these 56 derivations will be built:
  /nix/store/l4s3hilg46786l91xxnck8qrd5zk5c39-system-path.drv
  /nix/store/53gz0xpb6hi1n7f8k9iaf0j65rb177yi-dbus-1.drv
  /nix/store/3yyv0623ddraws79zmjfk1qcwpy46j4w-X-Restart-Triggers-dbus-broker.drv
  /nix/store/3f4j3in4icr0w7mmf5azp7wrbb87lvrd-unit-dbus-broker.service.drv
  /nix/store/2afbh3vl9b4wqmi7rhmal5s3lqq5d2di-user-units.drv
  /nix/store/7i9hc36x5jwnii1gk3h1nqnfx5pdxjkk-nix.conf.drv
  /nix/store/gp8c99h6mwblqzf2pmx80ax2d7hxjli1-unit-script-nix-gc-start.drv
  /nix/store/2xj8ma1f4q37pw3g0ias2wvisyf6jsbi-unit-nix-gc.service.drv
  /nix/store/9p97s7cydrakaiixbbgrnrcw0551rpyd-unit-nix-optimise.service.drv
  /nix/store/kx6mamh3kwimxnppg229zxy58cb8bgpr-unit-dbus-broker.service.drv
  /nix/store/86yd1gg4qy3vym7mkcyzmf44vgn39nzk-X-Restart-Triggers-nix-daemon.drv
  /nix/store/qvq8y9wibbnwi98wsjvw9llk7vqnxz5q-unit-nix-daemon.service.drv
  /nix/store/dxhcs8f88vsb624k3l6b10b549cv921m-tmpfiles.d.drv
  /nix/store/y9vs2brijwc8c2b5mh0vxrsz0hh37z6h-X-Restart-Triggers-systemd-tmpfiles-resetup.drv
  /nix/store/rmxiym60q7p0pgy3rvrqhgl15ngv7yc5-unit-systemd-tmpfiles-resetup.service.drv
  /nix/store/hqd4m2nanj15sbdqkwswammg2n8ga9ly-getty.drv
  /nix/store/yba88nb1hykyxa4w2m2i207xjk5kpazf-getty.drv
  /nix/store/sqw4bjlrvfm5l56jar3vmi77wwalcvif-unit-getty-.service.drv
  /nix/store/b9qz6v4p8nq14x6yaklmxy5ybj3gdxkp-system-units.drv
  /nix/store/qkiz6yqjxg5vdvj5ds3c5n57gkjkwqi9-etc.drv
  /nix/store/m1w862lrxy3cmlnrqhxxsif26nljv7dk-activate.drv
  /nix/store/0f31764hj16ghm9753p33l5m45pgn212-nixos-system-server-test.drv
  /nix/store/r83pgfxcw1n2v781qbslkwagg3w0p541-system-path.drv
  /nix/store/hfdp8pwsxxzhasg8ndcg2w197prj0nxb-dbus-1.drv
  /nix/store/pkyvq9bzv5p1p73rgk7y09vkimippi4r-X-Restart-Triggers-dbus-broker.drv
  /nix/store/gibl8vf5nh7rz7km47zqnhslnk5xdf1d-unit-dbus-broker.service.drv
  /nix/store/36cy4w2pi2w6k7jg152rzzpm1plchm8z-user-units.drv
  /nix/store/n8sp574dsmhbggqmf9hb0wmrri9l2qq3-tmpfiles.d.drv
  /nix/store/3wbzl5zadk20cplik16z31fcvghbrlcz-X-Restart-Triggers-systemd-tmpfiles-resetup.drv
  /nix/store/qxhrn5k10q3b7l2q99pvdzmkpi020xl6-system-path.drv
  /nix/store/am9qkfk9c09a47pkjf3vp7w6d4pqkk2b-dbus-1.drv
  /nix/store/qrrxsdc2h8nzpxn9dc9msx5xy2588qwx-X-Restart-Triggers-dbus-broker.drv
  /nix/store/4b2qclyk27xay6ar619c5acmkskacj4y-unit-dbus-broker.service.drv
  /nix/store/9v7c9rml9c13rfpb3v8iyv9618pih3fc-python3.14-nixos-test-lib-1.0.0.drv
  /nix/store/5k59m3qhfcaxaxyz5kkrpzsj2v6c4j3s-nixos-test-driver-1.1.drv
  /nix/store/7hgnzq5d0x9pk0i03d6a0ia7i525pzmi-unit-systemd-tmpfiles-resetup.service.drv
  /nix/store/hylqa47xmlzklb4mr8hi3kb4bvj1bb5f-unit-dbus-broker.service.drv
  /nix/store/8jjcdzmxgzgm8cz7fq11bq14qm836bp3-system-units.drv
  /nix/store/9nzrx9dbbs7yvvg1n846kva8mh5qmvb6-etc.drv
  /nix/store/acjg6brl33v9v1l84mhj1wk1cvj9axy5-activate.drv
  /nix/store/dl78xg0lmh8q88ds13ikbxhakns9agmz-nixos-system-client-test.drv
  /nix/store/jar8plgfhh075356yf6mdf2pp3381sdn-run-client-nspawn.drv
  /nix/store/bx9ay666mdpxmqa49l3hw83wkl8bjvvs-user-generators.drv
  /nix/store/wwlslfgw81qzfz9qlyr94hwf26df1iah-unit-dbus-broker.service.drv
  /nix/store/d7kgyvbw6k4b3qpsbhrgp60hg0dd7df9-user-units.drv
  /nix/store/imw2kazzmfl6nlf52psv7h2vlnfpdxn3-system-shutdown.drv
  /nix/store/n8nrm9qy69008c3l82hyy6576h07xxvl-system-units.drv
  /nix/store/rr3k22qcv35qb8krj0p5bp7b2yvqp8ml-system-generators.drv
  /nix/store/8f9q88nfvmphaa3rh6x91spppl8jvja2-etc.drv
  /nix/store/kjpb2fr1nxc95hh495nnp0lg2lnxibzf-activate.drv
  /nix/store/7y6r04f2bv7fr2xc9gvm9683k292p1ka-nixos-system-ca-test.drv
  /nix/store/m9nddhhaxh48pm1s4lmi44w57hi2iivm-run-ca-nspawn.drv
  /nix/store/w9gf8l5qjvz4jam4n2zgd57gr67l06zv-run-server-nspawn.drv
  /nix/store/6i3pyx6n59mmyx2kjgpjsp5gvnisi4xb-driverConfiguration.json.drv
  /nix/store/pnv1vpdikgfhhjjcz8jwzdam7ny715xf-nixos-test-driver-certificates.drv
  /nix/store/l1gmwgx65hrhb9wk5j5s0zks83vrpyb4-container-test-run-certificates.drv
building '/nix/store/l4s3hilg46786l91xxnck8qrd5zk5c39-system-path.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/qxhrn5k10q3b7l2q99pvdzmkpi020xl6-system-path.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/r83pgfxcw1n2v781qbslkwagg3w0p541-system-path.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/dxhcs8f88vsb624k3l6b10b549cv921m-tmpfiles.d.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/rr3k22qcv35qb8krj0p5bp7b2yvqp8ml-system-generators.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/imw2kazzmfl6nlf52psv7h2vlnfpdxn3-system-shutdown.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/bx9ay666mdpxmqa49l3hw83wkl8bjvvs-user-generators.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/3wbzl5zadk20cplik16z31fcvghbrlcz-X-Restart-Triggers-systemd-tmpfiles-resetup.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/l4s3hilg46786l91xxnck8qrd5zk5c39-system-path.drv'
system-path> structuredAttrs is enabled
system-path> created 1718 symlinks in user environment
building '/nix/store/qxhrn5k10q3b7l2q99pvdzmkpi020xl6-system-path.drv'
system-path> structuredAttrs is enabled
system-path> created 1718 symlinks in user environment
building '/nix/store/r83pgfxcw1n2v781qbslkwagg3w0p541-system-path.drv'
system-path> structuredAttrs is enabled
system-path> created 1718 symlinks in user environment
building '/nix/store/53gz0xpb6hi1n7f8k9iaf0j65rb177yi-dbus-1.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/dxhcs8f88vsb624k3l6b10b549cv921m-tmpfiles.d.drv'
building '/nix/store/am9qkfk9c09a47pkjf3vp7w6d4pqkk2b-dbus-1.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/y9vs2brijwc8c2b5mh0vxrsz0hh37z6h-X-Restart-Triggers-systemd-tmpfiles-resetup.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/hfdp8pwsxxzhasg8ndcg2w197prj0nxb-dbus-1.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/rr3k22qcv35qb8krj0p5bp7b2yvqp8ml-system-generators.drv'
building '/nix/store/bx9ay666mdpxmqa49l3hw83wkl8bjvvs-user-generators.drv'
building '/nix/store/imw2kazzmfl6nlf52psv7h2vlnfpdxn3-system-shutdown.drv'
building '/nix/store/3wbzl5zadk20cplik16z31fcvghbrlcz-X-Restart-Triggers-systemd-tmpfiles-resetup.drv'
building '/nix/store/7hgnzq5d0x9pk0i03d6a0ia7i525pzmi-unit-systemd-tmpfiles-resetup.service.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/qvq8y9wibbnwi98wsjvw9llk7vqnxz5q-unit-nix-daemon.service.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/53gz0xpb6hi1n7f8k9iaf0j65rb177yi-dbus-1.drv'
building '/nix/store/3yyv0623ddraws79zmjfk1qcwpy46j4w-X-Restart-Triggers-dbus-broker.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/hfdp8pwsxxzhasg8ndcg2w197prj0nxb-dbus-1.drv'
building '/nix/store/pkyvq9bzv5p1p73rgk7y09vkimippi4r-X-Restart-Triggers-dbus-broker.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/y9vs2brijwc8c2b5mh0vxrsz0hh37z6h-X-Restart-Triggers-systemd-tmpfiles-resetup.drv'
building '/nix/store/am9qkfk9c09a47pkjf3vp7w6d4pqkk2b-dbus-1.drv'
building '/nix/store/rmxiym60q7p0pgy3rvrqhgl15ngv7yc5-unit-systemd-tmpfiles-resetup.service.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/qrrxsdc2h8nzpxn9dc9msx5xy2588qwx-X-Restart-Triggers-dbus-broker.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/7hgnzq5d0x9pk0i03d6a0ia7i525pzmi-unit-systemd-tmpfiles-resetup.service.drv'
unit-systemd-tmpfiles-resetup.service> structuredAttrs is enabled
building '/nix/store/qvq8y9wibbnwi98wsjvw9llk7vqnxz5q-unit-nix-daemon.service.drv'
unit-nix-daemon.service> structuredAttrs is enabled
building '/nix/store/3yyv0623ddraws79zmjfk1qcwpy46j4w-X-Restart-Triggers-dbus-broker.drv'
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
building '/nix/store/qrrxsdc2h8nzpxn9dc9msx5xy2588qwx-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/3f4j3in4icr0w7mmf5azp7wrbb87lvrd-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/kx6mamh3kwimxnppg229zxy58cb8bgpr-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/rmxiym60q7p0pgy3rvrqhgl15ngv7yc5-unit-systemd-tmpfiles-resetup.service.drv'
