container-test-run-certificates
checks.aarch64-linux.certificates
· build #454
· raw
1Machine state will be reset. To keep it, pass --keep-machine-state2start all VLans3(finished: start all VLans, in 0.00 seconds)45Test will time out and terminate in 3600.0 seconds6run the VM test script7additionally exposed symbols:8 ca, client, server,9 vlan1,10 start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh11start all VMs12ca: systemd-nspawn running (pid 52)13ca: Waiting for journal at /build/vm-state-ca/var/log/journal...14server: systemd-nspawn running (pid 56)15client: systemd-nspawn running (pid 57)16server: Waiting for journal at /build/vm-state-server/var/log/journal...17client: Waiting for journal at /build/vm-state-client/var/log/journal...18(finished: start all VMs, in 0.00 seconds)19nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE20nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.21nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE22nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.23nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE24nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.25Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.26Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.27░ Spawning container client on /build/vm-state-client.28░ Spawning container ca on /build/vm-state-ca.29Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.30░ Spawning container server on /build/vm-state-server.31ca # [6396323.425213] ca systemd-journald[79]: Journal started32ca # [6396323.425271] ca systemd-journald[79]: Runtime Journal (/run/log/journal/1114226367a34c6294783a98c04e5fb5) is 8M, max 2.5G, 2.4G free.33ca # [6396323.433792] ca systemd[1]: Starting Flush Journal to Persistent Storage...34ca # [6396323.434556] ca systemd[1]: Starting Network Name Resolution...35ca # [6396323.435345] ca systemd[1]: Starting Create Static Device Nodes in /dev...36ca # [6396323.444474] ca systemd-journald[79]: Time spent on flushing to /var/log/journal/1114226367a34c6294783a98c04e5fb5 is 1.478ms for 5 entries.37ca # [6396323.444474] ca systemd-journald[79]: System Journal (/var/log/journal/1114226367a34c6294783a98c04e5fb5) is 8M, max 4G, 3.9G free.38ca # [6396323.453381] ca systemd[1]: Finished Create Static Device Nodes in /dev.39ca # [6396323.454041] ca systemd[1]: Reached target Preparation for Local File Systems.40ca # [6396323.454172] ca systemd[1]: Reached target Local File Systems.41ca # [6396323.454971] ca systemd[1]: Listening on Boot Loader Control Service Socket.42ca # [6396323.455026] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container43ca # [6396323.456134] ca systemd[1]: Starting Save Transient machine-id to Disk...44ca # [6396323.456167] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys45ca # [6396323.458423] ca systemd[1]: Finished Flush Journal to Persistent Storage.46ca # [6396323.459422] ca systemd[1]: Starting Create System Files and Directories...47ca # [6396323.473777] ca systemd-tmpfiles[123]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted48ca # [6396323.473961] ca systemd-tmpfiles[123]: fchmod() of /var/log/journal failed: Operation not permitted49ca # [6396323.474084] ca systemd-tmpfiles[123]: fchmod() of /var/log/journal/1114226367a34c6294783a98c04e5fb5 failed: Operation not permitted50ca # [6396323.474270] ca systemd-tmpfiles[123]: fchmod() of /run/log/journal failed: Operation not permitted51ca # [6396323.475629] ca systemd[1]: Finished Create System Files and Directories.52ca # [6396323.476633] ca systemd[1]: Starting Rebuild Journal Catalog...53ca # [6396323.477277] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...54ca # [6396323.492046] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.55ca # [6396323.495160] ca systemd[1]: Finished Rebuild Journal Catalog.56ca # [6396323.496256] ca systemd[1]: Starting Update is Completed...57ca # [6396323.505878] ca systemd[1]: Finished Update is Completed.58server # [6396323.423330] server systemd-journald[69]: Journal started59server # [6396323.423387] server systemd-journald[69]: Runtime Journal (/run/log/journal/1ff41e9b086c4ee0abcae26e0ffbbafe) is 8M, max 2.5G, 2.4G free.60server # [6396323.424807] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.61server # [6396323.433191] server systemd[1]: Starting Flush Journal to Persistent Storage...62server # [6396323.434018] server systemd[1]: Starting Network Name Resolution...63server # [6396323.434663] server systemd[1]: Starting Create Static Device Nodes in /dev...64server # [6396323.444328] server systemd-journald[69]: Time spent on flushing to /var/log/journal/1ff41e9b086c4ee0abcae26e0ffbbafe is 1.709ms for 6 entries.65server # [6396323.444328] server systemd-journald[69]: System Journal (/var/log/journal/1ff41e9b086c4ee0abcae26e0ffbbafe) is 8M, max 4G, 3.9G free.66server # [6396323.453487] server systemd[1]: Finished Create Static Device Nodes in /dev.67server # [6396323.454205] server systemd[1]: Reached target Preparation for Local File Systems.68server # [6396323.454322] server systemd[1]: Reached target Local File Systems.69server # [6396323.455108] server systemd[1]: Listening on Boot Loader Control Service Socket.70server # [6396323.455152] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container71server # [6396323.455963] server systemd[1]: Starting Save Transient machine-id to Disk...72server # [6396323.455997] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys73server # [6396323.458624] server systemd[1]: Finished Flush Journal to Persistent Storage.74server # [6396323.459632] server systemd[1]: Starting Create System Files and Directories...75server # [6396323.476038] server systemd-tmpfiles[111]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted76server # [6396323.476295] server systemd-tmpfiles[111]: fchmod() of /var/log/journal failed: Operation not permitted77server # [6396323.476463] server systemd-tmpfiles[111]: fchmod() of /var/log/journal/1ff41e9b086c4ee0abcae26e0ffbbafe failed: Operation not permitted78server # [6396323.476696] server systemd-tmpfiles[111]: fchmod() of /run/log/journal failed: Operation not permitted79server # [6396323.478318] server systemd[1]: Finished Create System Files and Directories.80server # [6396323.479306] server systemd[1]: Starting Rebuild Journal Catalog...81server # [6396323.479930] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...82server # [6396323.491071] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.83server # [6396323.499607] server systemd[1]: Finished Rebuild Journal Catalog.84server # [6396323.500836] server systemd[1]: Starting Update is Completed...85server # [6396323.511521] server systemd[1]: Finished Update is Completed.86client # [6396323.416099] client systemd-journald[69]: Journal started87client # [6396323.416167] client systemd-journald[69]: Runtime Journal (/run/log/journal/84bcf4e2c6fc41b280a82643ffa1f7aa) is 8M, max 2.5G, 2.4G free.88client # [6396323.417856] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.89client # [6396323.427204] client systemd[1]: Starting Flush Journal to Persistent Storage...90client # [6396323.428107] client systemd[1]: Starting Network Name Resolution...91client # [6396323.428798] client systemd[1]: Starting Create Static Device Nodes in /dev...92client # [6396323.437832] client systemd-journald[69]: Time spent on flushing to /var/log/journal/84bcf4e2c6fc41b280a82643ffa1f7aa is 1.413ms for 6 entries.93client # [6396323.437832] client systemd-journald[69]: System Journal (/var/log/journal/84bcf4e2c6fc41b280a82643ffa1f7aa) is 8M, max 4G, 3.9G free.94client # [6396323.445338] client systemd[1]: Finished Create Static Device Nodes in /dev.95client # [6396323.445589] client systemd[1]: Reached target Preparation for Local File Systems.96client # [6396323.445675] client systemd[1]: Reached target Local File Systems.97client # [6396323.446420] client systemd[1]: Listening on Boot Loader Control Service Socket.98client # [6396323.446464] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container99client # [6396323.447361] client systemd[1]: Starting Save Transient machine-id to Disk...100client # [6396323.447396] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys101client # [6396323.448644] client systemd[1]: Finished Flush Journal to Persistent Storage.102client # [6396323.449533] client systemd[1]: Starting Create System Files and Directories...103client # [6396323.463181] client systemd-tmpfiles[112]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted104client # [6396323.463360] client systemd-tmpfiles[112]: fchmod() of /var/log/journal failed: Operation not permitted105client # [6396323.463494] client