo549server # [6334117.127253] server acme-test.foo-start[325]: + cp -vp cert.pem ../out/cert.pem550server # [6334117.128468] server acme-test.foo-start[326]: 'cert.pem' -> '../out/cert.pem'551server # [6334117.128791] server acme-test.foo-start[325]: + cp -vp key.pem ../out/key.pem552server # [6334117.130045] server acme-test.foo-start[325]: 'key.pem' -> '../out/key.pem'553server # [6334117.130286] server acme-test.foo-start[315]: + cat out/cert.pem ca/cert.pem554server # [6334117.132122] server acme-test.foo-start[315]: + cp ca/cert.pem out/chain.pem555server # [6334117.134035] server acme-test.foo-start[315]: + cat out/key.pem out/fullchain.pem556server # [6334117.135650] server acme-test.foo-start[315]: + for fixpath in out certificates557server # [6334117.135650] server acme-test.foo-start[315]: + '[' -d out ']'558server # [6334117.135743] server acme-test.foo-start[315]: + chmod -R u=rwX,g=rX,o= out559server # [6334117.137316] server acme-test.foo-start[315]: + chown -R acme:nginx out560server # [6334117.140358] server acme-test.foo-start[315]: + for fixpath in out certificates561server # [6334117.140358] server acme-test.foo-start[315]: + '[' -d certificates ']'562server # [6334117.143470] server systemd[1]: Finished Ensure certificate for test.foo.563server # [6334117.145835] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...564server # [6334117.679510] server acme-order-renew-test.foo-start[333]: Waiting to acquire lock in /run/acme/565server # [6334117.682465] server acme-order-renew-test.foo-start[333]: + set -euo pipefail566server # [6334117.682538] server acme-order-renew-test.foo-start[333]: + echo ad12aa6741ce4bd2c108567server # [6334117.682656] server acme-order-renew-test.foo-start[333]: + cmp -s domainhash.txt certificates/domainhash.txt568server # [6334117.683960] server acme-order-renew-test.foo-start[333]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run569server # [6334117.732154] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] acme: Registering account for none@none.tld570server # [6334117.775558] server acme-order-renew-test.foo-start[341]: !!!! HEADS UP !!!!571server # [6334117.775558] server acme-order-renew-test.foo-start[341]: Your account credentials have been saved in your572server # [6334117.775558] server acme-order-renew-test.foo-start[341]: configuration directory at "accounts".573server # [6334117.775558] server acme-order-renew-test.foo-start[341]: You should make a secure backup of this folder now. This574server # [6334117.775558] server acme-order-renew-test.foo-start[341]: configuration directory will also contain private keys575server # [6334117.775558] server acme-order-renew-test.foo-start[341]: generated by lego and certificates obtained from the ACME576server # [6334117.775558] server acme-order-renew-test.foo-start[341]: server. Making regular backups of this folder is ideal.577server # [6334117.775746] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] [test.foo] acme: Obtaining bundled SAN certificate578server # [6334117.846745] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC579server # [6334117.846745] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01580server # [6334117.846745] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] [test.foo] acme: use http-01 solver581server # [6334117.846925] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] [test.foo] acme: Trying to solve HTTP-01582server # [6334117.856662] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] [test.foo] The server validated our request583server # [6334117.856747] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] [test.foo] acme: Validations succeeded; requesting certificates584server # [6334117.875959] server acme-order-renew-test.foo-start[341]: 2026/08/21 