unit-systemd-tmpfiles-resetup.service> structuredAttrs is enabled
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
building '/nix/store/4b2qclyk27xay6ar619c5acmkskacj4y-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/wwlslfgw81qzfz9qlyr94hwf26df1iah-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/pkyvq9bzv5p1p73rgk7y09vkimippi4r-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/gibl8vf5nh7rz7km47zqnhslnk5xdf1d-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/hylqa47xmlzklb4mr8hi3kb4bvj1bb5f-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol'
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
building '/nix/store/hylqa47xmlzklb4mr8hi3kb4bvj1bb5f-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/3f4j3in4icr0w7mmf5azp7wrbb87lvrd-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
building '/nix/store/kx6mamh3kwimxnppg229zxy58cb8bgpr-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/4b2qclyk27xay6ar619c5acmkskacj4y-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/n8nrm9qy69008c3l82hyy6576h07xxvl-system-units.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/wwlslfgw81qzfz9qlyr94hwf26df1iah-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/b9qz6v4p8nq14x6yaklmxy5ybj3gdxkp-system-units.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/2afbh3vl9b4wqmi7rhmal5s3lqq5d2di-user-units.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/8jjcdzmxgzgm8cz7fq11bq14qm836bp3-system-units.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/d7kgyvbw6k4b3qpsbhrgp60hg0dd7df9-user-units.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/gibl8vf5nh7rz7km47zqnhslnk5xdf1d-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/36cy4w2pi2w6k7jg152rzzpm1plchm8z-user-units.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/n8nrm9qy69008c3l82hyy6576h07xxvl-system-units.drv'
building '/nix/store/2afbh3vl9b4wqmi7rhmal5s3lqq5d2di-user-units.drv'
building '/nix/store/b9qz6v4p8nq14x6yaklmxy5ybj3gdxkp-system-units.drv'
building '/nix/store/8jjcdzmxgzgm8cz7fq11bq14qm836bp3-system-units.drv'
building '/nix/store/qkiz6yqjxg5vdvj5ds3c5n57gkjkwqi9-etc.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/36cy4w2pi2w6k7jg152rzzpm1plchm8z-user-units.drv'
building '/nix/store/d7kgyvbw6k4b3qpsbhrgp60hg0dd7df9-user-units.drv'
building '/nix/store/9nzrx9dbbs7yvvg1n846kva8mh5qmvb6-etc.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/8f9q88nfvmphaa3rh6x91spppl8jvja2-etc.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/qkiz6yqjxg5vdvj5ds3c5n57gkjkwqi9-etc.drv'
building '/nix/store/m1w862lrxy3cmlnrqhxxsif26nljv7dk-activate.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/9nzrx9dbbs7yvvg1n846kva8mh5qmvb6-etc.drv'
building '/nix/store/acjg6brl33v9v1l84mhj1wk1cvj9axy5-activate.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/8f9q88nfvmphaa3rh6x91spppl8jvja2-etc.drv'
building '/nix/store/kjpb2fr1nxc95hh495nnp0lg2lnxibzf-activate.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/m1w862lrxy3cmlnrqhxxsif26nljv7dk-activate.drv'
building '/nix/store/acjg6brl33v9v1l84mhj1wk1cvj9axy5-activate.drv'
building '/nix/store/dl78xg0lmh8q88ds13ikbxhakns9agmz-nixos-system-client-test.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/kjpb2fr1nxc95hh495nnp0lg2lnxibzf-activate.drv'
building '/nix/store/7y6r04f2bv7fr2xc9gvm9683k292p1ka-nixos-system-ca-test.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/0f31764hj16ghm9753p33l5m45pgn212-nixos-system-server-test.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/dl78xg0lmh8q88ds13ikbxhakns9agmz-nixos-system-client-test.drv'
nixos-system-client-test> structuredAttrs is enabled
building '/nix/store/jar8plgfhh075356yf6mdf2pp3381sdn-run-client-nspawn.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/7y6r04f2bv7fr2xc9gvm9683k292p1ka-nixos-system-ca-test.drv'
nixos-system-ca-test> structuredAttrs is enabled
building '/nix/store/m9nddhhaxh48pm1s4lmi44w57hi2iivm-run-ca-nspawn.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/0f31764hj16ghm9753p33l5m45pgn212-nixos-system-server-test.drv'
nixos-system-server-test> structuredAttrs is enabled
building '/nix/store/w9gf8l5qjvz4jam4n2zgd57gr67l06zv-run-server-nspawn.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/jar8plgfhh075356yf6mdf2pp3381sdn-run-client-nspawn.drv'
building '/nix/store/m9nddhhaxh48pm1s4lmi44w57hi2iivm-run-ca-nspawn.drv'
building '/nix/store/w9gf8l5qjvz4jam4n2zgd57gr67l06zv-run-server-nspawn.drv'
warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy
building '/nix/store/6i3pyx6n59mmyx2kjgpjsp5gvnisi4xb-driverConfiguration.json.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/6i3pyx6n59mmyx2kjgpjsp5gvnisi4xb-driverConfiguration.json.drv'
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/pnv1vpdikgfhhjjcz8jwzdam7ny715xf-nixos-test-driver-certificates.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/pnv1vpdikgfhhjjcz8jwzdam7ny715xf-nixos-test-driver-certificates.drv'
nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-certificates> All checks passed!
nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-certificates> All checks passed!
building '/nix/store/l1gmwgx65hrhb9wk5j5s0zks83vrpyb4-container-test-run-certificates.drv' on 'ssh-ng://builder@build01.clan.lol'
building '/nix/store/l1gmwgx65hrhb9wk5j5s0zks83vrpyb4-container-test-run-certificates.drv'
container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-certificates> start all VLans
container-test-run-certificates> (finished: start all VLans, in 0.00 seconds)
container-test-run-certificates> 
container-test-run-certificates> Test will time out and terminate in 3600.0 seconds
container-test-run-certificates> run the VM test script
container-test-run-certificates> additionally exposed symbols:
container-test-run-certificates>     ca, client, server,
container-test-run-certificates>     vlan1,
container-test-run-certificates>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-certificates> start all VMs
container-test-run-certificates> ca: systemd-nspawn running (pid 52)
container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal...
container-test-run-certificates> server: systemd-nspawn running (pid 56)
container-test-run-certificates> client: systemd-nspawn running (pid 57)
container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal...
container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal...
container-test-run-certificates> (finished: start all VMs, in 0.00 seconds)
container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container client on /build/vm-state-client.
container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container server on /build/vm-state-server.
container-test-run-certificates> ca # [6396323.425213] ca systemd-journald[79]: Journal started
container-test-run-certificates> ca # [6396323.425271] ca systemd-journald[79]: Runtime Journal (/run/log/journal/1114226367a34c6294783a98c04e5fb5) is 8M, max 2.5G, 2.4G free.
container-test-run-certificates> ca # [6396323.433792] ca systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> ca # [6396323.434556] ca systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> ca # [6396323.435345] ca systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> ca # [6396323.444474] ca systemd-journald[79]: Time spent on flushing to /var/log/journal/1114226367a34c6294783a98c04e5fb5 is 1.478ms for 5 entries.
container-test-run-certificates> ca # [6396323.444474] ca systemd-journald[79]: System Journal (/var/log/journal/1114226367a34c6294783a98c04e5fb5) is 8M, max 4G, 3.9G free.
container-test-run-certificates> ca # [6396323.453381] ca systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> ca # [6396323.454041] ca systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> ca # [6396323.454172] ca systemd[1]: Reached target Local File Systems.