systemd-tmpfiles[112]: fchmod() of /var/log/journal/84bcf4e2c6fc41b280a82643ffa1f7aa failed: Operation not permitted106client # [6396323.463678] client systemd-tmpfiles[112]: fchmod() of /run/log/journal failed: Operation not permitted107client # [6396323.465140] client systemd[1]: Finished Create System Files and Directories.108client # [6396323.466165] client systemd[1]: Starting Rebuild Journal Catalog...109client # [6396323.466932] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...110client # [6396323.479172] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.111client # [6396323.487869] client systemd[1]: Finished Rebuild Journal Catalog.112client # [6396323.488955] client systemd[1]: Starting Update is Completed...113client # [6396323.498926] client systemd[1]: Finished Update is Completed.114client # [6396323.554310] client systemd[1]: Finished Firewall.115client # [6396323.554449] client systemd[1]: Reached target Preparation for Network.116client # [6396323.554661] client systemd[1]: Listening on Network Management Resolve Hook Socket.117client # [6396323.555706] client systemd[1]: Starting Network Management...118server # [6396323.604226] server systemd[1]: Finished Firewall.119ca # [6396323.604200] ca systemd[1]: Finished Firewall.120server # [6396323.604431] server systemd[1]: Reached target Preparation for Network.121ca # [6396323.604385] ca systemd[1]: Reached target Preparation for Network.122server # [6396323.604634] server systemd[1]: Listening on Network Management Resolve Hook Socket.123ca # [6396323.604634] ca systemd[1]: Listening on Network Management Resolve Hook Socket.124server # [6396323.605602] server systemd[1]: Starting Network Management...125ca # [6396323.605795] ca systemd[1]: Starting Network Management...126ca # [6396324.001672] ca systemd-networkd[196]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted127ca # [6396324.001762] ca systemd-networkd[196]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted128ca # [6396324.008608] ca systemd-networkd[196]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.129ca # [6396324.008773] ca systemd-networkd[196]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.130ca # [6396324.008936] ca systemd-networkd[196]: lo: Link UP131ca # [6396324.008940] ca systemd-networkd[196]: lo: Gained carrier132ca # [6396324.009141] ca systemd-networkd[196]: eth1: Configuring with /etc/systemd/network/40-eth1.network.133ca # [6396324.009500] ca systemd[1]: Started Network Management.134ca # [6396324.036379] ca systemd-networkd[196]: eth1: Link UP135ca # [6396324.036498] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...136ca # [6396324.036632] ca systemd-networkd[196]: eth1: Gained carrier137ca # [6396324.074621] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.138ca # [6396324.077460] ca systemd[1]: Finished Save Transient machine-id to Disk.139ca # [6396324.111965] ca systemd-resolved[102]: Positive Trust Anchors:140ca # [6396324.111977] ca systemd-resolved[102]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d141ca # [6396324.111980] ca systemd-resolved[102]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16142ca # [6396324.112027] ca systemd-resolved[102]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test143ca # [6396324.134651] ca systemd-resolved[102]: Using system hostname 'ca'.144ca # [6396324.136206] ca systemd[1]: Started Network Name Resolution.145ca # [6396324.136301] ca systemd[1]: Reached target Network.146ca # [6396324.136365] ca systemd[1]: Reached target Network is Online.147ca # [6396324.136411] ca systemd[1]: Reached target System Initialization.148ca # [6396324.136648] ca systemd[1]: Started Renew ACME Certificate for ca.foo.149ca # [6396324.136675] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container150ca # [6396324.136701] ca systemd[1]: Started Daily Cleanup of Temporary Directories.151ca # [6396324.136718] ca systemd[1]: Reached target Timer Units.152ca # [6396324.136847] ca systemd[1]: Listening on D-Bus System Message Bus Socket.153ca # [6396324.136951] ca systemd[1]: Listening on Nix Daemon Socket.154ca # [6396324.137062] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.155ca # [6396324.137090] ca systemd[1]: Reached target Socket Units.156ca # [6396324.137128] ca systemd[1]: Reached target Basic System.157ca # [6396324.138429] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...158ca # [6396324.139146] ca systemd[1]: Starting Import lastlog data into lastlog2 database...159ca # [6396324.139185] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem160ca # [6396324.139949] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...161ca # [6396324.140865] ca systemd[1]: Starting step-ca service...162ca # [6396324.142077] ca systemd[1]: Starting D-Bus System Message Bus...163ca # [6396324.216289] ca systemd[1]: Finished Import lastlog data into lastlog2 database.164ca # [6396324.296789] ca acme-setup-privileged[202]: + set -euo pipefail165ca # [6396324.296789] ca acme-setup-privileged[202]: + cd /var/lib/acme166ca # [6396324.296789] ca acme-setup-privileged[202]: + chmod -R u=rwX,g=,o= .lego/accounts167ca # [6396324.298399] ca acme-setup-privileged[202]: + chown -R acme .lego/accounts168server # [6396323.993544] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted169server # [6396323.993640] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted170server # [6396324.000458] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.171server # [6396324.000629] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.172server # [6396324.000838] server systemd-networkd[186]: lo: Link UP173server # [6396324.000841] server systemd-networkd[186]: lo: Gained carrier174server # [6396324.001005] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network.175server # [6396324.001362] server systemd[1]: Started Network Management.176server # [6396324.001554] server systemd-networkd[186]: eth1: Link UP177server # [6396324.001833] server systemd-networkd[186]: eth1: Gained carrier178server # [6396324.002424] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...179server # [6396324.045743] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.180server # [6396324.077271] server systemd[1]: Finished Save Transient machine-id to Disk.181server # [6396324.127727] server systemd-resolved[90]: Positive Trust Anchors:182server # [6396324.127738] server systemd-resolved[90]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d183server # [6396324.127740] server systemd-resolved[90]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16184server # [6396324.127776] server systemd-resolved[90]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test185server # [6396324.149801] server systemd-resolved[90]: Using system hostname 'server'.186server # [6396324.151178] server systemd[1]: Started Network Name Resolution.187server # [6396324.151260] server systemd[1]: Reached target Network.188server # [6396324.151313] server systemd[1]: Reached target Network is Online.189server # [6396324.151351] server systemd[1]: Reached target System Initialization.190server # [6396324.151562] server systemd[1]: Started Renew ACME Certificate for test.foo.191server # [6396324.151598] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container192server # [6396324.151619] server systemd[1]: Started Daily Cleanup of Temporary Directories.193server # [6396324.151638] server systemd[1]: Reached target Timer Units.194server # [6396324.151746] server systemd[1]: Listening on D-Bus System Message Bus Socket.195server # [6396324.151841] server systemd[1]: Listening on Nix Daemon Socket.196server # [6396324.151940] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.197server # [6396324.151964] server systemd[1]: Reached target Socket Units.198server # [6396324.152020] server systemd[1]: Reached target Basic System.199server # [6396324.201302] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...200server # [6396324.202338] server systemd[1]: Starting Import lastlog data into lastlog2 database...201server # [6396324.202384] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem202server # [6396324.203340] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...203server # [6396324.204462] server systemd[1]: Starting D-Bus System Message Bus...204server # [6396324.222337] server systemd[1]: Finished Import lastlog data into lastlog2 database.205server # [6396324.304515] server acme-setup-privileged[192]: + set -euo pipefail206server # [6396324.304515] server acme-setup-privileged[192]: + cd /var/lib/acme207server # [6396324.304515] server acme-setup-privileged[192]: + chmod -R u=rwX,g=,o= .lego/accounts208client # [6396323.993698] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted209client # [6396323.993786] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted210client # [6396324.000442] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.211client # [6396324.000606] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.212client # [6396324.000792] client systemd-networkd[182]: lo: Link UP213client # [6396324.000797] client systemd-networkd[182]: lo: Gained carrier214client # [6396324.001004] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network.215client # [6396324.001367] client systemd[1]: Started Network Management.216client # [6396324.001464] client systemd-networkd[182]: eth1: Link UP217client # [6396324.002042] client systemd-networkd[182]: eth1: Gained carrier218client # [6396324.002468] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...219client # [6396324.045934] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.220client # [6396324.077794] client systemd[1]: Finished Save Transient machine-id to Disk.221client # [6396324.117692] client systemd-resolved[94]: Positive Trust Anchors:222client # [6396324.117703] client systemd-resolved[94]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d223client # [6396324.117706] client systemd-resolved[94]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16224client # [6396324.117743] client systemd-resolved[94]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test225client # [6396324.139961] client systemd-resolved[94]: Using system hostname 'client'.226client # [6396324.141381] client systemd[1]: Started Network Name Resolution.227client # [6396324.141459] client systemd[1]: Reached target Network.228client # [6396324.141529] client systemd[1]: Reached target System Initialization.229client # [6396324.141575] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container230client # [6396324.141606] client systemd[1]: Started Daily Cleanup of Temporary Directories.231client # [6396324.141623] client systemd[1]: Reached target Timer Units.232client # [6396324.141740] client systemd[1]: Listening on D-Bus System Message Bus Socket.233client # [6396324.141847] client systemd[1]: Listening on Nix Daemon Socket.234client # [6396324.141949] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.235client # [6396324.141970] client systemd[1]: Reached target Socket Units.236client # [6396324.142003] client systemd[1]: Reached target Basic System.237client # [6396324.200523] client systemd[1]: Starting Import lastlog data into lastlog2 database...238client # [6396324.202445] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...239client # [6396324.203981] client systemd[1]: Starting D-Bus System Message Bus...240client # [6396324.219995] client systemd[1]: Finished Import lastlog data into lastlog2 database.241client # [6396324.318589] client nsncd[189]: Aug 22 00:09:10.371 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"242client # [6396324.318733] client systemd[1]: Started Name Service Cache Daemon (nsncd).243client # [6396324.318822] client systemd[1]: Reached target Host and Network Name Lookups.244client # [6396324.318913] client systemd[1]: Reached target User and Group Name Lookups.245ca # [6396324.300060] ca acme-setup-privileged[202]: + for fixpath in ca.foo .lego/ca.foo246ca # [6396324.300097] ca acme-setup-privileged[202]: + '[' -d ca.foo ']'247ca # [6396324.300097] ca acme-setup-privileged[202]: + for fixpath in ca.foo .lego/ca.foo248ca # [6396324.300097] ca acme-setup-privileged[202]: + '[' -d .lego/ca.foo ']'249ca # [6396324.355730] ca nsncd[204]: Aug 22 00:09:10.408 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"250ca # [6396324.355781] ca systemd[1]: Started Name Service Cache Daemon (nsncd).251ca # [6396324.355845] ca systemd[1]: Reached target Host and Network Name Lookups.252ca # [6396324.355898] ca systemd[1]: Reached target User and Group Name Lookups.253ca # [6396324.357046] ca systemd[1]: Starting User Login Management...254ca # [6396324.357766] ca systemd[1]: Starting Permit User Sessions...255ca # [6396324.367488] ca systemd[1]: Finished Permit User Sessions.256ca # [6396324.368446] ca systemd[1]: Started Console Getty.257ca # [6396324.368490] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0258ca # [6396324.368512] ca systemd[1]: Reached target Login Prompts.259ca # [6396324.410480] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.260ca # [6396324.429126] ca dbus-broker-launch[206]: Looking up NSS user entry for 'systemd-timesync'...261ca # [6396324.430514] ca dbus-broker-launch[206]: NSS returned no entry for 'systemd-timesync'262ca # [6396324.430514] ca dbus-broker-launch[206]: Invalid user-name in /nix/store/mfvkn1zwby5692v4kx3ynjdz34b2lkq3-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"263ca # [6396324.430921] ca systemd[1]: Started D-Bus System Message Bus.264ca # [6396324.437715] ca dbus-broker-launch[206]: Ready265server # [6396324.306192] server acme-setup-privileged[192]: + chown -R acme .lego/accounts266server # [6396324.307614] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo267server # [6396324.307680] server acme-setup-privileged[192]: + '[' -d test.foo ']'268server # [6396324.307680] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo269server # [6396324.307680] server acme-setup-privileged[192]: + '[' -d .lego/test.foo ']'270server # [6396324.323832] server nsncd[194]: Aug 22 00:09:10.376 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"271server # [6396324.324137] server systemd[1]: Started Name Service Cache Daemon (nsncd).272server # [6396324.324252] server systemd[1]: Reached target Host and Network Name Lookups.273server # [6396324.324360] server systemd[1]: Reached target User and Group Name Lookups.274server # [6396324.326293] server systemd[1]: Starting User Login Management...275server # [6396324.327504] server systemd[1]: Starting Permit User Sessions...276server # [6396324.337507] server systemd[1]: Finished Permit User Sessions.277server # [6396324.338471] server systemd[1]: Started Console Getty.278server # [6396324.338508] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0279server # [6396324.338528] server systemd[1]: Reached target Login Prompts.280server # [6396324.411016] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.281server # [6396324.425097] server dbus-broker-launch[195]: Looking up NSS user entry for 'systemd-timesync'...282server # [6396324.426188] server dbus-broker-launch[195]: NSS returned no entry for 'systemd-timesync'283server # [6396324.426188] server dbus-broker-launch[195]: Invalid user-name in /nix/store/lxnlg1wvz5bx4xfzc75k21l11ngxkyck-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"284server # [6396324.426850] server systemd[1]: Started D-Bus System Message Bus.285server # [6396324.435599] server dbus-broker-launch[195]: Ready286client # [6396324.320828] client systemd[1]: Starting User Login Management...287client # [6396324.321932] client systemd[1]: Starting Permit User Sessions...288client # [6396324.331750] client systemd[1]: Finished Permit User Sessions.289client # [6396324.334075] client systemd[1]: Started Console Getty.290client # [6396324.334125] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0291client # [6396324.334142] client systemd[1]: Reached target Login Prompts.292client # [6396324.399646] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.293client # [6396324.418840] client dbus-broker-launch[190]: Looking up NSS user entry for 'systemd-timesync'...294client # [6396324.420105] client dbus-broker-launch[190]: NSS returned no entry for 'systemd-timesync'295client # [6396324.420105] client dbus-broker-launch[190]: Invalid user-name in /nix/store/s0a40wv0lnwiz13r43fk318ri3wv536k-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"296client # [6396324.420490] client systemd[1]: Started D-Bus System Message Bus.297client # [6396324.427527] client dbus-broker-launch[190]: Ready298client # [6396324.828542] client systemd-logind[205]: New seat seat0.299server # [6396324.833739] server systemd-logind[224]: New seat seat0.300client # [6396324.828792] client systemd[1]: Started User Login Management.301client # [6396324.830034] client systemd[1]: Starting linger-users.service...302client # [6396324.841496] client systemd[1]: linger-users.service: Deactivated successfully.303client # [6396324.841657] client systemd[1]: Finished linger-users.service.304client # [6396324.842087] client systemd[1]: Reached target Multi-User System.305client # [6396324.842251] client systemd[1]: Startup finished in 1.818s.306server # [6396324.833909] server systemd[1]: Started User Login Management.307server # [6396324.834982] server systemd[1]: Starting linger-users.service...308server # [6396324.845649] server systemd[1]: linger-users.service: Deactivated successfully.309server # [6396324.845745] server systemd[1]: Finished linger-users.service.310server # [6396324.876827] server acme-setup-start[208]: + set -euo pipefail311server # [6396324.876827] server acme-setup-start[208]: + test -e ca/key.pem312server # [6396324.877234] server acme-setup-start[208]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local313server # [6396324.897082] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.314server # [6396324.898500] server systemd[1]: Starting Ensure certificate for test.foo...315ca # [6396324.854372] ca systemd-logind[236]: New seat seat0.316ca # [6396324.854568] ca systemd[1]: Started User Login Management.317ca # [6396324.855947] ca systemd[1]: Starting linger-users.service...318ca # [6396324.870353] ca acme-setup-start[220]: + set -euo pipefail319ca # [6396324.870353] ca acme-setup-start[220]: + test -e ca/key.pem320ca # [6396324.870630] ca acme-setup-start[220]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local321ca # [6396324.871635] ca systemd[1]: linger-users.service: Deactivated successfully.322ca # [6396324.871778] ca systemd[1]: Finished linger-users.service.323ca # [6396324.887219] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.324ca # [6396324.888880] ca systemd[1]: Starting Ensure certificate for ca.foo...325ca # [6396325.009128] ca step-ca[205]: badger 2026/08/22 00:09:11 INFO: All 0 tables opened in 0s326ca # [6396325.012788] ca step-ca[205]: 2026/08/22 00:09:11 Building new tls configuration using step-ca x509 Signer Interface327ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Starting Smallstep CA/0.30.2 (linux/arm64)328ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Documentation: https://u.step.sm/docs/ca329ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Community Discord: https://u.step.sm/discord330ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Config file: /etc/smallstep/ca.json331ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 The primary server URL is https://ca.foo:1443332ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Root certificates are available at https://ca.foo:1443/roots.pem333ca # [6396325.019229] ca step-ca[205]: 2026/08/22 00:09:11 X.509 Root Fingerprint: 1a7ad12f92f4a81d1038b71212f5a044a8d7b0fb93aa69f507b3d4033bfed054334ca # [6396325.019563] ca systemd[1]: Started step-ca service.335ca # [6396325.019839] ca step-ca[205]: 2026/08/22 00:09:11 Serving HTTPS on 0.0.0.0:1443 ...336ca: must succeed: systemctl restart acme-order-renew-ca.foo.service 337ca # [6396325.405959] ca acme-ca.foo-start[257]: Waiting to acquire lock in /run/acme/338ca # [6396325.409136] ca acme-ca.foo-start[257]: + '[' -e out/acme-success ']'339ca # [6396325.409136] ca acme-ca.foo-start[257]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=340ca # [6396325.420156] ca acme-ca.foo-start[294]: + cd ca.foo341ca # [6396325.420809] ca acme-ca.foo-start[294]: + cp -vp cert.pem ../out/cert.pem342ca # [6396325.421640] ca acme-ca.foo-start[295]: 'cert.pem' -> '../out/cert.pem'343ca # [6396325.421980] ca acme-ca.foo-start[294]: + cp -vp key.pem ../out/key.pem344ca # [6396325.423298] ca acme-ca.foo-start[294]: 'key.pem' -> '../out/key.pem'345ca # [6396325.423557] ca acme-ca.foo-start[257]: + cat out/cert.pem ca/cert.pem346ca # [6396325.425607] ca acme-ca.foo-start[257]: + cp ca/cert.pem out/chain.pem347ca # [6396325.427043] ca acme-ca.foo-start[257]: + cat out/key.pem out/fullchain.pem348ca # [6396325.428530] ca acme-ca.foo-start[257]: + for fixpath in out certificates349ca # [6396325.428530] ca acme-ca.foo-start[257]: + '[' -d out ']'350ca # [6396325.428647] ca acme-ca.foo-start[257]: + chmod -R u=rwX,g=rX,o= out351ca # [6396325.430509] ca acme-ca.foo-start[257]: + chown -R acme:nginx out352ca # [6396325.434993] ca acme-ca.foo-start[257]: + for fixpath in out certificates353ca # [6396325.434993] ca acme-ca.foo-start[257]: + '[' -d certificates ']'354ca # [6396325.437813] ca systemd[1]: Finished Ensure certificate for ca.foo.355ca # [6396325.439576] ca systemd[1]: Starting Nginx Web Server...356ca # [6396325.632259] ca systemd-networkd[196]: eth1: Gained IPv6LL357server # [6396325.405293] server acme-test.foo-start[245]: Waiting to acquire lock in /run/acme/358server # [6396325.407746] server acme-test.foo-start[245]: + '[' -e out/acme-success ']'359server # [6396325.407746] server acme-test.foo-start[245]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=360server # [6396325.421554] server acme-test.foo-start[255]: + cd test.foo361server # [6396325.422174] server acme-test.foo-start[255]: + cp -vp cert.pem ../out/cert.pem362server # [6396325.423434] server acme-test.foo-start[256]: 'cert.pem' -> '../out/cert.pem'363server # [6396325.424117] server acme-test.foo-start[255]: + cp -vp key.pem ../out/key.pem364server # [6396325.425807] server acme-test.foo-start[255]: 'key.pem' -> '../out/key.pem'365server # [6396325.426075] server acme-test.foo-start[245]: + cat out/cert.pem ca/cert.pem366server # [6396325.427726] server acme-test.foo-start[245]: + cp ca/cert.pem out/chain.pem367server # [6396325.429249] server acme-test.foo-start[245]: + cat out/key.pem out/fullchain.pem368server # [6396325.430650] server acme-test.foo-start[245]: + for fixpath in out certificates369server # [6396325.430650] server acme-test.foo-start[245]: + '[' -d out ']'370server # [6396325.430758] server acme-test.foo-start[245]: + chmod -R u=rwX,g=rX,o= out371server # [6396325.432335] server acme-test.foo-start[245]: + chown -R acme:nginx out372server # [6396325.435235] server acme-test.foo-start[245]: + for fixpath in out certificates373server # [6396325.435235] server acme-test.foo-start[245]: + '[' -d certificates ']'374server # [6396325.438837] server systemd[1]: Finished Ensure certificate for test.foo.375server # [6396325.440098] server systemd-networkd[186]: eth1: Gained IPv6LL376server # [6396325.441233] server systemd[1]: Starting Nginx Web Server...377client # [6396325.920240] client systemd-networkd[182]: eth1: Gained IPv6LL378ca # [6396326.008383] ca nginx-pre-start[306]: nginx: the configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf syntax is ok379server # [6396325.979135] server nginx-pre-start[267]: nginx: the configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf syntax is ok380ca # [6396326.008704] ca nginx-pre-start[306]: nginx: configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf test is successful381ca # [6396326.020377] ca systemd[1]: Started Nginx Web Server.382server # [6396325.979909] server nginx-pre-start[267]: nginx: configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf test is successful383ca # [6396326.020760] ca systemd[1]: Reached target Multi-User System.384ca # [6396326.021940] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...385server # [6396325.984593] server systemd[1]: Started Nginx Web Server.386server # [6396325.985359] server systemd[1]: Reached target Multi-User System.387server # [6396325.987556] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...388ca # [6396326.541110] ca acme-order-renew-ca.foo-start[309]: Waiting to acquire lock in /run/acme/389ca # [6396326.544176] ca acme-order-renew-ca.foo-start[309]: + set -euo pipefail390ca # [6396326.544251] ca acme-order-renew-ca.foo-start[309]: + echo 88dc4fc401a6091a1bd9391ca # [6396326.544367] ca acme-order-renew-ca.foo-start[309]: + cmp -s domainhash.txt certificates/domainhash.txt392ca # [6396326.545474] ca acme-order-renew-ca.foo-start[309]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run393ca # [6396326.571276] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 No key found for account none@none.tld. Generating a P256 key.394ca # [6396326.571619] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key395ca # [6396326.597235] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration="330.445µs" duration-ns=330445 fields.time="2026-08-22T00:09:12Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=7ff74ded-6e6e-4982-bca1-80c490c99ab4 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=396ca # [6396326.597631] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] acme: Registering account for none@none.tld397ca # [6396326.621322] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=23.539484ms duration-ns=23539484 fields.time="2026-08-22T00:09:12Z" method=HEAD name=ca nonce=dHRCeFJHRU1wdWxTd2FWNEJNcVIwV0tMZU5JRDBMNTM path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b1135ddc-70f1-4eeb-8470-5d8f4fd8c11b size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=398ca # [6396326.624461] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=2.419914ms