06:52:23 [INFO] [test.foo] Server responded with a certificate.585server # [6334117.881527] server acme-order-renew-test.foo-start[333]: + mv domainhash.txt certificates/586server # [6334117.883671] server acme-order-renew-test.foo-start[333]: + touch out/acme-success587server # [6334117.885614] server acme-order-renew-test.foo-start[333]: + cmp -s certificates/test.foo.crt out/fullchain.pem588server # [6334117.886786] server acme-order-renew-test.foo-start[333]: + touch out/renewed589server # [6334117.888306] server acme-order-renew-test.foo-start[333]: + echo Installing new certificate590server # [6334117.888306] server acme-order-renew-test.foo-start[333]: Installing new certificate591server # [6334117.888306] server acme-order-renew-test.foo-start[333]: + cp -vp certificates/test.foo.crt out/fullchain.pem592server # [6334117.889890] server acme-order-renew-test.foo-start[373]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'593server # [6334117.890239] server acme-order-renew-test.foo-start[333]: + cp -vp certificates/test.foo.key out/key.pem594server # [6334117.891821] server acme-order-renew-test.foo-start[374]: 'certificates/test.foo.key' -> 'out/key.pem'595server # [6334117.892136] server acme-order-renew-test.foo-start[333]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem596server # [6334117.893583] server acme-order-renew-test.foo-start[375]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'597server # [6334117.893880] server acme-order-renew-test.foo-start[333]: + ln -sf fullchain.pem out/cert.pem598server # [6334117.895485] server acme-order-renew-test.foo-start[333]: + cat out/key.pem out/fullchain.pem599server # [6334117.897554] server acme-order-renew-test.foo-start[333]: + for fixpath in out certificates600server # [6334117.897554] server acme-order-renew-test.foo-start[333]: + '[' -d out ']'601server # [6334117.897651] server acme-order-renew-test.foo-start[333]: + chmod -R u=rwX,g=rX,o= out602server # [6334117.899217] server acme-order-renew-test.foo-start[333]: + chown -R acme:nginx out603server # [6334117.902378] server acme-order-renew-test.foo-start[333]: + for fixpath in out certificates604server # [6334117.902378] server acme-order-renew-test.foo-start[333]: + '[' -d certificates ']'605server # [6334117.902490] server acme-order-renew-test.foo-start[333]: + chmod -R u=rwX,g=rX,o= certificates606server # [6334117.904057] server acme-order-renew-test.foo-start[333]: + chown -R acme:nginx certificates607server # [6334117.907158] server acme-order-renew-test.foo-start[333]: + chmod -R u=rwX,g=,o= accounts/.608ca # [6334117.731241] ca step-ca[204]: time="2026-08-21T06:52:23Z" level=info duration="40.241µs" duration-ns=40241 fields.time="2026-08-21T06:52:23Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=4ed710d0-725f-4ee0-b9a5-7e139f929728 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=609ca # [6334117.769307] ca step-ca[204]: time="2026-08-21T06:52:23Z" level=info duration=34.838085ms duration-ns=34838085 fields.time="2026-08-21T06:52:23Z" method=HEAD name=ca nonce=NVZka1VDRm1leTdqWmFXbThlenk1QmFVSjJRclBjdUM path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=86d3fd31-f6be-4c9a-83fb-12d6b59515d7 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=610ca # [6334117.774695] ca step-ca[204]: time="2026-08-21T06:52:23Z" level=info duration=2.636396ms duration-ns=2636396 fields.time="2026-08-21T06:52:23Z" method=POST name=ca nonce=dFFhMHlFblIzMWdiRjdEWUFhVHh3cG11OVJmVFpFcDg path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=2106b02d-6fd0-4d8c-b7c9-1d752edc37d5 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/1YnxLoLS7NeVeFSbbkqdLh7cTAFp6Tuk/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=611ca # [6334117.783240] ca step-ca[204]: time="2026-08-21T06:52:23Z" level=info duration=3.916295ms duration-ns=3916295 fields.time="2026-08-21T06:52:23Z" method=POST name=ca nonce=S1h3ZVFjNHlOTXJjWVFWcVBIVzZ6M0NuWUN1OXNhek4 path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=358a5409-c108-4bc5-9fd0-532b0ad35462 response="{\"id\":\"ZJYoJGRNGT62iKIoDSAzQQm6Zji4qn1L\",\"status\":\"pending\",\"expires\":\"2026-08-22T06:52:23Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-21T06:51:23Z\",\"notAfter\":\"2026-11-19T06:52:23Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC\"],\"finalize\":\"https://ca.foo/acme/acme/order/ZJYoJGRNGT62iKIoDSAzQQm6Zji4qn1L/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=612ca # [6334117.846094] ca step-ca[204]: time="2026-08-21T06:52:23Z" level=info duration=2.081469ms duration-ns=2081469 fields.time="2026-08-21T06:52:23Z" method=POST name=ca nonce=S05lcHUyNzRjbDJTTXZwamIyRmM4RjFoMmRoYUlPMVk path=/acme/acme/authz/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC protocol=HTTP/1.1 referer= remote-address="::1" request-id=bc19e724-a8e1-4778-817c-7f24f28cd01b response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"o1uWyS6gFKeQzB6L6Yrd6aPgeWu1EilZ\",\"url\":\"https://ca.foo/acme/acme/challenge/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC/rtUTTDifO17sJVqyPfCYYqXxeNsKcZJA\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"o1uWyS6gFKeQzB6L6Yrd6aPgeWu1EilZ\",\"url\":\"https://ca.foo/acme/acme/challenge/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC/wkCjPjOoVHiD4tAyDaqAgvtvaUIk6TU0\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"o1uWyS6gFKeQzB6L6Yrd6aPgeWu1EilZ\",\"url\":\"https://ca.foo/acme/acme/challenge/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC/FihMK3C4bfEo4jE3YmxDxeps6eeb7qg8\"}],\"wildcard\":false,\"expires\":\"2026-08-22T06:52:23Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=613ca # [6334117.855974] ca step-ca[204]: time="2026-08-21T06:52:23Z" level=info duration=5.180033ms duration-ns=5180033 fields.time="2026-08-21T06:52:23Z" method=POST name=ca nonce=ZmoxQkZ0M0xqWWJ0TzJOem5YaHlNZktMU2tQTXdXd0U path=/acme/acme/challenge/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC/wkCjPjOoVHiD4tAyDaqAgvtvaUIk6TU0 protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=bc1f6f99-7beb-4185-a0ba-0b2fa2f262ee response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"o1uWyS6gFKeQzB6L6Yrd6aPgeWu1EilZ\",\"validated\":\"2026-08-21T06:52:23Z\",\"url\":\"https://ca.foo/acme/acme/challenge/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC/wkCjPjOoVHiD4tAyDaqAgvtvaUIk6TU0\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=614ca # [6334117.868875] ca step-ca[204]: time="2026-08-21T06:52:23Z" level=info duration=7.654146ms duration-ns=7654146 fields.time="2026-08-21T06:52:23Z" method=POST name=ca nonce=ZXkxYlJiMEV2cnFvRDQxM3pkdlk5Q1EwNUlZUWxUelY path=/acme/acme/order/ZJYoJGRNGT62iKIoDSAzQQm6Zji4qn1L/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=f43dc4df-a13a-453c-9eff-b375fc0b48e9 response="{\"id\":\"ZJYoJGRNGT62iKIoDSAzQQm6Zji4qn1L\",\"status\":\"valid\",\"expires\":\"2026-08-22T06:52:23Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-21T06:51:23Z\",\"notAfter\":\"2026-11-19T06:52:23Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/lQvttpGKGSx7prBZ5PykR12C9CLD3NiC\"],\"finalize\":\"https://ca.foo/acme/acme/order/ZJYoJGRNGT62iKIoDSAzQQm6Zji4qn1L/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/nUIlsbfJs0QOdlPX0p4F1sY75X0r0DIR\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=615ca # [6334117.875320] ca step-ca[204]: time="2026-08-21T06:52:23Z" level=info