these 95 derivations will be built: /nix/store/lm95giifd0dhq1kdq5mb1znhn6x4p6x7-nixos-tmpfiles.d.drv /nix/store/3f21pafjia6ggjsxw17b6bbkw3hwniyi-tmpfiles.d.drv /nix/store/8600386bxqaa15pag4dvba7696g9zf2n-extra-hosts.drv /nix/store/3mfjg63hxjhyhkspdbcpqydcyaw0k97h-hosts.drv /nix/store/kpfsx09pgqwnbiarmcjq7k9lig14352a-system-path.drv /nix/store/x7cvq6hp1rlzws915d0z6qs5hxkvwq3c-dbus-1.drv /nix/store/lvyfmf027gnyxj8hp7ryqy585givbbz0-X-Restart-Triggers-dbus-broker.drv /nix/store/v2dn16sis8z9wh6bqr0654m97cxsl31g-unit-dbus-broker.service.drv /nix/store/d90mfjvcalxq611ghwgc6gk793mwhmcv-user-units.drv /nix/store/hmm2bx0wzw811hrag8g58hj3r5bhd709-X-Restart-Triggers-acme-test.foo.drv /nix/store/v2dkfbyzaflr3vic7zy0dpg1r7zf5sw6-unit-script-acme-test.foo-start.drv /nix/store/1v3vxm3nksax5ha6lgbhxbkyy3dryrln-unit-acme-test.foo.service.drv /nix/store/rdxhp0awj9fb0vdx5srklv00ii428ccq-firewall-start.drv /nix/store/d97jkgjnw0qa3ficf4fi9rd83kkbqd7m-firewall-reload.drv /nix/store/36hmmd9m408dxc87qiq720gdwbzd9s0b-unit-firewall.service.drv /nix/store/sascxnqw22b9adqk1kz81gx72vj5a3xv-X-Restart-Triggers-systemd-tmpfiles-resetup.drv /nix/store/8bzah42yn3yj3f2jii15n4sqlcsi6s74-unit-systemd-tmpfiles-resetup.service.drv /nix/store/ww8y4r13kk1cwgibi3dsf04jk0zk0qpl-nginx.conf.drv /nix/store/nnpcbxx524xdjpj1nff6932h8ay8h3pf-unit-script-nginx-pre-start.drv /nix/store/8f3bcg9nhxcsfhz5jrqn80rsy2h2whjk-unit-nginx.service.drv /nix/store/8w3wfr0x961r4hy2ailivajx4dbg2fvb-unit-acme-renew-test.foo.timer.drv /nix/store/31rj4mgq1nwypvkvdpb0v0gcg51l03xz-acme-postrun.drv /nix/store/pnalsl2s49yjr48wgvnxagmx8lh49m9p-unit-script-acme-order-renew-test.foo-start.drv /nix/store/9pq23bipqykvy0c10a34z06rsm3v6gsl-unit-acme-order-renew-test.foo.service.drv /nix/store/jp075pp74n5kparfwa0474hgsjz4wnmb-unit-dbus-broker.service.drv /nix/store/lnh2ygxjgqwmhkinkgvvs4cf04s9aakk-unit-nginx-config-reload.service.drv /nix/store/lsyp04hby1xb4dmfmpfvgbxzgh4yl1z6-unit-acme-account-2c44cb477b4787b2cf13.target.drv /nix/store/p125j5y841vij8f2i3nycjnfkja6sqlh-unit-40-eth1.network.drv /nix/store/4inmh5fdqgkrzz6qn5pij4h2vf3vzn6h-X-Reload-Triggers-systemd-networkd.drv /nix/store/m5jrjkdvsckhlq58vrfc85h8hkf99fp4-unit-systemd-networkd.service.drv /nix/store/pvx4pmp10f5yld3mywvwa8zghqqdn4jw-nss-cacert-3.126.drv /nix/store/pfs7khx7s5lpirpqvwyr5ji4aak0yghc-unit-nix-daemon.service.drv /nix/store/wajgh70k44pmyjzlf689zf4v98kpfq0s-acme-setup-privileged.drv /nix/store/zrfg1fd7pkck9wnj2c62mynfwch1hb55-unit-acme-setup.service.drv /nix/store/j8df01fnryi8a8i6a2jgn1haqh8qw276-system-units.drv /nix/store/msvcmqhmajssll92gjai5phf8jw6pyac-vars-check-certificates.drv /nix/store/jxcn5rpxy34lrp3qh2rrx6rwx17rr9hl-etc.drv /nix/store/wm7bhdsgk7maxq6hxb34j1yf9infbqgb-users-groups.json.drv /nix/store/0ivz9vakaplrhfjbd7gknjcvpxm655vg-activate.drv /nix/store/hzhyn6p7596aacax0n6il7fx747y543j-system-path.drv /nix/store/l3xzz4s6356ydwb2xakxax2zcz32gyl1-dbus-1.drv /nix/store/106a3bfcask61xpjyzhik8ihyjxgfxsn-X-Restart-Triggers-dbus-broker.drv /nix/store/3z64pz59i9qs2j4ibaxf5cgj128pbpbd-X-Restart-Triggers-acme-ca.foo.drv /nix/store/9ih973wng9cbgnw5yibjnv7v433fdncp-unit-script-acme-ca.foo-start.drv /nix/store/22wdlwnfq80a4gf3q30nmczyzn1br71h-unit-acme-ca.foo.service.drv /nix/store/4dzyy8fmxm5z2a65d2gmg0cfnz0xwcmi-acme-postrun.drv /nix/store/kndwyk76bziyv42hdjc47fy545jcjlhy-unit-script-acme-order-renew-ca.foo-start.drv /nix/store/4fsvs6h1wgd8vrq60phvmg538s3v4sib-unit-acme-order-renew-ca.foo.service.drv /nix/store/ax4ccrgqi8qk5c9ppx4ycm0xm6xviisi-system-path.drv /nix/store/g4c8l8cqa5vxzam9i9pica0x5008z2kk-dbus-1.drv /nix/store/2v1ln30rqzry16bgifhism227bxrsg5l-X-Restart-Triggers-dbus-broker.drv /nix/store/cakxpxv88cbncq32mis7s67bz73ds9ab-unit-dbus-broker.service.drv /nix/store/4894whd891b1wi2l9n6zzmjfq7ym86qy-ca.json.drv /nix/store/5nhpg92ia3yqvpz7967c8ppqxv7skrz4-X-Restart-Triggers-step-ca.drv /nix/store/fsz7i8psl2dqxkd8lyhfa5k0mgdx2fdg-unit-step-ca.service.drv /nix/store/y34w2ly8dhisjz6apfdd99ybfy1hqama-nginx.conf.drv /nix/store/pdawzsb4z4fnq42pcpdh34sdlh04rrr3-unit-script-nginx-pre-start.drv /nix/store/fv6hcwi5x9qszlf9amr9z86ksay8w7cv-unit-nginx.service.drv /nix/store/lacmwdd44dzgw2x62bsf3j9i2n527pls-unit-nginx-config-reload.service.drv /nix/store/nhcgml3c92azgy1l9g42hk91dkp16pyp-acme-setup-privileged.drv /nix/store/s9km8agrqzqzbcns8xyn4ypw7jjkr7af-unit-acme-setup.service.drv /nix/store/vx4k4ah41xarp8mc8y4wjqi5whmr3g9c-unit-acme-renew-ca.foo.timer.drv /nix/store/ws9p9f1ilid28mxihffhl70mkys7m3wj-unit-acme-account-d22a46d9459bf683a338.target.drv /nix/store/1wz9mk7n9zabcpxg6cywzym5y5vbhzax-system-units.drv /nix/store/1zyfa4xzwkrj97a2h95n0cppkvimscqf-test-script.drv /nix/store/6zgwah06s2hnhglgy407pjhviai732fl-unit-dbus-broker.service.drv /nix/store/a2adi0v8wvzr81svps1mw7d3ggixk97y-system-units.drv /nix/store/kjjxn1q8w1ibsyafz9hwd3lm668h80cd-hosts.drv /nix/store/wnjz9jqqdp1yyhyy3fmzfhs1xfklbdx2-unit-dbus-broker.service.drv /nix/store/y42jdc0khvg45c6vwahscgg62b9588ra-user-units.drv /nix/store/pyz35b8cmifbra9bdm2958vir37fc4fm-etc.drv /nix/store/ps8q46sw9bqvlqf0829hb74fq4093gb8-activate.drv /nix/store/4add0rh0fv2b57l1jslqnhx53q8b4325-nixos-system-client-test.drv /nix/store/2x26w119fr5gmyanjjs2fcngrm1ny8rs-run-client-nspawn.drv /nix/store/a6f5v1ha6ln4aa1nyzwj5xm3knid64y6-dry-activate.drv /nix/store/l3al4jmq90zi9xv5k08ksvycg0brdkcy-nixos-system-server-test.drv /nix/store/a3ymwp11gqwn33ngfg9rs8nqaw9f8axa-run-server-nspawn.drv /nix/store/cwgfsljr1jp27r713z2yq4bli6z4i89y-decrypt-age-secrets.drv /nix/store/h90nzzi0faylcbdgwr1hc7zwkgzxyv1z-unit-dbus-broker.service.drv /nix/store/86qw7xlfw54gm3zmkfwzkl557av240y4-user-units.drv /nix/store/d1fswwvs0xfpn1fjv70mspv1bq2hfjm6-system-shutdown.drv /nix/store/gzlcjzpyd0hsmrchcqa1vicws9smqkmg-user-generators.drv /nix/store/ji5z680ajfdb50340zz888kwws981h0l-etc-hostname.drv /nix/store/n14qd3dpmwqhr1lz7y188inbriphna20-system-generators.drv /nix/store/lnad1cpwsdc1qc9azf0zgx7zjg6625vg-string-hosts.drv /nix/store/x1pznybbws35d4zvijmba9pzq23qg255-hosts.drv /nix/store/k9pvvc14xr9n8la0l7jnygy6r99wqs9k-etc.drv /nix/store/n3pcql3kxl7qdz8rznx65ba10340ja0j-users-groups.json.drv /nix/store/ca910w3hy53vf2vzf770q60kid9jzbvn-activate.drv /nix/store/rgr0zzkg38sn7v4j16f3gxk3llxjy68c-dry-activate.drv /nix/store/m1l4ghi58g1qi54qizap5c53y5r9k7al-nixos-system-ca-test.drv /nix/store/x7bp1h2wdiy9f37p48vz5l2ckr0imr1f-run-ca-nspawn.drv /nix/store/5k386p9p3aa9xd7lg62dim63jz2vq94m-driverConfiguration.json.drv /nix/store/9bi4jpcrplnyfqd1pjxlyickm86cjvg0-nixos-test-driver-certificates.drv /nix/store/k42iqfhfkq4gkp4qjnfwkvg6rf3rm5za-container-test-run-certificates.drv these 2 paths will be fetched (21.8 MiB download, 73.3 MiB unpacked): /nix/store/mabj8vrffrvzhnc1m76awgdm04p9zygr-python3.14-buildcatrust-0.5.1 /nix/store/51xw1kjjxjyfkljcqsl879nvvh97vxp0-step-ca-0.30.2 building '/nix/store/1zyfa4xzwkrj97a2h95n0cppkvimscqf-test-script.drv' building '/nix/store/ax4ccrgqi8qk5c9ppx4ycm0xm6xviisi-system-path.drv' building '/nix/store/hzhyn6p7596aacax0n6il7fx747y543j-system-path.drv' building '/nix/store/kpfsx09pgqwnbiarmcjq7k9lig14352a-system-path.drv' building '/nix/store/ji5z680ajfdb50340zz888kwws981h0l-etc-hostname.drv' building '/nix/store/ww8y4r13kk1cwgibi3dsf04jk0zk0qpl-nginx.conf.drv' building '/nix/store/y34w2ly8dhisjz6apfdd99ybfy1hqama-nginx.conf.drv' building '/nix/store/p125j5y841vij8f2i3nycjnfkja6sqlh-unit-40-eth1.network.drv' building '/nix/store/8600386bxqaa15pag4dvba7696g9zf2n-extra-hosts.drv' building '/nix/store/lm95giifd0dhq1kdq5mb1znhn6x4p6x7-nixos-tmpfiles.d.drv' nginx.conf> structuredAttrs is enabled nginx.conf> structuredAttrs is enabled system-path> structuredAttrs is enabled system-path> created 1723 symlinks in user environment system-path> structuredAttrs is enabled system-path> created 1723 symlinks in user environment system-path> structuredAttrs is enabled system-path> created 1723 symlinks in user environment unit-40-eth1.network> structuredAttrs is enabled building '/nix/store/lacmwdd44dzgw2x62bsf3j9i2n527pls-unit-nginx-config-reload.service.drv' building '/nix/store/lnh2ygxjgqwmhkinkgvvs4cf04s9aakk-unit-nginx-config-reload.service.drv' unit-nginx-config-reload.service> structuredAttrs is enabled building '/nix/store/lsyp04hby1xb4dmfmpfvgbxzgh4yl1z6-unit-acme-account-2c44cb477b4787b2cf13.target.drv' building '/nix/store/ws9p9f1ilid28mxihffhl70mkys7m3wj-unit-acme-account-d22a46d9459bf683a338.target.drv' building '/nix/store/vx4k4ah41xarp8mc8y4wjqi5whmr3g9c-unit-acme-renew-ca.foo.timer.drv' building '/nix/store/8w3wfr0x961r4hy2ailivajx4dbg2fvb-unit-acme-renew-test.foo.timer.drv' nginx.conf> nginx.conf> ==================== Results =================== nginx.conf> No issues found. nginx.conf> nginx.conf> ==================== Summary =================== nginx.conf> Total issues: nginx.conf> Unspecified: 0 nginx.conf> Low: 0 nginx.conf> Medium: 0 nginx.conf> High: 0 nginx.conf> nginx.conf> nginx.conf> ==================== Results =================== nginx.conf> No issues found. nginx.conf> nginx.conf> ==================== Summary =================== nginx.conf> Total issues: nginx.conf> Unspecified: 0 nginx.conf> Low: 0 nginx.conf> Medium: 0 nginx.conf> High: 0 nginx.conf> unit-acme-account-2c44cb477b4787b2cf13.target> structuredAttrs is enabled unit-acme-account-d22a46d9459bf683a338.target> structuredAttrs is enabled unit-acme-renew-ca.foo.timer> structuredAttrs is enabled unit-acme-renew-test.foo.timer> structuredAttrs is enabled unit-nginx-config-reload.service> structuredAttrs is enabled building '/nix/store/3z64pz59i9qs2j4ibaxf5cgj128pbpbd-X-Restart-Triggers-acme-ca.foo.drv' building '/nix/store/hmm2bx0wzw811hrag8g58hj3r5bhd709-X-Restart-Triggers-acme-test.foo.drv' building '/nix/store/31rj4mgq1nwypvkvdpb0v0gcg51l03xz-acme-postrun.drv' building '/nix/store/msvcmqhmajssll92gjai5phf8jw6pyac-vars-check-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' building '/nix/store/wajgh70k44pmyjzlf689zf4v98kpfq0s-acme-setup-privileged.drv' building '/nix/store/4894whd891b1wi2l9n6zzmjfq7ym86qy-ca.json.drv' building '/nix/store/l3xzz4s6356ydwb2xakxax2zcz32gyl1-dbus-1.drv' building '/nix/store/x7cvq6hp1rlzws915d0z6qs5hxkvwq3c-dbus-1.drv' building '/nix/store/rdxhp0awj9fb0vdx5srklv00ii428ccq-firewall-start.drv' building '/nix/store/9ih973wng9cbgnw5yibjnv7v433fdncp-unit-script-acme-ca.foo-start.drv' building '/nix/store/kndwyk76bziyv42hdjc47fy545jcjlhy-unit-script-acme-order-renew-ca.foo-start.drv' building '/nix/store/v2dkfbyzaflr3vic7zy0dpg1r7zf5sw6-unit-script-acme-test.foo-start.drv' building '/nix/store/n3pcql3kxl7qdz8rznx65ba10340ja0j-users-groups.json.drv' building '/nix/store/wm7bhdsgk7maxq6hxb34j1yf9infbqgb-users-groups.json.drv' ca.json> structuredAttrs is enabled building '/nix/store/3mfjg63hxjhyhkspdbcpqydcyaw0k97h-hosts.drv' building '/nix/store/kjjxn1q8w1ibsyafz9hwd3lm668h80cd-hosts.drv' building '/nix/store/lnad1cpwsdc1qc9azf0zgx7zjg6625vg-string-hosts.drv' building '/nix/store/3f21pafjia6ggjsxw17b6bbkw3hwniyi-tmpfiles.d.drv' building '/nix/store/pnalsl2s49yjr48wgvnxagmx8lh49m9p-unit-script-acme-order-renew-test.foo-start.drv' building '/nix/store/nnpcbxx524xdjpj1nff6932h8ay8h3pf-unit-script-nginx-pre-start.drv' building '/nix/store/pdawzsb4z4fnq42pcpdh34sdlh04rrr3-unit-script-nginx-pre-start.drv' building '/nix/store/4inmh5fdqgkrzz6qn5pij4h2vf3vzn6h-X-Reload-Triggers-systemd-networkd.drv' building '/nix/store/106a3bfcask61xpjyzhik8ihyjxgfxsn-X-Restart-Triggers-dbus-broker.drv' building '/nix/store/lvyfmf027gnyxj8hp7ryqy585givbbz0-X-Restart-Triggers-dbus-broker.drv' building '/nix/store/d97jkgjnw0qa3ficf4fi9rd83kkbqd7m-firewall-reload.drv' building '/nix/store/n14qd3dpmwqhr1lz7y188inbriphna20-system-generators.drv' building '/nix/store/d1fswwvs0xfpn1fjv70mspv1bq2hfjm6-system-shutdown.drv' building '/nix/store/22wdlwnfq80a4gf3q30nmczyzn1br71h-unit-acme-ca.foo.service.drv' building '/nix/store/zrfg1fd7pkck9wnj2c62mynfwch1hb55-unit-acme-setup.service.drv' building '/nix/store/1v3vxm3nksax5ha6lgbhxbkyy3dryrln-unit-acme-test.foo.service.drv' building '/nix/store/gzlcjzpyd0hsmrchcqa1vicws9smqkmg-user-generators.drv' building '/nix/store/pvx4pmp10f5yld3mywvwa8zghqqdn4jw-nss-cacert-3.126.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' building '/nix/store/cwgfsljr1jp27r713z2yq4bli6z4i89y-decrypt-age-secrets.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' unit-acme-ca.foo.service> structuredAttrs is enabled unit-acme-setup.service> structuredAttrs is enabled unit-acme-test.foo.service> structuredAttrs is enabled building '/nix/store/5nhpg92ia3yqvpz7967c8ppqxv7skrz4-X-Restart-Triggers-step-ca.drv' building '/nix/store/sascxnqw22b9adqk1kz81gx72vj5a3xv-X-Restart-Triggers-systemd-tmpfiles-resetup.drv' building '/nix/store/g4c8l8cqa5vxzam9i9pica0x5008z2kk-dbus-1.drv' building '/nix/store/a6f5v1ha6ln4aa1nyzwj5xm3knid64y6-dry-activate.drv' building '/nix/store/x1pznybbws35d4zvijmba9pzq23qg255-hosts.drv' building '/nix/store/9pq23bipqykvy0c10a34z06rsm3v6gsl-unit-acme-order-renew-test.foo.service.drv' building '/nix/store/8f3bcg9nhxcsfhz5jrqn80rsy2h2whjk-unit-nginx.service.drv' unit-acme-order-renew-test.foo.service> structuredAttrs is enabled unit-nginx.service> structuredAttrs is enabled building '/nix/store/4dzyy8fmxm5z2a65d2gmg0cfnz0xwcmi-acme-postrun.drv' building '/nix/store/nhcgml3c92azgy1l9g42hk91dkp16pyp-acme-setup-privileged.drv' building '/nix/store/6zgwah06s2hnhglgy407pjhviai732fl-unit-dbus-broker.service.drv' building '/nix/store/v2dn16sis8z9wh6bqr0654m97cxsl31g-unit-dbus-broker.service.drv' building '/nix/store/wnjz9jqqdp1yyhyy3fmzfhs1xfklbdx2-unit-dbus-broker.service.drv' building '/nix/store/36hmmd9m408dxc87qiq720gdwbzd9s0b-unit-firewall.service.drv' building '/nix/store/m5jrjkdvsckhlq58vrfc85h8hkf99fp4-unit-systemd-networkd.service.drv' unit-dbus-broker.