container-test-run-certificates> ca # [6396323.454971] ca systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> ca # [6396323.455026] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [6396323.456134] ca systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> ca # [6396323.456167] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> ca # [6396323.458423] ca systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> ca # [6396323.459422] ca systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> ca # [6396323.473777] ca systemd-tmpfiles[123]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> ca # [6396323.473961] ca systemd-tmpfiles[123]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [6396323.474084] ca systemd-tmpfiles[123]: fchmod() of /var/log/journal/1114226367a34c6294783a98c04e5fb5 failed: Operation not permitted
container-test-run-certificates> ca # [6396323.474270] ca systemd-tmpfiles[123]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [6396323.475629] ca systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> ca # [6396323.476633] ca systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> ca # [6396323.477277] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [6396323.492046] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> ca # [6396323.495160] ca systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> ca # [6396323.496256] ca systemd[1]: Starting Update is Completed...
container-test-run-certificates> ca # [6396323.505878] ca systemd[1]: Finished Update is Completed.
container-test-run-certificates> server # [6396323.423330] server systemd-journald[69]: Journal started
container-test-run-certificates> server # [6396323.423387] server systemd-journald[69]: Runtime Journal (/run/log/journal/1ff41e9b086c4ee0abcae26e0ffbbafe) is 8M, max 2.5G, 2.4G free.
container-test-run-certificates> server # [6396323.424807] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [6396323.433191] server systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> server # [6396323.434018] server systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> server # [6396323.434663] server systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> server # [6396323.444328] server systemd-journald[69]: Time spent on flushing to /var/log/journal/1ff41e9b086c4ee0abcae26e0ffbbafe is 1.709ms for 6 entries.
container-test-run-certificates> server # [6396323.444328] server systemd-journald[69]: System Journal (/var/log/journal/1ff41e9b086c4ee0abcae26e0ffbbafe) is 8M, max 4G, 3.9G free.
container-test-run-certificates> server # [6396323.453487] server systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> server # [6396323.454205] server systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> server # [6396323.454322] server systemd[1]: Reached target Local File Systems.
container-test-run-certificates> server # [6396323.455108] server systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> server # [6396323.455152] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [6396323.455963] server systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> server # [6396323.455997] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> server # [6396323.458624] server systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> server # [6396323.459632] server systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> server # [6396323.476038] server systemd-tmpfiles[111]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> server # [6396323.476295] server systemd-tmpfiles[111]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> server # [6396323.476463] server systemd-tmpfiles[111]: fchmod() of /var/log/journal/1ff41e9b086c4ee0abcae26e0ffbbafe failed: Operation not permitted
container-test-run-certificates> server # [6396323.476696] server systemd-tmpfiles[111]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> server # [6396323.478318] server systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> server # [6396323.479306] server systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> server # [6396323.479930] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> server # [6396323.491071] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> server # [6396323.499607] server systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> server # [6396323.500836] server systemd[1]: Starting Update is Completed...
container-test-run-certificates> server # [6396323.511521] server systemd[1]: Finished Update is Completed.
container-test-run-certificates> client # [6396323.416099] client systemd-journald[69]: Journal started
container-test-run-certificates> client # [6396323.416167] client systemd-journald[69]: Runtime Journal (/run/log/journal/84bcf4e2c6fc41b280a82643ffa1f7aa) is 8M, max 2.5G, 2.4G free.
container-test-run-certificates> client # [6396323.417856] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> client # [6396323.427204] client systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> client # [6396323.428107] client systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [6396323.428798] client systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> client # [6396323.437832] client systemd-journald[69]: Time spent on flushing to /var/log/journal/84bcf4e2c6fc41b280a82643ffa1f7aa is 1.413ms for 6 entries.
container-test-run-certificates> client # [6396323.437832] client systemd-journald[69]: System Journal (/var/log/journal/84bcf4e2c6fc41b280a82643ffa1f7aa) is 8M, max 4G, 3.9G free.
container-test-run-certificates> client # [6396323.445338] client systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> client # [6396323.445589] client systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> client # [6396323.445675] client systemd[1]: Reached target Local File Systems.
container-test-run-certificates> client # [6396323.446420] client systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> client # [6396323.446464] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [6396323.447361] client systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> client # [6396323.447396] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> client # [6396323.448644] client systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> client # [6396323.449533] client systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> client # [6396323.463181] client systemd-tmpfiles[112]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> client # [6396323.463360] client systemd-tmpfiles[112]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6396323.463494] client systemd-tmpfiles[112]: fchmod() of /var/log/journal/84bcf4e2c6fc41b280a82643ffa1f7aa failed: Operation not permitted
container-test-run-certificates> client # [6396323.463678] client systemd-tmpfiles[112]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [6396323.465140] client systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> client # [6396323.466165] client systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [6396323.466932] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> client # [6396323.479172] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> client # [6396323.487869] client systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> client # [6396323.488955] client systemd[1]: Starting Update is Completed...
container-test-run-certificates> client # [6396323.498926] client systemd[1]: Finished Update is Completed.
container-test-run-certificates> client # [6396323.554310] client systemd[1]: Finished Firewall.
container-test-run-certificates> client # [6396323.554449] client systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> client # [6396323.554661] client systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> client # [6396323.555706] client systemd[1]: Starting Network Management...
container-test-run-certificates> server # [6396323.604226] server systemd[1]: Finished Firewall.
container-test-run-certificates> ca # [6396323.604200] ca systemd[1]: Finished Firewall.
container-test-run-certificates> server # [6396323.604431] server systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> ca # [6396323.604385] ca systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> server # [6396323.604634] server systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> ca # [6396323.604634] ca systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> server # [6396323.605602] server systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [6396323.605795] ca systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [6396324.001672] ca systemd-networkd[196]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [6396324.001762] ca systemd-networkd[196]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [6396324.008608] ca systemd-networkd[196]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [6396324.008773] ca systemd-networkd[196]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [6396324.008936] ca systemd-networkd[196]: lo: Link UP
container-test-run-certificates> ca # [6396324.008940] ca systemd-networkd[196]: lo: Gained carrier
container-test-run-certificates> ca # [6396324.009141] ca systemd-networkd[196]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> ca # [6396324.009500] ca systemd[1]: Started Network Management.
container-test-run-certificates> ca # [6396324.036379] ca systemd-networkd[196]: eth1: Link UP
container-test-run-certificates> ca # [6396324.036498] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> ca # [6396324.036632] ca systemd-networkd[196]: eth1: Gained carrier
container-test-run-certificates> ca # [6396324.074621] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> ca # [6396324.077460] ca systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> ca # [6396324.111965] ca systemd-resolved[102]: Positive Trust Anchors:
container-test-run-certificates> ca # [6396324.111977] ca systemd-resolved[102]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> ca # [6396324.111980] ca systemd-resolved[102]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> ca # [6396324.112027] ca systemd-resolved[102]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> ca # [6396324.134651] ca systemd-resolved[102]: Using system hostname 'ca'.
container-test-run-certificates> ca # [6396324.136206] ca systemd[1]: Started Network Name Resolution.
container-test-run-certificates> ca # [6396324.136301] ca systemd[1]: Reached target Network.
container-test-run-certificates> ca # [6396324.136365] ca systemd[1]: Reached target Network is Online.
container-test-run-certificates> ca # [6396324.136411] ca systemd[1]: Reached target System Initialization.
container-test-run-certificates> ca # [6396324.136648] ca systemd[1]: Started Renew ACME Certificate for ca.foo.
container-test-run-certificates> ca # [6396324.136675] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [6396324.136701] ca systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> ca # [6396324.136718] ca systemd[1]: Reached target Timer Units.
container-test-run-certificates> ca # [6396324.136847] ca systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> ca # [6396324.136951] ca systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> ca # [6396324.137062] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> ca # [6396324.137090] ca systemd[1]: Reached target Socket Units.
container-test-run-certificates> ca # [6396324.137128] ca systemd[1]: Reached target Basic System.
container-test-run-certificates> ca # [6396324.138429] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> ca # [6396324.139146] ca systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> ca # [6396324.139185] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem
container-test-run-certificates> ca # [6396324.139949] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> ca # [6396324.140865] ca systemd[1]: Starting step-ca service...
container-test-run-certificates> ca # [6396324.142077] ca systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> ca # [6396324.216289] ca systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> ca # [6396324.296789] ca acme-setup-privileged[202]: + set -euo pipefail
container-test-run-certificates> ca # [6396324.296789] ca acme-setup-privileged[202]: + cd /var/lib/acme
container-test-run-certificates> ca # [6396324.296789] ca acme-setup-privileged[202]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> ca # [6396324.298399] ca acme-setup-privileged[202]: + chown -R acme .lego/accounts
container-test-run-certificates> server # [6396323.993544] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [6396323.993640] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [6396324.000458] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [6396324.000629] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [6396324.000838] server systemd-networkd[186]: lo: Link UP
container-test-run-certificates> server # [6396324.000841] server systemd-networkd[186]: lo: Gained carrier
container-test-run-certificates> server # [6396324.001005] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> server # [6396324.001362] server systemd[1]: Started Network Management.
container-test-run-certificates> server # [6396324.001554] server systemd-networkd[186]: eth1: Link UP
container-test-run-certificates> server # [6396324.001833] server systemd-networkd[186]: eth1: Gained carrier
container-test-run-certificates> server # [6396324.002424] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> server # [6396324.045743] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [6396324.077271] server systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> server # [6396324.127727] server systemd-resolved[90]: Positive Trust Anchors:
container-test-run-certificates> server # [6396324.127738] server systemd-resolved[90]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> server # [6396324.127740] server systemd-resolved[90]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> server # [6396324.127776] server systemd-resolved[90]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> server # [6396324.149801] server systemd-resolved[90]: Using system hostname 'server'.
container-test-run-certificates> server # [6396324.151178] server systemd[1]: Started Network Name Resolution.
container-test-run-certificates> server # [6396324.151260] server systemd[1]: Reached target Network.