certificate=MIIB2TCCAX6gAwIBAgIRANe8RaaQ8AVVk3tAdRI5NFEwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODIxMDY1MTIzWhcNMjYxMTE5MDY1MjIzWjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPUiOiKoODLhiDecYIDaPqiB7EU18m+ayHcorODy203kIrc4lsyd6JU9RLjMUq/y2liQWlKMl1R4ZxfzHEoVlV6jgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUnKKbkRfVrdxpLTNeiBH00HLNT84wHwYDVR0jBBgwFoAUpHKbmUxGxY/acG9/Hx2x4UOfy5cwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0kAMEYCIQCVhsrxpj4l/l+LjcTn3hXhEVUhXAO00ua5FSbxkyhISgIhAMwBWLQuhG71YzAkXKTVv05twdxv7jGkBmDT053DlUYp duration=2.028388ms duration-ns=2028388 fields.time="2026-08-21T06:52:23Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=c2NmY1JLUUZ4MjVZUTJHQnlPNmRhVGxZS3BxZjNVNUM path=/acme/acme/certificate/nUIlsbfJs0QOdlPX0p4F1sY75X0r0DIR protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=727cec06-a702-43f7-bb26-e6372a8d6782 sans="map[dns:[test.foo]]" serial=286761583586155098403035564287909770321 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-08-21T06:51:23Z" valid-to="2026-11-19T06:52:23Z"616* Trying [2001:db8:1::3]:443...617* Host test.foo:443 was resolved.618* IPv6: 2001:db8:1::3619* IPv4: 192.168.1.3620* ALPN: curl offers h2,http/1.1621} [5 bytes data]622* TLSv1.3 (OUT), TLS handshake, Client hello (1):623} [1552 bytes data]624* SSL Trust Anchors:625* OpenSSL default paths (fallback)626{ [5 bytes data]627* TLSv1.3 (IN), TLS handshake, Server hello (2):628{ [1210 bytes data]629* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):630{ [1 bytes data]631* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):632{ [19 bytes data]633* TLSv1.3 (IN), TLS handshake, Certificate (11):634{ [1009 bytes data]635* TLSv1.3 (IN), TLS handshake, CERT verify (15):636{ [111 bytes data]637* TLSv1.3 (IN), TLS handshake, Finished (20):638{ [52 bytes data]639* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):640} [1 bytes data]641* TLSv1.3 (OUT), TLS handshake, Finished (20):642} [52 bytes data]643* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey644* ALPN: server accepted h2645* Server certificate:646* subject: CN=test.foo647* start date: Aug 21 06:52:15 2026 GMT648* expire date: Sep 20 06:52:15 2028 GMT649* issuer: CN=minica root ca 0e0d4c650* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384651* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384652* subjectAltName: "test.foo" matches cert's "test.foo"653* OpenSSL verify result: 13654* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)655* closing connection #0656curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)657More details here: https://curl.se/docs/sslcerts.html658659curl failed to verify the legitimacy of the server and therefore could not660establish a secure connection to it. To learn more about this situation and661how to fix it, please visit the webpage mentioned above.662server # [6334118.078486] server systemd[1]: Reloading Nginx Web Server...663server # [6334118.083461] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.664server # [6334118.083772] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.665server # [6334118.613022] server nginx[391]: nginx: the configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf syntax is ok666server # [6334118.613593] server nginx[391]: nginx: configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf test is successful667* Trying [2001:db8:1::3]:443...668* Host test.foo:443 was resolved.669* IPv6: 2001:db8:1::3670* IPv4: 192.168.1.3671* ALPN: curl offers h2,http/1.1672} [5 bytes data]673* TLSv1.3 (OUT), TLS handshake, Client hello (1):674} [1552 bytes data]675* SSL Trust Anchors:676* OpenSSL default paths (fallback)677{ [5 bytes data]678* TLSv1.3 (IN), TLS handshake, Server hello (2):679{ [1210 bytes data]680* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):681{ [1 bytes data]682* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):683{ [19 bytes data]684* TLSv1.3 (IN), TLS handshake, Certificate (11):685{ [932 bytes data]686* TLSv1.3 (IN), TLS handshake, CERT verify (15):687{ [79 bytes data]688* TLSv1.3 (IN), TLS handshake, Finished (20):689{ [52 bytes data]690* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):691} [1 bytes data]692* TLSv1.3 (OUT), TLS handshake, Finished (20):693} [52 bytes data]694* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey695* ALPN: server accepted h2696* Server certificate:697* subject: CN=test.foo698* start date: Aug 21 06:51:23 2026 GMT699* expire date: Nov 19 06:52:23 2026 GMT700* issuer: CN=Clan Intermediate CA701* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256702* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256703* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256704* subjectAltName: "test.foo" matches cert's "test.foo"705* OpenSSL verify result: 0706* SSL certificate verified via OpenSSL.707* Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 45100 708 % Total % Received % Xferd Average Speed Time Time Time Current709 Dload Upload Total Spent Left Speed710 0 0 0 0 0 0 0 0 0* using HTTP/2711* [HTTP/2] [1] OPENED stream for https://test.foo/712* [HTTP/2] [1] [:method: GET]713* [HTTP/2] [1] [:scheme: https]714* [HTTP/2] [1] [:authority: test.foo]715* [HTTP/2] [1] [:path: /]716* [HTTP/2] [1] [user-agent: curl/8.21.0]717* [HTTP/2] [1] [accept: */*]718} [5 bytes data]719720721722723724* Request completely sent off725{ [5 bytes data]726* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):727{ [265 bytes data]728* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):729{ [265 bytes data]730731732733734735736737{ [5 bytes data]738100 20 100 20 0 0 585 0 0739* Connection #0 to host test.foo:443 left intact740client: (finished: waiting for success: curl -v https://test.foo, in 2.16 seconds)741client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2742Certificate:743 Data:744 Version: 3 (0x2)745 Serial Number:746 d7:bc:45:a6:90:f0:05:55:93:7b:40:75:12:39:34:51747 Signature Algorithm: ecdsa-with-SHA256748 Issuer: CN=Clan Intermediate CA749 Validity750 Not Before: Aug 21 06:51:23 2026 GMT751 Not After : Nov 19 06:52:23 2026 GMT752 Subject: CN=test.foo753 Subject Public Key Info:754 Public Key Algorithm: id-ecPublicKey755 Public-Key: (256 bit)756 pub:757 04:f5:22:3a:22:a8:38:32:e1:88:37:9c:60:80:da:758 3e:a8:81:ec:45:35:f2:6f:9a:c8:77:28:ac:e0:f2:759 db:4d:e4:22:b7:38:96:cc:9d:e8:95:3d:44:b8:cc:760 52:af:f2:da:58:90:5a:52:8c:97:54:78:67:17:f3:761 1c:4a:15:95:5e762 ASN1 OID: prime256v1763 NIST CURVE: P-256764 X509v3 extensions:765 X509v3 Key Usage: critical766 Digital Signature767 X509v3 Extended Key Usage: 768 TLS Web Server Authentication, TLS Web Client Authentication769 X509v3 Subject Key Identifier: 770 9C:A2:9B:91:17:D5:AD:DC:69:2D:33:5E:88:11:F4:D0:72:CD:4F:CE771 X509v3 Authority Key Identifier: 772 A4:72:9B:99:4C:46:C5:8F:DA:70:6F:7F:1F:1D:B1:E1:43:9F:CB:97773 X509v3 Subject Alternative Name: 774 DNS:test.foo775 1.3.6.1.4.1.37476.9000.64.1: 776 0......acme..777 Signature Algorithm: ecdsa-with-SHA256778 Signature Value:779 30:46:02:21:00:95:86:ca:f1:a6:3e:25:fe:5f:8b:8d:c4:e7:780 de:15:e1:11:55:21:5c:03:b4:d2:e6:b9:15:26:f1:93:28:48:781 4a:02:21:00:cc:01:58:b4:2e:84:6e:f5:63:30:24:5c:a4:d5:782 bf:4e:6d:c1:dc:6f:ee:31:a4:06:60:d3:d3:9d:c3:95:46:29783client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.04 seconds)784(finished: run the VM test script, in 12.21 seconds)785server # [6334119.148300] server systemd[1]: Reloaded Nginx Web Server.786test script finished in 12.46s787cleanup788kill NspawnMachine (pid 53)789kill NspawnMachine (pid 54)790Container ca terminated by signal KILL.791kill NspawnMachine (pid 55)792Container client terminated by signal KILL.793(finished: cleanup, in 0.44 seconds)794Container server terminated by signal KILL.