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled unit-firewall.service> structuredAttrs is enabled unit-systemd-networkd.service> structuredAttrs is enabled building '/nix/store/2v1ln30rqzry16bgifhism227bxrsg5l-X-Restart-Triggers-dbus-broker.drv' building '/nix/store/jp075pp74n5kparfwa0474hgsjz4wnmb-unit-dbus-broker.service.drv' building '/nix/store/fv6hcwi5x9qszlf9amr9z86ksay8w7cv-unit-nginx.service.drv' building '/nix/store/fsz7i8psl2dqxkd8lyhfa5k0mgdx2fdg-unit-step-ca.service.drv' building '/nix/store/8bzah42yn3yj3f2jii15n4sqlcsi6s74-unit-systemd-tmpfiles-resetup.service.drv' unit-dbus-broker.service> structuredAttrs is enabled unit-nginx.service> structuredAttrs is enabled unit-step-ca.service> structuredAttrs is enabled unit-systemd-tmpfiles-resetup.service> structuredAttrs is enabled building '/nix/store/4fsvs6h1wgd8vrq60phvmg538s3v4sib-unit-acme-order-renew-ca.foo.service.drv' building '/nix/store/s9km8agrqzqzbcns8xyn4ypw7jjkr7af-unit-acme-setup.service.drv' building '/nix/store/cakxpxv88cbncq32mis7s67bz73ds9ab-unit-dbus-broker.service.drv' building '/nix/store/h90nzzi0faylcbdgwr1hc7zwkgzxyv1z-unit-dbus-broker.service.drv' building '/nix/store/d90mfjvcalxq611ghwgc6gk793mwhmcv-user-units.drv' building '/nix/store/y42jdc0khvg45c6vwahscgg62b9588ra-user-units.drv' unit-acme-order-renew-ca.foo.service> structuredAttrs is enabled unit-acme-setup.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/86qw7xlfw54gm3zmkfwzkl557av240y4-user-units.drv' building '/nix/store/msvcmqhmajssll92gjai5phf8jw6pyac-vars-check-certificates.drv' vars-check-certificates> Running vars check using Nix-based executor... vars-check-certificates> ✓ All vars checks completed successfully building '/nix/store/pvx4pmp10f5yld3mywvwa8zghqqdn4jw-nss-cacert-3.126.drv' building '/nix/store/cwgfsljr1jp27r713z2yq4bli6z4i89y-decrypt-age-secrets.drv' nss-cacert-3.126> structuredAttrs is enabled nss-cacert-3.126> Running phase: unpackPhase nss-cacert-3.126> Running phase: patchPhase nss-cacert-3.126> Running phase: updateAutotoolsGnuConfigScriptsPhase nss-cacert-3.126> Running phase: configurePhase nss-cacert-3.126> no configure script, doing nothing nss-cacert-3.126> Running phase: buildPhase building '/nix/store/rgr0zzkg38sn7v4j16f3gxk3llxjy68c-dry-activate.drv' nss-cacert-3.126> Running phase: installPhase nss-cacert-3.126> Running phase: fixupPhase nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/928av4g7xjr0hi7lrx9m7zjqjh7l2lly-nss-cacert-3.126-p11kit nss-cacert-3.126> checking for references to /build/ in /nix/store/928av4g7xjr0hi7lrx9m7zjqjh7l2lly-nss-cacert-3.126-p11kit... nss-cacert-3.126> patching script interpreter paths in /nix/store/928av4g7xjr0hi7lrx9m7zjqjh7l2lly-nss-cacert-3.126-p11kit nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/qhi15azqv12wgsimssyp3rbfgrwq3r52-nss-cacert-3.126-hashed nss-cacert-3.126> checking for references to /build/ in /nix/store/qhi15azqv12wgsimssyp3rbfgrwq3r52-nss-cacert-3.126-hashed... nss-cacert-3.126> patching script interpreter paths in /nix/store/qhi15azqv12wgsimssyp3rbfgrwq3r52-nss-cacert-3.126-hashed nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/kd5pz4wffc7zw36aad1378l6r55lrkln-nss-cacert-3.126 nss-cacert-3.126> checking for references to /build/ in /nix/store/kd5pz4wffc7zw36aad1378l6r55lrkln-nss-cacert-3.126... nss-cacert-3.126> patching script interpreter paths in /nix/store/kd5pz4wffc7zw36aad1378l6r55lrkln-nss-cacert-3.126 nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/xxp1frhxfhj8afadzvlfxf71r8jqh8dy-nss-cacert-3.126-unbundled nss-cacert-3.126> checking for references to /build/ in /nix/store/xxp1frhxfhj8afadzvlfxf71r8jqh8dy-nss-cacert-3.126-unbundled... nss-cacert-3.126> patching script interpreter paths in /nix/store/xxp1frhxfhj8afadzvlfxf71r8jqh8dy-nss-cacert-3.126-unbundled building '/nix/store/pfs7khx7s5lpirpqvwyr5ji4aak0yghc-unit-nix-daemon.service.drv' unit-nix-daemon.service> structuredAttrs is enabled building '/nix/store/1wz9mk7n9zabcpxg6cywzym5y5vbhzax-system-units.drv' building '/nix/store/a2adi0v8wvzr81svps1mw7d3ggixk97y-system-units.drv' building '/nix/store/j8df01fnryi8a8i6a2jgn1haqh8qw276-system-units.drv' building '/nix/store/pyz35b8cmifbra9bdm2958vir37fc4fm-etc.drv' building '/nix/store/jxcn5rpxy34lrp3qh2rrx6rwx17rr9hl-etc.drv' building '/nix/store/k9pvvc14xr9n8la0l7jnygy6r99wqs9k-etc.drv' building '/nix/store/ps8q46sw9bqvlqf0829hb74fq4093gb8-activate.drv' building '/nix/store/0ivz9vakaplrhfjbd7gknjcvpxm655vg-activate.drv' building '/nix/store/ca910w3hy53vf2vzf770q60kid9jzbvn-activate.drv' building '/nix/store/4add0rh0fv2b57l1jslqnhx53q8b4325-nixos-system-client-test.drv' building '/nix/store/m1l4ghi58g1qi54qizap5c53y5r9k7al-nixos-system-ca-test.drv' building '/nix/store/l3al4jmq90zi9xv5k08ksvycg0brdkcy-nixos-system-server-test.drv' nixos-system-ca-test> structuredAttrs is enabled nixos-system-client-test> structuredAttrs is enabled building '/nix/store/2x26w119fr5gmyanjjs2fcngrm1ny8rs-run-client-nspawn.drv' nixos-system-server-test> structuredAttrs is enabled building '/nix/store/x7bp1h2wdiy9f37p48vz5l2ckr0imr1f-run-ca-nspawn.drv' building '/nix/store/a3ymwp11gqwn33ngfg9rs8nqaw9f8axa-run-server-nspawn.drv' building '/nix/store/5k386p9p3aa9xd7lg62dim63jz2vq94m-driverConfiguration.json.drv' driverConfiguration.json> structuredAttrs is enabled building '/nix/store/9bi4jpcrplnyfqd1pjxlyickm86cjvg0-nixos-test-driver-certificates.drv' nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/k42iqfhfkq4gkp4qjnfwkvg6rf3rm5za-container-test-run-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' building '/nix/store/k42iqfhfkq4gkp4qjnfwkvg6rf3rm5za-container-test-run-certificates.drv' container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> start all VMs container-test-run-certificates> ca: systemd-nspawn running (pid 51) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 56) container-test-run-certificates> server: systemd-nspawn running (pid 57) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> (finished: start all VMs, in 0.00 seconds) container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [7795859.462924] ca systemd-journald[78]: Journal started container-test-run-certificates> ca # [7795859.462952] ca systemd-journald[78]: Runtime Journal (/run/log/journal/200bf50af51740799e4d79c8d7e80f24) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [7795859.467096] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [7795859.475946] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [7795859.476507] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [7795859.476893] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [7795859.480715] ca systemd-journald[78]: Time spent on flushing to /var/log/journal/200bf50af51740799e4d79c8d7e80f24 is 1.285ms for 6 entries. container-test-run-certificates> ca # [7795859.480715] ca systemd-journald[78]: System Journal (/var/log/journal/200bf50af51740799e4d79c8d7e80f24) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [7795859.515309] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [7795859.515953] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [7795859.516035] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [7795859.516565] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [7795859.516596] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [7795859.517379] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [7795859.517398] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [7795859.523909] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [7795859.524762] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [7795859.534986] ca