duration-ns=2419914 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=Rkhxbjd5cDdiWTM2bFRKeXJEdkRZSlRJTDNwZ1hKNFc path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=e291127f-0dc4-4925-844c-49b02dcc2930 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/CxJxlHWzcUD3pYIzfsgYdW4u3qyJNQVa/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=399ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: !!!! HEADS UP !!!!400ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: Your account credentials have been saved in your401ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: configuration directory at "accounts".402ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: You should make a secure backup of this folder now. This403ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: configuration directory will also contain private keys404ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: generated by lego and certificates obtained from the ACME405ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: server. Making regular backups of this folder is ideal.406ca # [6396326.624944] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate407ca # [6396326.628804] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=3.521769ms duration-ns=3521769 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=THZXNWRjN2xsRkpzeTEyVmlIZ3JYSFZMbjVubmQ0MGM path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1b398d4a-20b8-44ad-8218-6891809daac6 response="{\"id\":\"QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M\",\"status\":\"pending\",\"expires\":\"2026-08-23T00:09:12Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-22T00:08:12Z\",\"notAfter\":\"2026-11-20T00:09:12Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/kC7g8yRzmeywruexhewmlArHUPhAHWCn\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=408ca # [6396326.695901] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=9.939657ms duration-ns=9939657 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=TGE3MkxVM1l3VlNKN1YzRVFHaVNscGRvNm9EcGZMMjk path=/acme/acme/authz/kC7g8yRzmeywruexhewmlArHUPhAHWCn protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=5b2a06fd-8957-4b39-b0b9-a4bd4f8d039c response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"ep3Vf8PvwN36MSq1Si9vwOgjHj5kvdhM\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/7JCNhYFytoN4FRLMRkDXg0MpKp2mhUXE\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"ep3Vf8PvwN36MSq1Si9vwOgjHj5kvdhM\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/Jb0Vu8rcGMuErjGzzDgdPpdFdTqyAckF\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"ep3Vf8PvwN36MSq1Si9vwOgjHj5kvdhM\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/BvSrgVwMs3Yzz6ZGSlBPxBSYzqeEIBa8\"}],\"wildcard\":false,\"expires\":\"2026-08-23T00:09:12Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=409ca # [6396326.696256] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/kC7g8yRzmeywruexhewmlArHUPhAHWCn410ca # [6396326.696256] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01411ca # [6396326.696256] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: use http-01 solver412ca # [6396326.696335] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: Trying to solve HTTP-01413ca # [6396326.699475] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=2.715877ms duration-ns=2715877 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=aHNJWDhpdDZZRnVrTFdoSk1WUUltMk9DSkNlSjgzUWo path=/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/Jb0Vu8rcGMuErjGzzDgdPpdFdTqyAckF protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=8c534ae2-3fef-4c53-96fe-d7d17c57f7d1 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"ep3Vf8PvwN36MSq1Si9vwOgjHj5kvdhM\",\"validated\":\"2026-08-22T00:09:12Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/Jb0Vu8rcGMuErjGzzDgdPpdFdTqyAckF\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=414ca # [6396326.699721] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] The server validated our request415ca # [6396326.699786] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates416ca # [6396326.704834] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=4.271699ms duration-ns=4271699 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=S2ZqSFNKd1htQTdsS0VQT3ZLakRXNW02U0I5b3ZHM24 path=/acme/acme/order/QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=2b3c6cbd-3f9d-4503-810a-3e69a4de5893 response="{\"id\":\"QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M\",\"status\":\"valid\",\"expires\":\"2026-08-23T00:09:12Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-22T00:08:12Z\",\"notAfter\":\"2026-11-20T00:09:12Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/kC7g8yRzmeywruexhewmlArHUPhAHWCn\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/bTZ65hDFOam97hofI8JH8UyKMBhluqGP\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=417ca # [6396326.707599] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info certificate=MIIB0zCCAXqgAwIBAgIRAI2HkGK9oE2XhG0PuEbpsnowCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODIyMDAwODEyWhcNMjYxMTIwMDAwOTEyWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQofYlVwQhpiWRWAObOkYmbQTre077PTHtVCkxKBwmyUZvCPFAQUUlwk25yD0igWggTcKoiXFS29M13UoRqJzd8o4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFNyTWi31xO0eBmWmN7qi2CF+DF1MMB8GA1UdIwQYMBaAFKRym5lMRsWP2nBvfx8dseFDn8uXMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDRwAwRAIgBD5T2+cJKCpj7uMkXUa3ZwaE2nODbLWlKPXWy/oYS0ECICg+KnWbyqDTYGIFOZHWn46BXrM96gP+dwW8eluzAuxo duration=2.16079ms duration-ns=2160790 fields.time="2026-08-22T00:09:12Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=SUs4aWJCYlBsYkx5ZU1Zb2I1NDducG55YVhNcHE0eko path=/acme/acme/certificate/bTZ65hDFOam97hofI8JH8UyKMBhluqGP protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=7007c338-fe08-4c69-a676-0af74726e918 sans="map[dns:[ca.foo]]" serial=188125035971604653452326940294832042618 size=1340 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-08-22T00:08:12Z" valid-to="2026-11-20T00:09:12Z"418ca # [6396326.707878] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] Server responded with a certificate.419ca # [6396326.717226] ca acme-order-renew-ca.foo-start[309]: + mv domainhash.txt certificates/420ca # [6396326.718971] ca acme-order-renew-ca.foo-start[309]: + touch out/acme-success421ca # [6396326.721239] ca acme-order-renew-ca.foo-start[309]: + cmp -s certificates/ca.foo.crt out/fullchain.pem422ca # [6396326.722719] ca acme-order-renew-ca.foo-start[309]: + touch out/renewed423ca # [6396326.724502] ca acme-order-renew-ca.foo-start[309]: + echo Installing new certificate424ca # [6396326.724502] ca acme-order-renew-ca.foo-start[309]: Installing new certificate425ca # [6396326.724502] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.crt out/fullchain.pem426ca # [6396326.726032] ca acme-order-renew-ca.foo-start[354]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'427ca # [6396326.726246] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.key out/key.pem428ca # [6396326.727455] ca acme-order-renew-ca.foo-start[355]: 'certificates/ca.foo.key' -> 'out/key.pem'429ca # [6396326.727652] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem430ca # [6396326.729191] ca acme-order-renew-ca.foo-start[356]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'431ca # [6396326.729401] ca acme-order-renew-ca.foo-start[309]: + ln -sf fullchain.pem out/cert.pem432ca # [6396326.730837] ca acme-order-renew-ca.foo-start[309]: + cat out/key.pem out/fullchain.pem433ca # [6396326.732263] ca acme-order-renew-ca.foo-start[309]: + for fixpath in out certificates434ca # [6396326.732263] ca acme-order-renew-ca.foo-start[309]: + '[' -d out ']'435ca # [6396326.732328] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=rX,o= out436ca # [6396326.733704] ca acme-order-renew-ca.foo-start[309]: + chown -R acme:nginx out437ca # [6396326.736251] ca acme-order-renew-ca.foo-start[309]: + for fixpath in out certificates438ca # [6396326.736251] ca acme-order-renew-ca.foo-start[309]: + '[' -d certificates ']'439ca # [6396326.736358] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=rX,o= certificates440ca # [6396326.737562] ca acme-order-renew-ca.foo-start[309]: + chown -R acme:nginx certificates441ca # [6396326.739687] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=,o= accounts/.442server # [6396326.552218] server acme-order-renew-test.foo-start[270]: Waiting to acquire lock in /run/acme/443server # [6396326.554756] server acme-order-renew-test.foo-start[270]: + set -euo pipefail444server # [6396326.554838] server acme-order-renew-test.foo-start[270]: + echo ad12aa6741ce4bd2c108445server # [6396326.554939] server acme-order-renew-test.foo-start[270]: + cmp -s domainhash.txt certificates/domainhash.txt446server # [6396326.555986] server acme-order-renew-test.foo-start[270]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run447server # [6396326.573661] server acme-order-renew-test.foo-start[282]: 2026/08/22 00:09:12 No key found for account none@none.tld. Generating a P256 key.448server # [6396326.573981] server acme-order-renew-test.foo-start[282]: 2026/08/22 00:09:12 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key449server # [6396326.610133] server acme-order-renew-test.foo-start[282]: 2026/08/22 00:09:12 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority450server # [6396326.611367] server acme-order-renew-test.foo-start[270]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.451server # [6396326.611367] server acme-order-renew-test.foo-start[270]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.452server # [6396326.611367] server acme-order-renew-test.foo-start[270]: + exit 10453server # [6396326.614288] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a454server # [6396326.614380] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'.455server # [6396326.614649] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo.456server # [6396326.615025] server systemd[1]: Startup finished in 3.589s.457ca # [6396326.887163] ca systemd[1]: Reloading Nginx Web Server...458ca # [6396326.890804] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.459ca # [6396326.891002] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.460ca # [6396327.403809] ca nginx[372]: nginx: the configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf syntax is ok461ca # [6396327.404409] ca nginx[372]: nginx: configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf test is successful462ca # [6396327.921844] ca systemd[1]: Reloaded Nginx Web Server.463ca # [6396327.922180] ca systemd[1]: Startup finished in 4.877s.464ca # [6396328.235815] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...465ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 3.42 seconds)466ca # [6396328.741900] ca acme-order-renew-ca.foo-start[387]: Waiting to acquire lock in /run/acme/467ca # [6396328.744313] ca acme-order-renew-ca.foo-start[387]: + set -euo pipefail468ca # [6396328.744389] ca acme-order-renew-ca.foo-start[387]: + echo 88dc4fc401a6091a1bd9469ca # [6396328.744500] ca acme-order-renew-ca.foo-start[387]: + cmp -s domainhash.txt certificates/domainhash.txt470ca # [6396328.745449] ca acme-order-renew-ca.foo-start[387]: + '[' -e certificates/ca.foo.key ']'471ca # [6396328.745449] ca acme-order-renew-ca.foo-start[387]: + '[' -e certificates/ca.foo.crt ']'472ca # [6396328.745978] ca acme-order-renew-ca.foo-start[395]: ++ find accounts -name none@none.tld.key473ca # [6396328.749023] ca acme-order-renew-ca.foo-start[387]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']'474ca # [6396328.749110] ca acme-order-renew-ca.foo-start[387]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic475ca # [6396328.797886] ca step-ca[205]: time="2026-08-22T00:09:14Z" level=info duration="57.761µs" duration-ns=57761 fields.time="2026-08-22T00:09:14Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=92128b32-4b35-4d98-b991-fcea248bda6b response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=476ca # [6396328.798452] ca acme-order-renew-ca.foo-start[396]: 2026/08/22 00:09:14 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint477ca # [6396328.798452] ca acme-order-renew-ca.foo-start[396]: 2026/08/22 00:09:14 [INFO] [ca.foo] The certificate expires at 2026-11-20T00:09:12Z, the renewal can be performed in 1439h59m37.148372019s: no renewal.478ca # [6396328.799186] ca acme-order-renew-ca.foo-start[387]: + mv domainhash.txt certificates/479ca # [6396328.801180] ca acme-order-renew-ca.foo-start[387]: + touch out/acme-success480ca # [6396328.802454] ca acme-order-renew-ca.foo-start[387]: + cmp -s certificates/ca.foo.crt out/fullchain.pem481ca # [6396328.803398] ca acme-order-renew-ca.foo-start[387]: + for fixpath in out certificates482ca # [6396328.803427] ca acme-order-renew-ca.foo-start[387]: + '[' -d out ']'483ca # [6396328.803427] ca acme-order-renew-ca.foo-start[387]: + chmod -R u=rwX,g=rX,o= out484ca # [6396328.805226] ca acme-order-renew-ca.foo-start[387]: + chown -R acme:nginx out485ca # [6396328.809012] ca acme-order-renew-ca.foo-start[387]: + for fixpath in out certificates486ca # [6396328.809042] ca acme-order-renew-ca.foo-start[387]: + '[' -d certificates ']'487ca # [6396328.809042] ca acme-order-renew-ca.foo-start[387]: + chmod -R u=rwX,g=rX,o= certificates488ca # [6396328.810721] ca acme-order-renew-ca.foo-start[387]: + chown -R acme:nginx certificates489ca # [6396328.813078] ca acme-order-renew-ca.foo-start[387]: + chmod -R u=rwX,g=,o= accounts/.490ca # [6396328.982446] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.491ca # [6396328.982672] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.492server: must succeed: systemctl restart acme-test.foo.service493server # [6396332.008783] server systemd[1]: acme-test.foo.service: Deactivated successfully.494server # [6396332.009146] server systemd[1]: Stopped Ensure certificate for test.foo.495server # [6396332.010413] server systemd[1]: Stopping Ensure certificate for test.foo...496server # [6396332.013057] server systemd[1]: Starting Ensure certificate for test.foo...497server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.68 seconds)498client: waiting for success: curl -v https://test.foo499* Host test.foo:443 was resolved.500* IPv6: 2001:db8:1::3501* IPv4: 192.168.1.3502* Trying [2001:db8:1::3]:443...503* ALPN: curl offers h2,http/1.1504} [5 bytes data]505* TLSv1.3 (OUT), TLS handshake, Client hello (1):506} [1552 bytes data]507* SSL Trust Anchors:508* OpenSSL default paths (fallback)509{ [5 bytes data]510* TLSv1.3 (IN), TLS handshake, Server hello (2):511{ [1210 bytes data]512* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):513{ [1 bytes data]514* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):515{ [19 bytes data]516* TLSv1.3 (IN), TLS handshake, Certificate (11):517{ [1009 bytes data]518* TLSv1.3 (IN), TLS handshake, CERT verify (15):519{ [111 bytes data]520* TLSv1.3 (IN), TLS handshake, Finished (20):521{ [52 bytes data]522* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):523} [1 bytes data]524* TLSv1.3 (OUT), TLS handshake, Finished (20):525} [52 bytes data]526* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey527* ALPN: server accepted h2528* Server certificate:529* subject: CN=test.foo530* start date: Aug 22 00:09:11 2026 GMT531* expire date: Sep 21 00:09:11 2028 GMT532* issuer: CN=minica root ca 058ed9533* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384534* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384535* subjectAltName: "test.foo" matches cert's "test.foo"536* OpenSSL verify result: 13537* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)538* closing connection #0539curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)540More details here: https://curl.se/docs/sslcerts.html541542curl failed to verify the legitimacy of the server and therefore could not543establish a secure connection to it. To learn more about this situation and544how to fix it, please visit the webpage mentioned above.545server # [6396332.641877] server acme-test.foo-start[316]: Waiting to acquire lock in /run/acme/546server # [6396332.644717] server acme-test.foo-start[316]: + '[' -e out/acme-success ']'547server # [6396332.644754] server acme-test.foo-start[316]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=548server # [6396332.656656] server acme-test.foo-start[326]: + cd test.foo549server # [6396332.656870] server acme-test.foo-start[326]: + cp -vp cert.pem ../out/cert.pem550server # [6396332.658236] server acme-test.foo-start[327]: 'cert.pem' -> '../out/cert.pem'551server # [6396332.658551] server acme-test.foo-start[326]: + cp -vp key.pem ../out/key.pem552server # [6396332.659827] server acme-test.foo-start[326]: 'key.pem' -> '../out/key.pem'553server # [6396332.660078] server acme-test.foo-start[316]: + cat out/cert.pem ca/cert.pem554server # [6396332.661581] server acme-test.foo-start[316]: + cp ca/cert.pem out/chain.pem555server # [6396332.662956] server acme-test.foo-start[316]: + cat out/key.pem out/fullchain.pem556server # [6396332.664350] server acme-test.foo-start[316]: + for fixpath in out certificates557server # [6396332.664371] server acme-test.foo-start[316]: + '[' -d out ']'558server # [6396332.664387] server acme-test.foo-start[316]: + chmod -R u=rwX,g=rX,o= out559server # [6396332.665621] server acme-test.foo-start[316]: + chown -R acme:nginx out560server # [6396332.667851] server acme-test.foo-start[316]: + for fixpath in out certificates561server # [6396332.667871] server acme-test.foo-start[316]: + '[' -d certificates ']'562server # [6396332.671424] server systemd[1]: Finished Ensure certificate for test.foo.563server # [6396332.673966] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...564server # [6396333.302306] server acme-order-renew-test.foo-start[334]: Waiting to acquire lock in /run/acme/565server # [6396333.305662] server acme-order-renew-test.foo-start[334]: + set -euo pipefail566server # [6396333.305733] server acme-order-renew-test.foo-start[334]: + echo ad12aa6741ce4bd2c108567server # [6396333.305852] server acme-order-renew-test.foo-start[334]: + cmp -s domainhash.txt certificates/domainhash.txt568server # [6396333.307244] server acme-order-renew-test.foo-start[334]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run569server # [6396333.354190] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] acme: Registering account for none@none.tld570server # [6396333.375567] server acme-order-renew-test.foo-start[342]: !!!! HEADS UP !!!!571server # [6396333.375567] server acme-order-renew-test.foo-start[342]: Your account credentials have been saved in your572server # [6396333.375567] server acme-order-renew-test.foo-start[342]: configuration directory at "accounts".573server # [6396333.375567] server acme-order-renew-test.foo-start[342]: You should make a secure backup of this folder now. This574server # [6396333.375567] server acme-order-renew-test.foo-start[342]: configuration directory will also contain private keys575server # [6396333.375567] server acme-order-renew-test.foo-start[342]: generated by lego and certificates obtained from the ACME576server # [6396333.375567] server acme-order-renew-test.foo-start[342]: server. Making regular backups of this folder is ideal.577server # [6396333.375724] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: Obtaining bundled SAN certificate578server # [6396333.440550] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L579server # [6396333.440550] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01580server # [6396333.440550] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: use http-01 solver581server # [6396333.440550] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: Trying to solve HTTP-01582server # [6396333.448771] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] The server validated our request583server # [6396333.448872] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: Validations succeeded; requesting certificates584server # [6396333.463824] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] Server responded with a certificate.585server # [6396333.468811] server acme-order-renew-test.foo-start[334]: + mv domainhash.txt certificates/586server # [6396333.470353] server acme-order-renew-test.foo-start[334]: + touch out/acme-success587server # [6396333.472221] server acme-order-renew-test.foo-start[334]: + cmp -s certificates/test.foo.crt out/fullchain.pem588server # [6396333.473498] server acme-order-renew-test.foo-start[334]: + touch out/renewed589server # [6396333.474971] server acme-order-renew-test.foo-start[334]: + echo Installing new certificate590server # [6396333.474971] server acme-order-renew-test.foo-start[334]: Installing new certificate591server # [6396333.474971] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.crt out/fullchain.pem592server # [6396333.476981] server acme-order-renew-test.foo-start[374]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'593server # [6396333.477325] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.key out/key.pem594server # [6396333.478438] server acme-order-renew-test.foo-start[375]: 'certificates/test.foo.key' -> 'out/key.pem'595server # [6396333.478726] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem596server # [6396333.480548] server acme-order-renew-test.foo-start[376]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'597server # [6396333.480831] server acme-order-renew-test.foo-start[334]: + ln -sf fullchain.pem out/cert.pem598server # [6396333.482117] server acme-order-renew-test.foo-start[334]: + cat out/key.pem out/fullchain.pem599server # [6396333.483814] server acme-order-renew-test.foo-start[334]: + for fixpath in out certificates600server # [6396333.483814] server acme-order-renew-test.foo-start[334]: + '[' -d out ']'601server # [6396333.483900] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=rX,o= out602server # [6396333.485470] server acme-order-renew-test.foo-start[334]: + chown -R acme:nginx out603server # [6396333.488172] server acme-order-renew-test.foo-start[334]: + for fixpath in out certificates604server # [6396333.488172] server acme-order-renew-test.foo-start[334]: + '[' -d certificates ']'605server # [6396333.488172] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=rX,o= certificates606server # [6396333.489709] server acme-order-renew-test.foo-start[334]: + chown -R acme:nginx certificates607server # [6396333.492595] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=,o= accounts/.608ca # [6396333.353144] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration="63.92µs" duration-ns=63920 fields.time="2026-08-22T00:09:19Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=faf10a8a-e7e6-4997-bbb8-86e917db0369 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=609ca # [6396333.370702] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=13.305263ms duration-ns=13305263 fields.time="2026-08-22T00:09:19Z" method=HEAD name=ca nonce=WjJKbGgwZ0ZJOTZPQTlLcERkQWZPTjIwRUZmV2R2U1U path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=f403dd62-389c-4953-b510-e7e6d692b62e size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=610ca # [6396333.374866] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=1.50706ms duration-ns=1507060 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=TkdlNk8zVEpTZWtwcmhsR1FLS1VnWGFub0VMWHhPMlM path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=a4f13b2c-2a99-4042-a8a2-132766001a17 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/mHodQoHFtqNHGb8oif77WIi6f46jg2C4/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=611ca # [6396333.380295] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=2.081309ms duration-ns=2081309 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=cWlEeGFCN2JVak54bjVLcjNYMDlubWFSdDZaM1ZKVGg path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=efa0a38e-c88b-4cc2-97ec-0a10890d130b response="{\"id\":\"mGC5gTTWzehltKiPqTNU196imvFToJTt\",\"status\":\"pending\",\"expires\":\"2026-08-23T00:09:19Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-22T00:08:19Z\",\"notAfter\":\"2026-11-20T00:09:19Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L\"],\"finalize\":\"https://ca.foo/acme/acme/order/mGC5gTTWzehltKiPqTNU196imvFToJTt/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=612ca # [6396333.440153] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=1.43642ms duration-ns=1436420 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=YXJJcFdDSWY4M25SbXE4dUU3V0hNclNqRTBXcllvQ1Q path=/acme/acme/authz/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L protocol=HTTP/1.1 referer= remote-address="::1" request-id=86395e05-917e-4c52-b42d-644e8220ffbb response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"wmNUE37620kWOsSCOzWoFm7zV1iBzn90\",\"url\":\"https://ca.foo/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/t9V86x13P14ohAaLewnzh2BsmZpzlpap\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"wmNUE37620kWOsSCOzWoFm7zV1iBzn90\",\"url\":\"https://ca.foo/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/dpKrL6bx5yBSy9gHI14oI29IBkTCZAuv\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"wmNUE37620kWOsSCOzWoFm7zV1iBzn90\",\"url\":\"https://ca.foo/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/3HHIjTPLeRUdpF2GlkIRENGfQ1dnJ3hp\"}],\"wildcard\":false,\"expires\":\"2026-08-23T00:09:19Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=613ca # [6396333.448085] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=4.615023ms duration-ns=4615023 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=VXBKcGdjTXdsZDhFVHZab2JyNmJka0ZMVDZwYUF4NEI path=/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/dpKrL6bx5yBSy9gHI14oI29IBkTCZAuv protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=e7a6c7ca-6c3a-4958-a137-931264dc7435 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"wmNUE37620kWOsSCOzWoFm7zV1iBzn90\",\"validated\":\"2026-08-22T00:09:19Z\",\"url\":\"https://ca.foo/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/dpKrL6bx5yBSy9gHI14oI29IBkTCZAuv\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=614ca # [6396333.458506] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=6.903815ms duration-ns=6903815 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=OWp5eDBiT05lN1pFeWlwd3NTRWZpNTFweFp4N1ZxMUk path=/acme/acme/order/mGC5gTTWzehltKiPqTNU196imvFToJTt/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=5b7f37ca-271d-47f2-bf8a-534e95a455e2 response="{\"id\":\"mGC5gTTWzehltKiPqTNU196imvFToJTt\",\"status\":\"valid\",\"expires\":\"2026-08-23T00:09:19Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-22T00:08:19Z\",\"notAfter\":\"2026-11-20T00:09:19Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L\"],\"finalize\":\"https://ca.foo/acme/acme/order/mGC5gTTWzehltKiPqTNU196imvFToJTt/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/fjnYsmtrIWI3go4DpRXiA1sxqIWWTbO3\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=615ca # [6396333.463426] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info certificate="MIIB2DCCAX6gAwIBAgIRANe2WFvMCmzf/BMlHV/h1iwwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODIyMDAwODE5WhcNMjYxMTIwMDAwOTE5WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABIHASqjl4ouGT1l4nh8q3wUWUeE5j8p4eM/1E2gbX0pP0319XBjxWaARpryjSKKTbsRwGStYbBHcpdhtImzhlwqjgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUxQ8SJ3DF9yvBE3uAdiUXjTl/UtMwHwYDVR0jBBgwFoAUpHKbmUxGxY/acG9/Hx2x4UOfy5cwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0gAMEUCIFzxbLzuLc4Rp8BL8I3jH7PCrDMAu0jopsSFJTwwCBPnAiEA0e7SljEHKthuiAaZrwsD3Z+rAIe+E57u6QmXlnoPBZY=" duration=1.817625ms duration-ns=1817625 fields.time="2026-08-22T00:09:19Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=SHM0NnpFanJyRnlWNW5xRm9SSzQ1T0pyU0pmOGV6ZXE path=/acme/acme/certificate/fjnYsmtrIWI3go4DpRXiA1sxqIWWTbO3 protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=d0f45d68-0d46-4365-bca2-b47da39f279c sans="map[dns:[test.foo]]" serial=286730809246965706856881617863528535596 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-08-22T00:08:19Z" valid-to="2026-11-20T00:09:19Z"616* Trying [2001:db8:1::3]:443...617* ALPN: curl offers h2,http/1.1618} [5 bytes data]619* TLSv1.3 (OUT), TLS handshake, Client hello (1):620} [1552 bytes data]621* SSL Trust Anchors:622* OpenSSL default paths (fallback)623* Host test.foo:443 was resolved.624* IPv6: 2001:db8:1::3625* IPv4: 192.168.1.3626{ [5 bytes data]627* TLSv1.3 (IN), TLS handshake, Server hello (2):628{ [1210 bytes data]629* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):630{ [1 bytes data]631* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):632{ [19 bytes data]633* TLSv1.3 (IN), TLS handshake, Certificate (11):634{ [1009 bytes data]635* TLSv1.3 (IN), TLS handshake, CERT verify (15):636{ [112 bytes data]637* TLSv1.3 (IN), TLS handshake, Finished (20):638{ [52 bytes data]639* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):640} [1 bytes data]641* TLSv1.3 (OUT), TLS handshake, Finished (20):642} [52 bytes data]643* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey644* ALPN: server accepted h2645* Server certificate:646* subject: CN=test.foo647* start date: Aug 22 00:09:11 2026 GMT648* expire date: Sep 21 00:09:11 2028 GMT649* issuer: CN=minica root ca 058ed9650* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384651* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384652* subjectAltName: "test.foo" matches cert's "test.foo"653* OpenSSL verify result: 13654* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)655* closing connection #0656curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)657More details here: https://curl.se/docs/sslcerts.html658659curl failed to verify the legitimacy of the server and therefore could not660establish a secure connection to it. To learn more about this situation and661how to fix it, please visit the webpage mentioned above.662server # [6396333.626126] server systemd[1]: Reloading Nginx Web Server...663server # [6396333.629984] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.664server # [6396333.630192] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.665server # [6396334.124744] server nginx[392]: nginx: the configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf syntax is ok666server # [6396334.125386] server nginx[392]: nginx: configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf test is successful667* Host test.foo:443 was resolved.668* IPv6: 2001:db8:1::3669* IPv4: 192.168.1.3670* Trying [2001:db8:1::3]:443...671* ALPN: curl offers h2,http/1.1672} [5 bytes data]673* TLSv1.3 (OUT), TLS handshake, Client hello (1):674} [1552 bytes data]675* SSL Trust Anchors:676* OpenSSL default paths (fallback)677{ [5 bytes data]678* TLSv1.3 (IN), TLS handshake, Server hello (2):679{ [1210 bytes data]680* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):681{ [1 bytes data]682* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):683{ [19 bytes data]684* TLSv1.3 (IN), TLS handshake, Certificate (11):685{ [931 bytes data]686* TLSv1.3 (IN), TLS handshake, CERT verify (15):687{ [79 bytes data]688* TLSv1.3 (IN), TLS handshake, Finished (20):689{ [52 bytes data]690* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):691} [1 bytes data]692* TLSv1.3 (OUT), TLS handshake, Finished (20):693} [52 bytes data]694* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey695* ALPN: server accepted h2696* Server certificate:697* subject: CN=test.foo698* start date: Aug 22 00:08:19 2026 GMT699* expire date: Nov 20 00:09:19 2026 GMT700* issuer: CN=Clan Intermediate CA701* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256702* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256703* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256704* subjectAltName: "test.foo" matches cert's "test.foo"705* OpenSSL verify result: 0706* SSL certificate verified via OpenSSL.707* Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 39894 708 % Total % Received % Xferd Average Speed Time Time Time Current709 Dload Upload Total Spent Left Speed710 0 0 0 0 0 0 0 0 0* using HTTP/2711* [HTTP/2] [1] OPENED stream for https://test.foo/712* [HTTP/2] [1] [:method: GET]713* [HTTP/2] [1] [:scheme: https]714* [HTTP/2] [1] [:authority: test.foo]715* [HTTP/2] [1] [:path: /]716* [HTTP/2] [1] [user-agent: curl/8.21.0]717* [HTTP/2] [1] [accept: */*]718} [5 bytes data]719720721722723724* Request completely sent off725{ [5 bytes data]726* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):727{ [265 bytes data]728* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):729{ [265 bytes data]730731732733734735736737{ [5 bytes data]738100 20 100 20 0 0 812 0 0739* Connection #0 to host test.foo:443 left intact740client: (finished: waiting for success: curl -v https://test.foo, in 2.12 seconds)741client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2742Certificate:743 Data:744 Version: 3 (0x2)745 Serial Number:746 d7:b6:58:5b:cc:0a:6c:df:fc:13:25:1d:5f:e1:d6:2c747 Signature Algorithm: ecdsa-with-SHA256748 Issuer: CN=Clan Intermediate CA749 Validity750 Not Before: Aug 22 00:08:19 2026 GMT751 Not After : Nov 20 00:09:19 2026 GMT752 Subject: CN=test.foo753 Subject Public Key Info:754 Public Key Algorithm: id-ecPublicKey755 Public-Key: (256 bit)756 pub:757 04:81:c0:4a:a8:e5:e2:8b:86:4f:59:78:9e:1f:2a:758 df:05:16:51:e1:39:8f:ca:78:78:cf:f5:13:68:1b:759 5f:4a:4f:d3:7d:7d:5c:18:f1:59:a0:11:a6:bc:a3:760 48:a2:93:6e:c4:70:19:2b:58:6c:11:dc:a5:d8:6d:761 22:6c:e1:97:0a762 ASN1 OID: prime256v1763 NIST CURVE: P-256764 X509v3 extensions:765 X509v3 Key Usage: critical766 Digital Signature767 X509v3 Extended Key Usage: 768 TLS Web Server Authentication, TLS Web Client Authentication769 X509v3 Subject Key Identifier: 770 C5:0F:12:27:70:C5:F7:2B:C1:13:7B:80:76:25:17:8D:39:7F:52:D3771 X509v3 Authority Key Identifier: 772 A4:72:9B:99:4C:46:C5:8F:DA:70:6F:7F:1F:1D:B1:E1:43:9F:CB:97773 X509v3 Subject Alternative Name: 774 DNS:test.foo775 1.3.6.1.4.1.37476.9000.64.1: 776 0......acme..777 Signature Algorithm: ecdsa-with-SHA256778 Signature Value:779 30:45:02:20:5c:f1:6c:bc:ee:2d:ce:11:a7:c0:4b:f0:8d:e3:780 1f:b3:c2:ac:33:00:bb:48:e8:a6:c4:85:25:3c:30:08:13:e7:781 02:21:00:d1:ee:d2:96:31:07:2a:d8:6e:88:06:99:af:0b:03:782 dd:9f:ab:00:87:be:13:9e:ee:e9:09:97:96:7a:0f:05:96783client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.05 seconds)784(finished: run the VM test script, in 12.28 seconds)785test script finished in 12.41s786cleanup787kill NspawnMachine (pid 52)788server # [6396334.620385] server systemd[1]: Reloaded Nginx Web Server.789Container ca terminated by signal KILL.790kill NspawnMachine (pid 57)791kill NspawnMachine (pid 56)792Container client terminated by signal KILL.793Container server terminated by signal KILL.794(finished: cleanup, in 0.54 seconds)