container-test-run-certificates> server # [6396324.151313] server systemd[1]: Reached target Network is Online.
container-test-run-certificates> server # [6396324.151351] server systemd[1]: Reached target System Initialization.
container-test-run-certificates> server # [6396324.151562] server systemd[1]: Started Renew ACME Certificate for test.foo.
container-test-run-certificates> server # [6396324.151598] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [6396324.151619] server systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> server # [6396324.151638] server systemd[1]: Reached target Timer Units.
container-test-run-certificates> server # [6396324.151746] server systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> server # [6396324.151841] server systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> server # [6396324.151940] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> server # [6396324.151964] server systemd[1]: Reached target Socket Units.
container-test-run-certificates> server # [6396324.152020] server systemd[1]: Reached target Basic System.
container-test-run-certificates> server # [6396324.201302] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> server # [6396324.202338] server systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> server # [6396324.202384] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem
container-test-run-certificates> server # [6396324.203340] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> server # [6396324.204462] server systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> server # [6396324.222337] server systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> server # [6396324.304515] server acme-setup-privileged[192]: + set -euo pipefail
container-test-run-certificates> server # [6396324.304515] server acme-setup-privileged[192]: + cd /var/lib/acme
container-test-run-certificates> server # [6396324.304515] server acme-setup-privileged[192]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> client # [6396323.993698] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [6396323.993786] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [6396324.000442] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [6396324.000606] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [6396324.000792] client systemd-networkd[182]: lo: Link UP
container-test-run-certificates> client # [6396324.000797] client systemd-networkd[182]: lo: Gained carrier
container-test-run-certificates> client # [6396324.001004] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> client # [6396324.001367] client systemd[1]: Started Network Management.
container-test-run-certificates> client # [6396324.001464] client systemd-networkd[182]: eth1: Link UP
container-test-run-certificates> client # [6396324.002042] client systemd-networkd[182]: eth1: Gained carrier
container-test-run-certificates> client # [6396324.002468] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> client # [6396324.045934] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> client # [6396324.077794] client systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [6396324.117692] client systemd-resolved[94]: Positive Trust Anchors:
container-test-run-certificates> client # [6396324.117703] client systemd-resolved[94]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> client # [6396324.117706] client systemd-resolved[94]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> client # [6396324.117743] client systemd-resolved[94]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> client # [6396324.139961] client systemd-resolved[94]: Using system hostname 'client'.
container-test-run-certificates> client # [6396324.141381] client systemd[1]: Started Network Name Resolution.
container-test-run-certificates> client # [6396324.141459] client systemd[1]: Reached target Network.
container-test-run-certificates> client # [6396324.141529] client systemd[1]: Reached target System Initialization.
container-test-run-certificates> client # [6396324.141575] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [6396324.141606] client systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> client # [6396324.141623] client systemd[1]: Reached target Timer Units.
container-test-run-certificates> client # [6396324.141740] client systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> client # [6396324.141847] client systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> client # [6396324.141949] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> client # [6396324.141970] client systemd[1]: Reached target Socket Units.
container-test-run-certificates> client # [6396324.142003] client systemd[1]: Reached target Basic System.
container-test-run-certificates> client # [6396324.200523] client systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> client # [6396324.202445] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> client # [6396324.203981] client systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> client # [6396324.219995] client systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> client # [6396324.318589] client nsncd[189]: Aug 22 00:09:10.371 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> client # [6396324.318733] client systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> client # [6396324.318822] client systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> client # [6396324.318913] client systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> ca # [6396324.300060] ca acme-setup-privileged[202]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [6396324.300097] ca acme-setup-privileged[202]: + '[' -d ca.foo ']'
container-test-run-certificates> ca # [6396324.300097] ca acme-setup-privileged[202]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [6396324.300097] ca acme-setup-privileged[202]: + '[' -d .lego/ca.foo ']'
container-test-run-certificates> ca # [6396324.355730] ca nsncd[204]: Aug 22 00:09:10.408 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> ca # [6396324.355781] ca systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> ca # [6396324.355845] ca systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> ca # [6396324.355898] ca systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> ca # [6396324.357046] ca systemd[1]: Starting User Login Management...
container-test-run-certificates> ca # [6396324.357766] ca systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> ca # [6396324.367488] ca systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> ca # [6396324.368446] ca systemd[1]: Started Console Getty.
container-test-run-certificates> ca # [6396324.368490] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> ca # [6396324.368512] ca systemd[1]: Reached target Login Prompts.
container-test-run-certificates> ca # [6396324.410480] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> ca # [6396324.429126] ca dbus-broker-launch[206]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> ca # [6396324.430514] ca dbus-broker-launch[206]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> ca # [6396324.430514] ca dbus-broker-launch[206]: Invalid user-name in /nix/store/mfvkn1zwby5692v4kx3ynjdz34b2lkq3-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> ca # [6396324.430921] ca systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> ca # [6396324.437715] ca dbus-broker-launch[206]: Ready
container-test-run-certificates> server # [6396324.306192] server acme-setup-privileged[192]: + chown -R acme .lego/accounts
container-test-run-certificates> server # [6396324.307614] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [6396324.307680] server acme-setup-privileged[192]: + '[' -d test.foo ']'
container-test-run-certificates> server # [6396324.307680] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [6396324.307680] server acme-setup-privileged[192]: + '[' -d .lego/test.foo ']'
container-test-run-certificates> server # [6396324.323832] server nsncd[194]: Aug 22 00:09:10.376 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> server # [6396324.324137] server systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> server # [6396324.324252] server systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> server # [6396324.324360] server systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> server # [6396324.326293] server systemd[1]: Starting User Login Management...
container-test-run-certificates> server # [6396324.327504] server systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> server # [6396324.337507] server systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> server # [6396324.338471] server systemd[1]: Started Console Getty.
container-test-run-certificates> server # [6396324.338508] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> server # [6396324.338528] server systemd[1]: Reached target Login Prompts.
container-test-run-certificates> server # [6396324.411016] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> server # [6396324.425097] server dbus-broker-launch[195]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> server # [6396324.426188] server dbus-broker-launch[195]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> server # [6396324.426188] server dbus-broker-launch[195]: Invalid user-name in /nix/store/lxnlg1wvz5bx4xfzc75k21l11ngxkyck-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> server # [6396324.426850] server systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> server # [6396324.435599] server dbus-broker-launch[195]: Ready
container-test-run-certificates> client # [6396324.320828] client systemd[1]: Starting User Login Management...
container-test-run-certificates> client # [6396324.321932] client systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> client # [6396324.331750] client systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> client # [6396324.334075] client systemd[1]: Started Console Getty.
container-test-run-certificates> client # [6396324.334125] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> client # [6396324.334142] client systemd[1]: Reached target Login Prompts.
container-test-run-certificates> client # [6396324.399646] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [6396324.418840] client dbus-broker-launch[190]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> client # [6396324.420105] client dbus-broker-launch[190]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> client # [6396324.420105] client dbus-broker-launch[190]: Invalid user-name in /nix/store/s0a40wv0lnwiz13r43fk318ri3wv536k-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> client # [6396324.420490] client systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> client # [6396324.427527] client dbus-broker-launch[190]: Ready
container-test-run-certificates> client # [6396324.828542] client systemd-logind[205]: New seat seat0.
container-test-run-certificates> server # [6396324.833739] server systemd-logind[224]: New seat seat0.
container-test-run-certificates> client # [6396324.828792] client systemd[1]: Started User Login Management.
container-test-run-certificates> client # [6396324.830034] client systemd[1]: Starting linger-users.service...
container-test-run-certificates> client # [6396324.841496] client systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> client # [6396324.841657] client systemd[1]: Finished linger-users.service.
container-test-run-certificates> client # [6396324.842087] client systemd[1]: Reached target Multi-User System.
container-test-run-certificates> client # [6396324.842251] client systemd[1]: Startup finished in 1.818s.
container-test-run-certificates> server # [6396324.833909] server systemd[1]: Started User Login Management.
container-test-run-certificates> server # [6396324.834982] server systemd[1]: Starting linger-users.service...
container-test-run-certificates> server # [6396324.845649] server systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> server # [6396324.845745] server systemd[1]: Finished linger-users.service.
container-test-run-certificates> server # [6396324.876827] server acme-setup-start[208]: + set -euo pipefail
container-test-run-certificates> server # [6396324.876827] server acme-setup-start[208]: + test -e ca/key.pem
container-test-run-certificates> server # [6396324.877234] server acme-setup-start[208]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> server # [6396324.897082] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> server # [6396324.898500] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> ca # [6396324.854372] ca systemd-logind[236]: New seat seat0.
container-test-run-certificates> ca # [6396324.854568] ca systemd[1]: Started User Login Management.
container-test-run-certificates> ca # [6396324.855947] ca systemd[1]: Starting linger-users.service...
container-test-run-certificates> ca # [6396324.870353] ca acme-setup-start[220]: + set -euo pipefail
container-test-run-certificates> ca # [6396324.870353] ca acme-setup-start[220]: + test -e ca/key.pem
container-test-run-certificates> ca # [6396324.870630] ca acme-setup-start[220]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> ca # [6396324.871635] ca systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> ca # [6396324.871778] ca systemd[1]: Finished linger-users.service.
container-test-run-certificates> ca # [6396324.887219] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> ca # [6396324.888880] ca systemd[1]: Starting Ensure certificate for ca.foo...