systemd-tmpfiles[146]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [7795859.535148] ca systemd-tmpfiles[146]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [7795859.535251] ca systemd-tmpfiles[146]: fchmod() of /var/log/journal/200bf50af51740799e4d79c8d7e80f24 failed: Operation not permitted container-test-run-certificates> ca # [7795859.535406] ca systemd-tmpfiles[146]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [7795859.536297] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [7795859.536878] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [7795859.537238] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [7795859.545907] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [7795859.548935] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [7795859.549681] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [7795859.554474] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [7795859.570549] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [7795859.570641] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [7795859.570785] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [7795859.571294] ca systemd[1]: Starting Network Management... container-test-run-certificates> client # [7795859.455805] client systemd-journald[69]: Journal started container-test-run-certificates> server # [7795859.459176] server systemd-journald[69]: Journal started container-test-run-certificates> client # [7795859.455837] client systemd-journald[69]: Runtime Journal (/run/log/journal/fe0f4c95958a43379d4f0f4988700840) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [7795859.459203] server systemd-journald[69]: Runtime Journal (/run/log/journal/9e94cb9a41fa46b8958470d82c24beab) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [7795859.458202] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [7795859.462689] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [7795859.462972] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [7795859.467963] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [7795859.463377] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [7795859.477921] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [7795859.463831] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [7795859.478461] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [7795859.468224] client systemd-journald[69]: Time spent on flushing to /var/log/journal/fe0f4c95958a43379d4f0f4988700840 is 1.204ms for 6 entries. container-test-run-certificates> server # [7795859.478841] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [7795859.468224] client systemd-journald[69]: System Journal (/var/log/journal/fe0f4c95958a43379d4f0f4988700840) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [7795859.483352] server systemd-journald[69]: Time spent on flushing to /var/log/journal/9e94cb9a41fa46b8958470d82c24beab is 1.396ms for 7 entries. container-test-run-certificates> client # [7795859.474200] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [7795859.483352] server systemd-journald[69]: System Journal (/var/log/journal/9e94cb9a41fa46b8958470d82c24beab) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [7795859.474791] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [7795859.515309] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [7795859.474869] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [7795859.516062] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [7795859.475510] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [7795859.516129] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [7795859.475547] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [7795859.516634] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [7795859.476134] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [7795859.516666] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [7795859.476160] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [7795859.517304] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [7795859.476535] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [7795859.517327] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [7795859.477566] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [7795859.530117] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [7795859.517423] client systemd-tmpfiles[112]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [7795859.530861] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [7795859.542454] server systemd-tmpfiles[141]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [7795859.542613] server systemd-tmpfiles[141]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [7795859.517576] client systemd-tmpfiles[112]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [7795859.542722] server systemd-tmpfiles[141]: fchmod() of /var/log/journal/9e94cb9a41fa46b8958470d82c24beab failed: Operation not permitted container-test-run-certificates> server # [7795859.542875] server systemd-tmpfiles[141]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [7795859.544035] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [7795859.517683] client systemd-tmpfiles[112]: fchmod() of /var/log/journal/fe0f4c95958a43379d4f0f4988700840 failed: Operation not permitted container-test-run-certificates> server # [7795859.544823] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [7795859.517839] client systemd-tmpfiles[112]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [7795859.545283] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [7795859.520278] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [7795859.551771] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [7795859.521036] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [7795859.556918] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [7795859.521593] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [7795859.557589] server systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [7795859.529259] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [7795859.564754] server systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [7795859.534645] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [7795859.570132] server systemd[1]: Finished Firewall. container-test-run-certificates> client # [7795859.535314] client systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [7795859.570233] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [7795859.540878] client systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [7795859.570385] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [7795859.565317] client systemd[1]: Finished Firewall. container-test-run-certificates> server # [7795859.570987] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [7795859.926936] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [7795859.927064] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [7795859.565385] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [7795859.934665] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [7795859.565522] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [7795859.934836] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [7795859.934916] server systemd-networkd[186]: lo: Link UP container-test-run-certificates> client # [7795859.566100] client systemd[1]: Starting Network Management... container-test-run-certificates> server # [7795859.934920] server systemd-networkd[186]: lo: Gained carrier container-test-run-certificates> server # [7795859.935086] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [7795859.935368] server systemd[1]: Started Network Management. container-test-run-certificates> server # [7795859.935406] server systemd-networkd[186]: eth1: Link UP container-test-run-certificates> server # [7795859.935543] server systemd-networkd[186]: eth1: Gained carrier container-test-run-certificates> server # [7795859.936040] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [7795859.946275] ca systemd-networkd[195]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [7795859.946355] ca systemd-networkd[195]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [7795859.952501] ca systemd-networkd[195]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [7795859.952649] ca systemd-networkd[195]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [7795859.952703] ca systemd-networkd[195]: lo: Link UP container-test-run-certificates> ca # [7795859.952706] ca systemd-networkd[195]: lo: Gained carrier container-test-run-certificates> ca # [7795859.952823] ca systemd-networkd[195]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [7795859.953048] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [7795859.953082] ca systemd-networkd[195]: eth1: Link UP container-test-run-certificates> ca # [7795859.953213] ca systemd-networkd[195]: eth1: Gained carrier container-test-run-certificates> ca # [7795859.953639] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [7795859.979208] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [7795859.982521] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [7795859.982590] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [7795859.996132] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [7795859.996287] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [7795859.996374] client systemd-networkd[182]: lo: Link UP container-test-run-certificates> client # [7795859.996378] client systemd-networkd[182]: lo: Gained carrier container-test-run-certificates> client # [7795859.996529] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [7795859.996805] client systemd[1]: Started Network Management. container-test-run-certificates> client # [7795859.996848] client systemd-networkd[182]: eth1: Link UP container-test-run-certificates> client # [7795859.996972] client systemd-networkd[182]: eth1: Gained carrier container-test-run-certificates> client # [7795860.013488] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [7795860.025992] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [7795859.954606] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [7795860.267918] server systemd-resolved[100]: Positive Trust Anchors: container-test-run-certificates> server # [7795860.267926] server systemd-resolved[100]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [7795860.267929] server systemd-resolved[100]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [7795860.267946] server systemd-resolved[100]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [7795860.278535] server systemd-resolved[100]: Using system hostname 'server'. container-test-run-certificates> server # [7795860.279386] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [7795860.279439] server systemd[1]: Reached target Network. container-test-run-certificates> server # [7795860.279468] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [7795860.279495] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [7795860.279623] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [7795860.279636] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [7795860.279645] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [7795860.279658] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [7795860.279731] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [7795860.279787] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [7795860.279862] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [7795860.279873] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [7795860.279892] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [7795860.293270] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [7795860.293829] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [7795860.293849] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [7795860.294762] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [7795860.295549] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [7795860.304378] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [7795860.398141] server acme-setup-privileged[191]: + set -euo pipefail container-test-run-certificates> server # [7795860.398141] server acme-setup-privileged[191]: + cd /var/lib/acme container-test-run-certificates> server # [7795860.398642] server acme-setup-privileged[191]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [7795860.399413] server acme-setup-privileged[191]: + chown -R acme .lego/accounts container-test-run-certificates> server # [7795860.400339] server acme-setup-privileged[191]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [7795860.400350] server acme-setup-privileged[191]: + '[' -d test.foo ']' container-test-run-certificates> server # [7795860.400361] server acme-setup-privileged[191]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [7795860.400361] server acme-setup-privileged[191]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [7795860.412444] server nsncd[193]: Aug 29 15:31:57.778 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [7795860.412480] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [7795860.412529] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [7795860.412564] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [7795860.422831] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [7795860.423347] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [7795860.429673] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [7795860.430306] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [7795860.430333] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [7795860.430344] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [7795860.513407] server dbus-broker-launch[194]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [7795860.514125] server dbus-broker-launch[194]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [7795860.514125] server dbus-broker-launch[194]: Invalid user-name in /nix/store/0pgc9air17alr427hx1lc5x9wnyi4fv0-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [7795860.514423] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [7795860.518480] server dbus-broker-launch[194]: Ready container-test-run-certificates> client # [7795860.266419] client systemd-resolved[92]: Positive Trust Anchors: container-test-run-certificates> client # [7795860.266429] client systemd-resolved[92]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [7795860.266431] client systemd-resolved[92]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [7795860.266448] client systemd-resolved[92]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [7795860.277976] client systemd-resolved[92]: Using system hostname 'client'. container-test-run-certificates> client # [7795860.278972] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [7795860.279059] client systemd[1]: Reached target Network. container-test-run-certificates> client # [7795860.279098] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [7795860.279132] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [7795860.255419] ca systemd-resolved[107]: Positive Trust Anchors: container-test-run-certificates> ca # [7795860.255426] ca systemd-resolved[107]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [7795860.279146] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [7795860.255429] ca systemd-resolved[107]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [7795860.279158] client systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [7795860.255445] ca systemd-resolved[107]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [7795860.266527] ca systemd-resolved[107]: Using system hostname 'ca'. container-test-run-certificates> client # [7795860.279239] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [7795860.267448] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [7795860.279305] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [7795860.267518] ca systemd[1]: Reached target Network. container-test-run-certificates> client # [7795860.279381] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [7795860.267555] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> client # [7795860.279393] client systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [7795860.267591] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [7795860.279414] client systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [7795860.267739] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> client # [7795860.293257] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [7795860.267766] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [7795860.293860] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [7795860.267784] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [7795860.294897] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [7795860.267799] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [7795860.304932] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [7795860.267894] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [7795860.409989] client nsncd[188]: Aug 29 15:31:57.775 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [7795860.267971] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [7795860.410104] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [7795860.268070] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [7795860.410159] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [7795860.268088] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [7795860.410193] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [7795860.268116] ca systemd[1]: Reached target Basic System. container-test-run-certificates> client # [7795860.422797] client systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [7795860.268878] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> client # [7795860.423468] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [7795860.269278] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [7795860.430362] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [7795860.269300] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> client # [7795860.430973] client systemd[1]: Started Console Getty. container-test-run-certificates> ca # [7795860.269741] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [7795860.431004] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [7795860.270196] ca systemd[1]: Starting step-ca service... container-test-run-certificates> client # [7795860.431018] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [7795860.270824] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [7795860.302815] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [7795860.401352] ca acme-setup-privileged[200]: + set -euo pipefail container-test-run-certificates> ca # [7795860.401352] ca acme-setup-privileged[200]: + cd /var/lib/acme container-test-run-certificates> ca # [7795860.401685] ca acme-setup-privileged[200]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [7795860.402121] ca acme-setup-privileged[200]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [7795860.402961] ca acme-setup-privileged[200]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [7795860.402986] ca acme-setup-privileged[200]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [7795860.402986] ca acme-setup-privileged[200]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [7795860.402986] ca acme-setup-privileged[200]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [7795860.421822] ca nsncd[202]: Aug 29 15:31:57.787 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [7795860.421858] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [7795860.421898] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [7795860.421934] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [7795860.422764] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [7795860.423348] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [7795860.429671] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [7795860.430213] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [7795860.430231] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [7795860.430243] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [7795860.537029] ca dbus-broker-launch[204]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [7795860.537745] ca dbus-broker-launch[204]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [7795860.537745] ca dbus-broker-launch[204]: Invalid user-name in /nix/store/gpdxpznvl5s3x1lll78m5sc9cdp1kx2s-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [7795860.538135] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [7795860.523045] client dbus-broker-launch[189]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [7795860.523645] client dbus-broker-launch[189]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [7795860.523645] client dbus-broker-launch[189]: Invalid user-name in /nix/store/91l6d2rr3446jkw7ll0r95z9ca8qijjq-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [7795860.541571] ca dbus-broker-launch[204]: Ready container-test-run-certificates> client # [7795860.523867] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [7795860.527309] client dbus-broker-launch[189]: Ready container-test-run-certificates> server # [7795860.917667] server systemd-logind[219]: New seat seat0. container-test-run-certificates> server # [7795860.917766] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [7795860.931294] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [7795860.941943] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [7795860.942083] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [7795861.063591] server acme-setup-start[207]: + set -euo pipefail container-test-run-certificates> server # [7795861.063591] server acme-setup-start[207]: + test -e ca/key.pem container-test-run-certificates> server # [7795861.063874] server acme-setup-start[207]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [7795861.070551] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [7795861.089178] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> client # [7795860.907146] client systemd-logind[204]: New seat seat0. container-test-run-certificates> client # [7795860.907298] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [7795860.908491] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [7795860.943366] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [7795860.943409] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [7795860.943620] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [7795861.001657] ca systemd-logind[230]: New seat seat0. container-test-run-certificates> ca # [7795861.001812] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [7795861.002596] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [7795861.033631] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [7795861.033767] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [7795861.060240] ca acme-setup-start[218]: + set -euo pipefail container-test-run-certificates> ca # [7795861.060443] ca acme-setup-start[218]: + test -e ca/key.pem container-test-run-certificates> ca # [7795861.060443] ca acme-setup-start[218]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [7795861.066803] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [7795861.067598] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [7795861.239728] ca step-ca[203]: badger 2026/08/29 15:31:58 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [7795861.243167] ca step-ca[203]: 2026/08/29 15:31:58 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [7795861.246217] ca step-ca[203]: 2026/08/29 15:31:58 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [7795861.246217] ca step-ca[203]: 2026/08/29 15:31:58 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [7795861.246217] ca step-ca[203]: 2026/08/29 15:31:58 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [7795861.246217] ca step-ca[203]: 2026/08/29 15:31:58 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [7795861.246217] ca step-ca[203]: 2026/08/29 15:31:58 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [7795861.246217] ca step-ca[203]: 2026/08/29 15:31:58 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [7795861.246217] ca step-ca[203]: 2026/08/29 15:31:58 X.509 Root Fingerprint: e66e070a9af4f3b248f523bd3ca5cb4479186bff51ece71b355d138839702030 container-test-run-certificates> ca # [7795861.246350] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [7795861.246417] ca step-ca[203]: 2026/08/29 15:31:58 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [7795861.310091] ca systemd-networkd[195]: eth1: Gained IPv6LL container-test-run-certificates> ca: must succeed: systemctl restart acme-order-renew-ca.foo.service container-test-run-certificates> client # [7795861.693104] client systemd-networkd[182]: eth1: Gained IPv6LL container-test-run-certificates> server # [7795861.755665] server acme-test.foo-start[244]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [7795861.757558] server acme-test.foo-start[244]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [7795861.757591] server acme-test.foo-start[244]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [7795861.762346] server acme-test.foo-start[254]: + cd test.foo container-test-run-certificates> server # [7795861.762634] server acme-test.foo-start[254]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [7795861.763331] server acme-test.foo-start[255]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [7795861.763515] server acme-test.foo-start[254]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [7795861.764306] server acme-test.foo-start[254]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [7795861.764447] server acme-test.foo-start[244]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [7795861.765396] server acme-test.foo-start[244]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [7795861.766401] server acme-test.foo-start[244]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [7795861.767543] server acme-test.foo-start[244]: + for fixpath in out certificates container-test-run-certificates> server # [7795861.767543] server acme-test.foo-start[244]: + '[' -d out ']' container-test-run-certificates> server # [7795861.767543] server acme-test.foo-start[244]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [7795861.768437] server acme-test.foo-start[244]: + chown -R acme:nginx out container-test-run-certificates> server # [7795861.770103] server acme-test.foo-start[244]: + for fixpath in out certificates container-test-run-certificates> server # [7795861.770103] server acme-test.foo-start[244]: + '[' -d certificates ']' container-test-run-certificates> server # [7795861.777446] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [7795861.778332] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [7795861.822109] server systemd-networkd[186]: eth1: Gained IPv6LL container-test-run-certificates> ca # [7795861.831979] ca acme-ca.foo-start[255]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [7795861.833701] ca acme-ca.foo-start[255]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [7795861.833701] ca acme-ca.foo-start[255]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [7795861.838320] ca acme-ca.foo-start[281]: + cd ca.foo container-test-run-certificates> ca # [7795861.838629] ca acme-ca.foo-start[281]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [7795861.839289] ca acme-ca.foo-start[282]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [7795861.839444] ca acme-ca.foo-start[281]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [7795861.840178] ca acme-ca.foo-start[281]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [7795861.840319] ca acme-ca.foo-start[255]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [7795861.842072] ca acme-ca.foo-start[255]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [7795861.843015] ca acme-ca.foo-start[255]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [7795861.843884] ca acme-ca.foo-start[255]: + for fixpath in out certificates container-test-run-certificates> ca # [7795861.843906] ca acme-ca.foo-start[255]: + '[' -d out ']' container-test-run-certificates> ca # [7795861.843906] ca acme-ca.foo-start[255]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [7795861.844719] ca acme-ca.foo-start[255]: + chown -R acme:nginx out container-test-run-certificates> ca # [7795861.846112] ca acme-ca.foo-start[255]: + for fixpath in out certificates container-test-run-certificates> ca # [7795861.846133] ca