container-test-run-certificates> ca # [6396325.009128] ca step-ca[205]: badger 2026/08/22 00:09:11 INFO: All 0 tables opened in 0s
container-test-run-certificates> ca # [6396325.012788] ca step-ca[205]: 2026/08/22 00:09:11 Building new tls configuration using step-ca x509 Signer Interface
container-test-run-certificates> ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Starting Smallstep CA/0.30.2 (linux/arm64)
container-test-run-certificates> ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Documentation: https://u.step.sm/docs/ca
container-test-run-certificates> ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Community Discord: https://u.step.sm/discord
container-test-run-certificates> ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Config file: /etc/smallstep/ca.json
container-test-run-certificates> ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 The primary server URL is https://ca.foo:1443
container-test-run-certificates> ca # [6396325.019090] ca step-ca[205]: 2026/08/22 00:09:11 Root certificates are available at https://ca.foo:1443/roots.pem
container-test-run-certificates> ca # [6396325.019229] ca step-ca[205]: 2026/08/22 00:09:11 X.509 Root Fingerprint: 1a7ad12f92f4a81d1038b71212f5a044a8d7b0fb93aa69f507b3d4033bfed054
container-test-run-certificates> ca # [6396325.019563] ca systemd[1]: Started step-ca service.
container-test-run-certificates> ca # [6396325.019839] ca step-ca[205]: 2026/08/22 00:09:11 Serving HTTPS on 0.0.0.0:1443 ...
container-test-run-certificates> ca: must succeed: systemctl restart acme-order-renew-ca.foo.service 
container-test-run-certificates> ca # [6396325.405959] ca acme-ca.foo-start[257]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6396325.409136] ca acme-ca.foo-start[257]: + '[' -e out/acme-success ']'
container-test-run-certificates> ca # [6396325.409136] ca acme-ca.foo-start[257]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=
container-test-run-certificates> ca # [6396325.420156] ca acme-ca.foo-start[294]: + cd ca.foo
container-test-run-certificates> ca # [6396325.420809] ca acme-ca.foo-start[294]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> ca # [6396325.421640] ca acme-ca.foo-start[295]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> ca # [6396325.421980] ca acme-ca.foo-start[294]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> ca # [6396325.423298] ca acme-ca.foo-start[294]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> ca # [6396325.423557] ca acme-ca.foo-start[257]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> ca # [6396325.425607] ca acme-ca.foo-start[257]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> ca # [6396325.427043] ca acme-ca.foo-start[257]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [6396325.428530] ca acme-ca.foo-start[257]: + for fixpath in out certificates
container-test-run-certificates> ca # [6396325.428530] ca acme-ca.foo-start[257]: + '[' -d out ']'
container-test-run-certificates> ca # [6396325.428647] ca acme-ca.foo-start[257]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6396325.430509] ca acme-ca.foo-start[257]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6396325.434993] ca acme-ca.foo-start[257]: + for fixpath in out certificates
container-test-run-certificates> ca # [6396325.434993] ca acme-ca.foo-start[257]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6396325.437813] ca systemd[1]: Finished Ensure certificate for ca.foo.
container-test-run-certificates> ca # [6396325.439576] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca # [6396325.632259] ca systemd-networkd[196]: eth1: Gained IPv6LL
container-test-run-certificates> server # [6396325.405293] server acme-test.foo-start[245]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6396325.407746] server acme-test.foo-start[245]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [6396325.407746] server acme-test.foo-start[245]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [6396325.421554] server acme-test.foo-start[255]: + cd test.foo
container-test-run-certificates> server # [6396325.422174] server acme-test.foo-start[255]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [6396325.423434] server acme-test.foo-start[256]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [6396325.424117] server acme-test.foo-start[255]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [6396325.425807] server acme-test.foo-start[255]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [6396325.426075] server acme-test.foo-start[245]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [6396325.427726] server acme-test.foo-start[245]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [6396325.429249] server acme-test.foo-start[245]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6396325.430650] server acme-test.foo-start[245]: + for fixpath in out certificates
container-test-run-certificates> server # [6396325.430650] server acme-test.foo-start[245]: + '[' -d out ']'
container-test-run-certificates> server # [6396325.430758] server acme-test.foo-start[245]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6396325.432335] server acme-test.foo-start[245]: + chown -R acme:nginx out
container-test-run-certificates> server # [6396325.435235] server acme-test.foo-start[245]: + for fixpath in out certificates
container-test-run-certificates> server # [6396325.435235] server acme-test.foo-start[245]: + '[' -d certificates ']'
container-test-run-certificates> server # [6396325.438837] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [6396325.440098] server systemd-networkd[186]: eth1: Gained IPv6LL
container-test-run-certificates> server # [6396325.441233] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> client # [6396325.920240] client systemd-networkd[182]: eth1: Gained IPv6LL
container-test-run-certificates> ca # [6396326.008383] ca nginx-pre-start[306]: nginx: the configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf syntax is ok
container-test-run-certificates> server # [6396325.979135] server nginx-pre-start[267]: nginx: the configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf syntax is ok
container-test-run-certificates> ca # [6396326.008704] ca nginx-pre-start[306]: nginx: configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf test is successful
container-test-run-certificates> ca # [6396326.020377] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [6396325.979909] server nginx-pre-start[267]: nginx: configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf test is successful
container-test-run-certificates> ca # [6396326.020760] ca systemd[1]: Reached target Multi-User System.
container-test-run-certificates> ca # [6396326.021940] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> server # [6396325.984593] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [6396325.985359] server systemd[1]: Reached target Multi-User System.
container-test-run-certificates> server # [6396325.987556] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> ca # [6396326.541110] ca acme-order-renew-ca.foo-start[309]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6396326.544176] ca acme-order-renew-ca.foo-start[309]: + set -euo pipefail
container-test-run-certificates> ca # [6396326.544251] ca acme-order-renew-ca.foo-start[309]: + echo 88dc4fc401a6091a1bd9
container-test-run-certificates> ca # [6396326.544367] ca acme-order-renew-ca.foo-start[309]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> ca # [6396326.545474] ca acme-order-renew-ca.foo-start[309]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run
container-test-run-certificates> ca # [6396326.571276] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 No key found for account none@none.tld. Generating a P256 key.
container-test-run-certificates> ca # [6396326.571619] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key
container-test-run-certificates> ca # [6396326.597235] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration="330.445µs" duration-ns=330445 fields.time="2026-08-22T00:09:12Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=7ff74ded-6e6e-4982-bca1-80c490c99ab4 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396326.597631] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] acme: Registering account for none@none.tld
container-test-run-certificates> ca # [6396326.621322] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=23.539484ms duration-ns=23539484 fields.time="2026-08-22T00:09:12Z" method=HEAD name=ca nonce=dHRCeFJHRU1wdWxTd2FWNEJNcVIwV0tMZU5JRDBMNTM path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b1135ddc-70f1-4eeb-8470-5d8f4fd8c11b size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396326.624461] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=2.419914ms duration-ns=2419914 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=Rkhxbjd5cDdiWTM2bFRKeXJEdkRZSlRJTDNwZ1hKNFc path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=e291127f-0dc4-4925-844c-49b02dcc2930 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/CxJxlHWzcUD3pYIzfsgYdW4u3qyJNQVa/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: !!!! HEADS UP !!!!
container-test-run-certificates> ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: Your account credentials have been saved in your
container-test-run-certificates> ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: configuration directory at "accounts".
container-test-run-certificates> ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: You should make a secure backup of this folder now. This
container-test-run-certificates> ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: configuration directory will also contain private keys
container-test-run-certificates> ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> ca # [6396326.624799] ca acme-order-renew-ca.foo-start[320]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> ca # [6396326.624944] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate
container-test-run-certificates> ca # [6396326.628804] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=3.521769ms duration-ns=3521769 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=THZXNWRjN2xsRkpzeTEyVmlIZ3JYSFZMbjVubmQ0MGM path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1b398d4a-20b8-44ad-8218-6891809daac6 response="{\"id\":\"QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M\",\"status\":\"pending\",\"expires\":\"2026-08-23T00:09:12Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-22T00:08:12Z\",\"notAfter\":\"2026-11-20T00:09:12Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/kC7g8yRzmeywruexhewmlArHUPhAHWCn\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396326.695901] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=9.939657ms duration-ns=9939657 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=TGE3MkxVM1l3VlNKN1YzRVFHaVNscGRvNm9EcGZMMjk path=/acme/acme/authz/kC7g8yRzmeywruexhewmlArHUPhAHWCn protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=5b2a06fd-8957-4b39-b0b9-a4bd4f8d039c response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"ep3Vf8PvwN36MSq1Si9vwOgjHj5kvdhM\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/7JCNhYFytoN4FRLMRkDXg0MpKp2mhUXE\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"ep3Vf8PvwN36MSq1Si9vwOgjHj5kvdhM\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/Jb0Vu8rcGMuErjGzzDgdPpdFdTqyAckF\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"ep3Vf8PvwN36MSq1Si9vwOgjHj5kvdhM\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/BvSrgVwMs3Yzz6ZGSlBPxBSYzqeEIBa8\"}],\"wildcard\":false,\"expires\":\"2026-08-23T00:09:12Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396326.696256] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/kC7g8yRzmeywruexhewmlArHUPhAHWCn
container-test-run-certificates> ca # [6396326.696256] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01
container-test-run-certificates> ca # [6396326.696256] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: use http-01 solver
container-test-run-certificates> ca # [6396326.696335] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: Trying to solve HTTP-01
container-test-run-certificates> ca # [6396326.699475] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=2.715877ms duration-ns=2715877 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=aHNJWDhpdDZZRnVrTFdoSk1WUUltMk9DSkNlSjgzUWo path=/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/Jb0Vu8rcGMuErjGzzDgdPpdFdTqyAckF protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=8c534ae2-3fef-4c53-96fe-d7d17c57f7d1 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"ep3Vf8PvwN36MSq1Si9vwOgjHj5kvdhM\",\"validated\":\"2026-08-22T00:09:12Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/kC7g8yRzmeywruexhewmlArHUPhAHWCn/Jb0Vu8rcGMuErjGzzDgdPpdFdTqyAckF\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396326.699721] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] The server validated our request
container-test-run-certificates> ca # [6396326.699786] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates
container-test-run-certificates> ca # [6396326.704834] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info duration=4.271699ms duration-ns=4271699 fields.time="2026-08-22T00:09:12Z" method=POST name=ca nonce=S2ZqSFNKd1htQTdsS0VQT3ZLakRXNW02U0I5b3ZHM24 path=/acme/acme/order/QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=2b3c6cbd-3f9d-4503-810a-3e69a4de5893 response="{\"id\":\"QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M\",\"status\":\"valid\",\"expires\":\"2026-08-23T00:09:12Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-22T00:08:12Z\",\"notAfter\":\"2026-11-20T00:09:12Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/kC7g8yRzmeywruexhewmlArHUPhAHWCn\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/QLLaI3M8aQgUvaRESXjbk2v1pJCOiF9M/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/bTZ65hDFOam97hofI8JH8UyKMBhluqGP\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396326.707599] ca step-ca[205]: time="2026-08-22T00:09:12Z" level=info certificate=MIIB0zCCAXqgAwIBAgIRAI2HkGK9oE2XhG0PuEbpsnowCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODIyMDAwODEyWhcNMjYxMTIwMDAwOTEyWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQofYlVwQhpiWRWAObOkYmbQTre077PTHtVCkxKBwmyUZvCPFAQUUlwk25yD0igWggTcKoiXFS29M13UoRqJzd8o4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFNyTWi31xO0eBmWmN7qi2CF+DF1MMB8GA1UdIwQYMBaAFKRym5lMRsWP2nBvfx8dseFDn8uXMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDRwAwRAIgBD5T2+cJKCpj7uMkXUa3ZwaE2nODbLWlKPXWy/oYS0ECICg+KnWbyqDTYGIFOZHWn46BXrM96gP+dwW8eluzAuxo duration=2.16079ms duration-ns=2160790 fields.time="2026-08-22T00:09:12Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=SUs4aWJCYlBsYkx5ZU1Zb2I1NDducG55YVhNcHE0eko path=/acme/acme/certificate/bTZ65hDFOam97hofI8JH8UyKMBhluqGP protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=7007c338-fe08-4c69-a676-0af74726e918 sans="map[dns:[ca.foo]]" serial=188125035971604653452326940294832042618 size=1340 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-08-22T00:08:12Z" valid-to="2026-11-20T00:09:12Z"
container-test-run-certificates> ca # [6396326.707878] ca acme-order-renew-ca.foo-start[320]: 2026/08/22 00:09:12 [INFO] [ca.foo] Server responded with a certificate.
container-test-run-certificates> ca # [6396326.717226] ca acme-order-renew-ca.foo-start[309]: + mv domainhash.txt certificates/
container-test-run-certificates> ca # [6396326.718971] ca acme-order-renew-ca.foo-start[309]: + touch out/acme-success
container-test-run-certificates> ca # [6396326.721239] ca acme-order-renew-ca.foo-start[309]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6396326.722719] ca acme-order-renew-ca.foo-start[309]: + touch out/renewed
container-test-run-certificates> ca # [6396326.724502] ca acme-order-renew-ca.foo-start[309]: + echo Installing new certificate
container-test-run-certificates> ca # [6396326.724502] ca acme-order-renew-ca.foo-start[309]: Installing new certificate
container-test-run-certificates> ca # [6396326.724502] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6396326.726032] ca acme-order-renew-ca.foo-start[354]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> ca # [6396326.726246] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.key out/key.pem
container-test-run-certificates> ca # [6396326.727455] ca acme-order-renew-ca.foo-start[355]: 'certificates/ca.foo.key' -> 'out/key.pem'
container-test-run-certificates> ca # [6396326.727652] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem
container-test-run-certificates> ca # [6396326.729191] ca acme-order-renew-ca.foo-start[356]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> ca # [6396326.729401] ca acme-order-renew-ca.foo-start[309]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> ca # [6396326.730837] ca acme-order-renew-ca.foo-start[309]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [6396326.732263] ca acme-order-renew-ca.foo-start[309]: + for fixpath in out certificates
container-test-run-certificates> ca # [6396326.732263] ca acme-order-renew-ca.foo-start[309]: + '[' -d out ']'
container-test-run-certificates> ca # [6396326.732328] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6396326.733704] ca acme-order-renew-ca.foo-start[309]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6396326.736251] ca acme-order-renew-ca.foo-start[309]: + for fixpath in out certificates
container-test-run-certificates> ca # [6396326.736251] ca acme-order-renew-ca.foo-start[309]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6396326.736358] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [6396326.737562] ca acme-order-renew-ca.foo-start[309]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [6396326.739687] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> server # [6396326.552218] server acme-order-renew-test.foo-start[270]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6396326.554756] server acme-order-renew-test.foo-start[270]: + set -euo pipefail
container-test-run-certificates> server # [6396326.554838] server acme-order-renew-test.foo-start[270]: + echo ad12aa6741ce4bd2c108
container-test-run-certificates> server # [6396326.554939] server acme-order-renew-test.foo-start[270]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> server # [6396326.555986] server acme-order-renew-test.foo-start[270]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run
container-test-run-certificates> server # [6396326.573661] server acme-order-renew-test.foo-start[282]: 2026/08/22 00:09:12 No key found for account none@none.tld. Generating a P256 key.
container-test-run-certificates> server # [6396326.573981] server acme-order-renew-test.foo-start[282]: 2026/08/22 00:09:12 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key
container-test-run-certificates> server # [6396326.610133] server acme-order-renew-test.foo-start[282]: 2026/08/22 00:09:12 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority
container-test-run-certificates> server # [6396326.611367] server acme-order-renew-test.foo-start[270]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.
container-test-run-certificates> server # [6396326.611367] server acme-order-renew-test.foo-start[270]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.
container-test-run-certificates> server # [6396326.611367] server acme-order-renew-test.foo-start[270]: + exit 10
container-test-run-certificates> server # [6396326.614288] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a
container-test-run-certificates> server # [6396326.614380] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'.
container-test-run-certificates> server # [6396326.614649] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> server # [6396326.615025] server systemd[1]: Startup finished in 3.589s.
container-test-run-certificates> ca # [6396326.887163] ca systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> ca # [6396326.890804] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [6396326.891002] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> ca # [6396327.403809] ca nginx[372]: nginx: the configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf syntax is ok
container-test-run-certificates> ca # [6396327.404409] ca nginx[372]: nginx: configuration file /nix/store/m0ydhgw5ib8qadqvijibx910rjv6ds7z-nginx.conf test is successful
container-test-run-certificates> ca # [6396327.921844] ca systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> ca # [6396327.922180] ca systemd[1]: Startup finished in 4.877s.
container-test-run-certificates> ca # [6396328.235815] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 3.42 seconds)
container-test-run-certificates> ca # [6396328.741900] ca acme-order-renew-ca.foo-start[387]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [6396328.744313] ca acme-order-renew-ca.foo-start[387]: + set -euo pipefail
container-test-run-certificates> ca # [6396328.744389] ca acme-order-renew-ca.foo-start[387]: + echo 88dc4fc401a6091a1bd9
container-test-run-certificates> ca # [6396328.744500] ca acme-order-renew-ca.foo-start[387]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> ca # [6396328.745449] ca acme-order-renew-ca.foo-start[387]: + '[' -e certificates/ca.foo.key ']'
container-test-run-certificates> ca # [6396328.745449] ca acme-order-renew-ca.foo-start[387]: + '[' -e certificates/ca.foo.crt ']'
container-test-run-certificates> ca # [6396328.745978] ca acme-order-renew-ca.foo-start[395]: ++ find accounts -name none@none.tld.key
container-test-run-certificates> ca # [6396328.749023] ca acme-order-renew-ca.foo-start[387]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']'
container-test-run-certificates> ca # [6396328.749110] ca acme-order-renew-ca.foo-start[387]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic
container-test-run-certificates> ca # [6396328.797886] ca step-ca[205]: time="2026-08-22T00:09:14Z" level=info duration="57.761µs" duration-ns=57761 fields.time="2026-08-22T00:09:14Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=92128b32-4b35-4d98-b991-fcea248bda6b response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396328.798452] ca acme-order-renew-ca.foo-start[396]: 2026/08/22 00:09:14 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint
container-test-run-certificates> ca # [6396328.798452] ca acme-order-renew-ca.foo-start[396]: 2026/08/22 00:09:14 [INFO] [ca.foo] The certificate expires at 2026-11-20T00:09:12Z, the renewal can be performed in 1439h59m37.148372019s: no renewal.
container-test-run-certificates> ca # [6396328.799186] ca acme-order-renew-ca.foo-start[387]: + mv domainhash.txt certificates/
container-test-run-certificates> ca # [6396328.801180] ca acme-order-renew-ca.foo-start[387]: + touch out/acme-success
container-test-run-certificates> ca # [6396328.802454] ca acme-order-renew-ca.foo-start[387]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [6396328.803398] ca acme-order-renew-ca.foo-start[387]: + for fixpath in out certificates
container-test-run-certificates> ca # [6396328.803427] ca acme-order-renew-ca.foo-start[387]: + '[' -d out ']'
container-test-run-certificates> ca # [6396328.803427] ca acme-order-renew-ca.foo-start[387]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [6396328.805226] ca acme-order-renew-ca.foo-start[387]: + chown -R acme:nginx out
container-test-run-certificates> ca # [6396328.809012] ca acme-order-renew-ca.foo-start[387]: + for fixpath in out certificates
container-test-run-certificates> ca # [6396328.809042] ca acme-order-renew-ca.foo-start[387]: + '[' -d certificates ']'
container-test-run-certificates> ca # [6396328.809042] ca acme-order-renew-ca.foo-start[387]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [6396328.810721] ca acme-order-renew-ca.foo-start[387]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [6396328.813078] ca acme-order-renew-ca.foo-start[387]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [6396328.982446] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [6396328.982672] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> server: must succeed: systemctl restart acme-test.foo.service
container-test-run-certificates> server # [6396332.008783] server systemd[1]: acme-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [6396332.009146] server systemd[1]: Stopped Ensure certificate for test.foo.
container-test-run-certificates> server # [6396332.010413] server systemd[1]: Stopping Ensure certificate for test.foo...
container-test-run-certificates> server # [6396332.013057] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.68 seconds)
container-test-run-certificates> client: waiting for success: curl -v https://test.foo
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [1009 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [111 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 22 00:09:11 2026 GMT
container-test-run-certificates> *   expire date: Sep 21 00:09:11 2028 GMT
container-test-run-certificates> *   issuer: CN=minica root ca 058ed9
container-test-run-certificates> *   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 13
container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html
container-test-run-certificates> 
container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not
container-test-run-certificates> establish a secure connection to it. To learn more about this situation and
container-test-run-certificates> how to fix it, please visit the webpage mentioned above.
container-test-run-certificates> server # [6396332.641877] server acme-test.foo-start[316]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6396332.644717] server acme-test.foo-start[316]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [6396332.644754] server acme-test.foo-start[316]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [6396332.656656] server acme-test.foo-start[326]: + cd test.foo
container-test-run-certificates> server # [6396332.656870] server acme-test.foo-start[326]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [6396332.658236] server acme-test.foo-start[327]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [6396332.658551] server acme-test.foo-start[326]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [6396332.659827] server acme-test.foo-start[326]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [6396332.660078] server acme-test.foo-start[316]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [6396332.661581] server acme-test.foo-start[316]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [6396332.662956] server acme-test.foo-start[316]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6396332.664350] server acme-test.foo-start[316]: + for fixpath in out certificates
container-test-run-certificates> server # [6396332.664371] server acme-test.foo-start[316]: + '[' -d out ']'
container-test-run-certificates> server # [6396332.664387] server acme-test.foo-start[316]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6396332.665621] server acme-test.foo-start[316]: + chown -R acme:nginx out
container-test-run-certificates> server # [6396332.667851] server acme-test.foo-start[316]: + for fixpath in out certificates
container-test-run-certificates> server # [6396332.667871] server acme-test.foo-start[316]: + '[' -d certificates ']'
container-test-run-certificates> server # [6396332.671424] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [6396332.673966] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> server # [6396333.302306] server acme-order-renew-test.foo-start[334]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [6396333.305662] server acme-order-renew-test.foo-start[334]: + set -euo pipefail
container-test-run-certificates> server # [6396333.305733] server acme-order-renew-test.foo-start[334]: + echo ad12aa6741ce4bd2c108
container-test-run-certificates> server # [6396333.305852] server acme-order-renew-test.foo-start[334]: + cmp -s domainhash.txt certificates/domainhash.txt
container-test-run-certificates> server # [6396333.307244] server acme-order-renew-test.foo-start[334]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run
container-test-run-certificates> server # [6396333.354190] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] acme: Registering account for none@none.tld
container-test-run-certificates> server # [6396333.375567] server acme-order-renew-test.foo-start[342]: !!!! HEADS UP !!!!
container-test-run-certificates> server # [6396333.375567] server acme-order-renew-test.foo-start[342]: Your account credentials have been saved in your
container-test-run-certificates> server # [6396333.375567] server acme-order-renew-test.foo-start[342]: configuration directory at "accounts".
container-test-run-certificates> server # [6396333.375567] server acme-order-renew-test.foo-start[342]: You should make a secure backup of this folder now. This
container-test-run-certificates> server # [6396333.375567] server acme-order-renew-test.foo-start[342]: configuration directory will also contain private keys
container-test-run-certificates> server # [6396333.375567] server acme-order-renew-test.foo-start[342]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> server # [6396333.375567] server acme-order-renew-test.foo-start[342]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> server # [6396333.375724] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: Obtaining bundled SAN certificate
container-test-run-certificates> server # [6396333.440550] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L
container-test-run-certificates> server # [6396333.440550] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01
container-test-run-certificates> server # [6396333.440550] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: use http-01 solver
container-test-run-certificates> server # [6396333.440550] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: Trying to solve HTTP-01
container-test-run-certificates> server # [6396333.448771] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] The server validated our request
container-test-run-certificates> server # [6396333.448872] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] acme: Validations succeeded; requesting certificates
container-test-run-certificates> server # [6396333.463824] server acme-order-renew-test.foo-start[342]: 2026/08/22 00:09:19 [INFO] [test.foo] Server responded with a certificate.
container-test-run-certificates> server # [6396333.468811] server acme-order-renew-test.foo-start[334]: + mv domainhash.txt certificates/
container-test-run-certificates> server # [6396333.470353] server acme-order-renew-test.foo-start[334]: + touch out/acme-success
container-test-run-certificates> server # [6396333.472221] server acme-order-renew-test.foo-start[334]: + cmp -s certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [6396333.473498] server acme-order-renew-test.foo-start[334]: + touch out/renewed
container-test-run-certificates> server # [6396333.474971] server acme-order-renew-test.foo-start[334]: + echo Installing new certificate
container-test-run-certificates> server # [6396333.474971] server acme-order-renew-test.foo-start[334]: Installing new certificate
container-test-run-certificates> server # [6396333.474971] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [6396333.476981] server acme-order-renew-test.foo-start[374]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> server # [6396333.477325] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.key out/key.pem
container-test-run-certificates> server # [6396333.478438] server acme-order-renew-test.foo-start[375]: 'certificates/test.foo.key' -> 'out/key.pem'
container-test-run-certificates> server # [6396333.478726] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem
container-test-run-certificates> server # [6396333.480548] server acme-order-renew-test.foo-start[376]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> server # [6396333.480831] server acme-order-renew-test.foo-start[334]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> server # [6396333.482117] server acme-order-renew-test.foo-start[334]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [6396333.483814] server acme-order-renew-test.foo-start[334]: + for fixpath in out certificates
container-test-run-certificates> server # [6396333.483814] server acme-order-renew-test.foo-start[334]: + '[' -d out ']'
container-test-run-certificates> server # [6396333.483900] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [6396333.485470] server acme-order-renew-test.foo-start[334]: + chown -R acme:nginx out
container-test-run-certificates> server # [6396333.488172] server acme-order-renew-test.foo-start[334]: + for fixpath in out certificates
container-test-run-certificates> server # [6396333.488172] server acme-order-renew-test.foo-start[334]: + '[' -d certificates ']'
container-test-run-certificates> server # [6396333.488172] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> server # [6396333.489709] server acme-order-renew-test.foo-start[334]: + chown -R acme:nginx certificates
container-test-run-certificates> server # [6396333.492595] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [6396333.353144] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration="63.92µs" duration-ns=63920 fields.time="2026-08-22T00:09:19Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=faf10a8a-e7e6-4997-bbb8-86e917db0369 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396333.370702] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=13.305263ms duration-ns=13305263 fields.time="2026-08-22T00:09:19Z" method=HEAD name=ca nonce=WjJKbGgwZ0ZJOTZPQTlLcERkQWZPTjIwRUZmV2R2U1U path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=f403dd62-389c-4953-b510-e7e6d692b62e size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396333.374866] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=1.50706ms duration-ns=1507060 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=TkdlNk8zVEpTZWtwcmhsR1FLS1VnWGFub0VMWHhPMlM path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=a4f13b2c-2a99-4042-a8a2-132766001a17 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/mHodQoHFtqNHGb8oif77WIi6f46jg2C4/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396333.380295] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=2.081309ms duration-ns=2081309 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=cWlEeGFCN2JVak54bjVLcjNYMDlubWFSdDZaM1ZKVGg path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=efa0a38e-c88b-4cc2-97ec-0a10890d130b response="{\"id\":\"mGC5gTTWzehltKiPqTNU196imvFToJTt\",\"status\":\"pending\",\"expires\":\"2026-08-23T00:09:19Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-22T00:08:19Z\",\"notAfter\":\"2026-11-20T00:09:19Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L\"],\"finalize\":\"https://ca.foo/acme/acme/order/mGC5gTTWzehltKiPqTNU196imvFToJTt/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396333.440153] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=1.43642ms duration-ns=1436420 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=YXJJcFdDSWY4M25SbXE4dUU3V0hNclNqRTBXcllvQ1Q path=/acme/acme/authz/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L protocol=HTTP/1.1 referer= remote-address="::1" request-id=86395e05-917e-4c52-b42d-644e8220ffbb response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"wmNUE37620kWOsSCOzWoFm7zV1iBzn90\",\"url\":\"https://ca.foo/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/t9V86x13P14ohAaLewnzh2BsmZpzlpap\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"wmNUE37620kWOsSCOzWoFm7zV1iBzn90\",\"url\":\"https://ca.foo/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/dpKrL6bx5yBSy9gHI14oI29IBkTCZAuv\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"wmNUE37620kWOsSCOzWoFm7zV1iBzn90\",\"url\":\"https://ca.foo/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/3HHIjTPLeRUdpF2GlkIRENGfQ1dnJ3hp\"}],\"wildcard\":false,\"expires\":\"2026-08-23T00:09:19Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396333.448085] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=4.615023ms duration-ns=4615023 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=VXBKcGdjTXdsZDhFVHZab2JyNmJka0ZMVDZwYUF4NEI path=/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/dpKrL6bx5yBSy9gHI14oI29IBkTCZAuv protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=e7a6c7ca-6c3a-4958-a137-931264dc7435 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"wmNUE37620kWOsSCOzWoFm7zV1iBzn90\",\"validated\":\"2026-08-22T00:09:19Z\",\"url\":\"https://ca.foo/acme/acme/challenge/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L/dpKrL6bx5yBSy9gHI14oI29IBkTCZAuv\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396333.458506] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info duration=6.903815ms duration-ns=6903815 fields.time="2026-08-22T00:09:19Z" method=POST name=ca nonce=OWp5eDBiT05lN1pFeWlwd3NTRWZpNTFweFp4N1ZxMUk path=/acme/acme/order/mGC5gTTWzehltKiPqTNU196imvFToJTt/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=5b7f37ca-271d-47f2-bf8a-534e95a455e2 response="{\"id\":\"mGC5gTTWzehltKiPqTNU196imvFToJTt\",\"status\":\"valid\",\"expires\":\"2026-08-23T00:09:19Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-22T00:08:19Z\",\"notAfter\":\"2026-11-20T00:09:19Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/IBUqyZYZHBxgYa764I20AWz3nLv6Gw2L\"],\"finalize\":\"https://ca.foo/acme/acme/order/mGC5gTTWzehltKiPqTNU196imvFToJTt/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/fjnYsmtrIWI3go4DpRXiA1sxqIWWTbO3\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [6396333.463426] ca step-ca[205]: time="2026-08-22T00:09:19Z" level=info certificate="MIIB2DCCAX6gAwIBAgIRANe2WFvMCmzf/BMlHV/h1iwwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODIyMDAwODE5WhcNMjYxMTIwMDAwOTE5WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABIHASqjl4ouGT1l4nh8q3wUWUeE5j8p4eM/1E2gbX0pP0319XBjxWaARpryjSKKTbsRwGStYbBHcpdhtImzhlwqjgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUxQ8SJ3DF9yvBE3uAdiUXjTl/UtMwHwYDVR0jBBgwFoAUpHKbmUxGxY/acG9/Hx2x4UOfy5cwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0gAMEUCIFzxbLzuLc4Rp8BL8I3jH7PCrDMAu0jopsSFJTwwCBPnAiEA0e7SljEHKthuiAaZrwsD3Z+rAIe+E57u6QmXlnoPBZY=" duration=1.817625ms duration-ns=1817625 fields.time="2026-08-22T00:09:19Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=SHM0NnpFanJyRnlWNW5xRm9SSzQ1T0pyU0pmOGV6ZXE path=/acme/acme/certificate/fjnYsmtrIWI3go4DpRXiA1sxqIWWTbO3 protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=d0f45d68-0d46-4365-bca2-b47da39f279c sans="map[dns:[test.foo]]" serial=286730809246965706856881617863528535596 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-08-22T00:08:19Z" valid-to="2026-11-20T00:09:19Z"
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [1009 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [112 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 22 00:09:11 2026 GMT
container-test-run-certificates> *   expire date: Sep 21 00:09:11 2028 GMT
container-test-run-certificates> *   issuer: CN=minica root ca 058ed9
container-test-run-certificates> *   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 13
container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html
container-test-run-certificates> 
container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not
container-test-run-certificates> establish a secure connection to it. To learn more about this situation and
container-test-run-certificates> how to fix it, please visit the webpage mentioned above.
container-test-run-certificates> server # [6396333.626126] server systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> server # [6396333.629984] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [6396333.630192] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> server # [6396334.124744] server nginx[392]: nginx: the configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf syntax is ok
container-test-run-certificates> server # [6396334.125386] server nginx[392]: nginx: configuration file /nix/store/cg1ianm6b7c0wkyi3akik85ix2jk9h6y-nginx.conf test is successful
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [931 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [79 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Aug 22 00:08:19 2026 GMT
container-test-run-certificates> *   expire date: Nov 20 00:09:19 2026 GMT
container-test-run-certificates> *   issuer: CN=Clan Intermediate CA
container-test-run-certificates> *   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 0
container-test-run-certificates> * SSL certificate verified via OpenSSL.
container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 39894 
container-test-run-certificates>   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
container-test-run-certificates>                                  Dload  Upload  Total   Spent   Left   Speed
container-test-run-certificates>   0      0   0      0   0      0      0      0                              0* using HTTP/2
container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/
container-test-run-certificates> * [HTTP/2] [1] [:method: GET]
container-test-run-certificates> * [HTTP/2] [1] [:scheme: https]
container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo]
container-test-run-certificates> * [HTTP/2] [1] [:path: /]
container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.21.0]
container-test-run-certificates> * [HTTP/2] [1] [accept: */*]
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> * Request completely sent off
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> 100     20 100     20   0      0    812      0                              0
container-test-run-certificates> * Connection #0 to host test.foo:443 left intact
container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 2.12 seconds)
container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2
container-test-run-certificates> Certificate:
container-test-run-certificates>     Data:
container-test-run-certificates>         Version: 3 (0x2)
container-test-run-certificates>         Serial Number:
container-test-run-certificates>             d7:b6:58:5b:cc:0a:6c:df:fc:13:25:1d:5f:e1:d6:2c
container-test-run-certificates>         Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>         Issuer: CN=Clan Intermediate CA
container-test-run-certificates>         Validity
container-test-run-certificates>             Not Before: Aug 22 00:08:19 2026 GMT
container-test-run-certificates>             Not After : Nov 20 00:09:19 2026 GMT
container-test-run-certificates>         Subject: CN=test.foo
container-test-run-certificates>         Subject Public Key Info:
container-test-run-certificates>             Public Key Algorithm: id-ecPublicKey
container-test-run-certificates>                 Public-Key: (256 bit)
container-test-run-certificates>                 pub:
container-test-run-certificates>                     04:81:c0:4a:a8:e5:e2:8b:86:4f:59:78:9e:1f:2a:
container-test-run-certificates>                     df:05:16:51:e1:39:8f:ca:78:78:cf:f5:13:68:1b:
container-test-run-certificates>                     5f:4a:4f:d3:7d:7d:5c:18:f1:59:a0:11:a6:bc:a3:
container-test-run-certificates>                     48:a2:93:6e:c4:70:19:2b:58:6c:11:dc:a5:d8:6d:
container-test-run-certificates>                     22:6c:e1:97:0a
container-test-run-certificates>                 ASN1 OID: prime256v1
container-test-run-certificates>                 NIST CURVE: P-256
container-test-run-certificates>         X509v3 extensions:
container-test-run-certificates>             X509v3 Key Usage: critical
container-test-run-certificates>                 Digital Signature
container-test-run-certificates>             X509v3 Extended Key Usage: 
container-test-run-certificates>                 TLS Web Server Authentication, TLS Web Client Authentication
container-test-run-certificates>             X509v3 Subject Key Identifier: 
container-test-run-certificates>                 C5:0F:12:27:70:C5:F7:2B:C1:13:7B:80:76:25:17:8D:39:7F:52:D3
container-test-run-certificates>             X509v3 Authority Key Identifier: 
container-test-run-certificates>                 A4:72:9B:99:4C:46:C5:8F:DA:70:6F:7F:1F:1D:B1:E1:43:9F:CB:97
container-test-run-certificates>             X509v3 Subject Alternative Name: 
container-test-run-certificates>                 DNS:test.foo
container-test-run-certificates>             1.3.6.1.4.1.37476.9000.64.1: 
container-test-run-certificates>                 0......acme..
container-test-run-certificates>     Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>     Signature Value:
container-test-run-certificates>         30:45:02:20:5c:f1:6c:bc:ee:2d:ce:11:a7:c0:4b:f0:8d:e3:
container-test-run-certificates>         1f:b3:c2:ac:33:00:bb:48:e8:a6:c4:85:25:3c:30:08:13:e7:
container-test-run-certificates>         02:21:00:d1:ee:d2:96:31:07:2a:d8:6e:88:06:99:af:0b:03:
container-test-run-certificates>         dd:9f:ab:00:87:be:13:9e:ee:e9:09:97:96:7a:0f:05:96
container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.05 seconds)
container-test-run-certificates> (finished: run the VM test script, in 12.28 seconds)
container-test-run-certificates> test script finished in 12.41s
container-test-run-certificates> cleanup
container-test-run-certificates> kill NspawnMachine (pid 52)
container-test-run-certificates> server # [6396334.620385] server systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> Container ca terminated by signal KILL.
container-test-run-certificates> kill NspawnMachine (pid 57)
container-test-run-certificates> kill NspawnMachine (pid 56)
container-test-run-certificates> Container client terminated by signal KILL.
container-test-run-certificates> Container server terminated by signal KILL.
container-test-run-certificates> (finished: cleanup, in 0.54 seconds)

post-build step Upload to niks3: ok
time=2026-08-22T00:09:22.442Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)"
time=2026-08-22T00:09:24.698Z level=INFO msg="Uploading 1 narinfos"
time=2026-08-22T00:09:25.080Z level=INFO msg="Upload complete. (2.701s)"