acme-ca.foo-start[255]: + '[' -d certificates ']' container-test-run-certificates> ca # [7795861.847761] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [7795861.853651] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [7795862.324331] server nginx-pre-start[266]: nginx: the configuration file /nix/store/i3shb91swdhxxybfsz96km99fkcdhisp-nginx.conf syntax is ok container-test-run-certificates> ca # [7795862.384206] ca nginx-pre-start[293]: nginx: the configuration file /nix/store/nhgkqzf0bl1zdjaabizjaga2992vk8lp-nginx.conf syntax is ok container-test-run-certificates> ca # [7795862.384595] ca nginx-pre-start[293]: nginx: configuration file /nix/store/nhgkqzf0bl1zdjaabizjaga2992vk8lp-nginx.conf test is successful container-test-run-certificates> ca # [7795862.387466] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [7795862.387773] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [7795862.388564] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> server # [7795862.324672] server nginx-pre-start[266]: nginx: configuration file /nix/store/i3shb91swdhxxybfsz96km99fkcdhisp-nginx.conf test is successful container-test-run-certificates> server # [7795862.328692] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [7795862.328920] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [7795862.329540] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [7795863.129688] server acme-order-renew-test.foo-start[269]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [7795863.131620] server acme-order-renew-test.foo-start[269]: + set -euo pipefail container-test-run-certificates> server # [7795863.131694] server acme-order-renew-test.foo-start[269]: + echo ad12aa6741ce4bd2c108 container-test-run-certificates> server # [7795863.131731] server acme-order-renew-test.foo-start[269]: + cmp -s domainhash.txt certificates/domainhash.txt container-test-run-certificates> server # [7795863.132563] server acme-order-renew-test.foo-start[269]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run container-test-run-certificates> server # [7795863.142918] server acme-order-renew-test.foo-start[280]: 2026/08/29 15:32:00 No key found for account none@none.tld. Generating a P256 key. container-test-run-certificates> server # [7795863.143238] server acme-order-renew-test.foo-start[280]: 2026/08/29 15:32:00 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key container-test-run-certificates> server # [7795863.237660] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [7795863.238544] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [7795863.238576] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [7795863.239353] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [7795863.280693] ca acme-order-renew-ca.foo-start[296]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [7795863.282478] ca acme-order-renew-ca.foo-start[296]: + set -euo pipefail container-test-run-certificates> ca # [7795863.282559] ca acme-order-renew-ca.foo-start[296]: + echo 88dc4fc401a6091a1bd9 container-test-run-certificates> ca # [7795863.282617] ca acme-order-renew-ca.foo-start[296]: + cmp -s domainhash.txt certificates/domainhash.txt container-test-run-certificates> ca # [7795863.283267] ca acme-order-renew-ca.foo-start[296]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run container-test-run-certificates> ca # [7795863.291688] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 No key found for account none@none.tld. Generating a P256 key. container-test-run-certificates> ca # [7795863.291894] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key container-test-run-certificates> ca # [7795863.306578] ca step-ca[203]: time="2026-08-29T15:32:00Z" level=info duration="89.418µs" duration-ns=89418 fields.time="2026-08-29T15:32:00Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a9148e5e-779a-4779-a86e-54ace2ad3221 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795863.306921] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] acme: Registering account for none@none.tld container-test-run-certificates> ca # [7795863.308098] ca step-ca[203]: time="2026-08-29T15:32:00Z" level=info duration=1.21456ms duration-ns=1214560 fields.time="2026-08-29T15:32:00Z" method=HEAD name=ca nonce=RHRWT3pDbXFwSFBITXliWVlidUNITnVxVkMyQVNEdXg path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=580a1970-9a32-495c-982e-de9fc53a9c71 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795863.309827] ca step-ca[203]: time="2026-08-29T15:32:00Z" level=info duration=1.216082ms duration-ns=1216082 fields.time="2026-08-29T15:32:00Z" method=POST name=ca nonce=bWNQaHhiMWRtbmpxZXA3ZzZ5UVh4ZEp3Z29TcVRoTzk path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a8db1f0f-756f-4f40-8d9e-bf9a1e1e688a response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/VqyG9mzHVXlC3TKNeOy2C7XLXm8XpsNu/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795863.309983] ca acme-order-renew-ca.foo-start[309]: !!!! HEADS UP !!!! container-test-run-certificates> ca # [7795863.309983] ca acme-order-renew-ca.foo-start[309]: Your account credentials have been saved in your container-test-run-certificates> ca # [7795863.309983] ca acme-order-renew-ca.foo-start[309]: configuration directory at "accounts". container-test-run-certificates> ca # [7795863.309983] ca acme-order-renew-ca.foo-start[309]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [7795863.309983] ca acme-order-renew-ca.foo-start[309]: configuration directory will also contain private keys container-test-run-certificates> ca # [7795863.309983] ca acme-order-renew-ca.foo-start[309]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [7795863.309983] ca acme-order-renew-ca.foo-start[309]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [7795863.310116] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate container-test-run-certificates> ca # [7795863.311977] ca step-ca[203]: time="2026-08-29T15:32:00Z" level=info duration=1.700494ms duration-ns=1700494 fields.time="2026-08-29T15:32:00Z" method=POST name=ca nonce=ZGdsRUhiZzFjdHJPaklHVUs3RzRETzdSdGFnRFdnNUw path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=120bd80a-2a85-4242-a6c6-59229d17d1e5 response="{\"id\":\"gGgOp8B6PixVIr6cnwm9vlE6ehn83ZvU\",\"status\":\"pending\",\"expires\":\"2026-08-30T15:32:00Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-29T15:31:00Z\",\"notAfter\":\"2026-11-27T15:32:00Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/gGgOp8B6PixVIr6cnwm9vlE6ehn83ZvU/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795863.370238] ca step-ca[203]: time="2026-08-29T15:32:00Z" level=info duration=1.42137ms duration-ns=1421370 fields.time="2026-08-29T15:32:00Z" method=POST name=ca nonce=ckcwYjd5amhhdHJobktNR0Y3RnNidVppQ2xTdExPWDM path=/acme/acme/authz/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=fc14599e-4b0f-4ba0-82a9-2b66ed6d1732 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"pa39Gcbot6LilOKAmdS5jm2F5u5o5SZl\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr/nw0gSFAOv6jdIrFmQ2Ft9MF6hAf8JKgw\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"pa39Gcbot6LilOKAmdS5jm2F5u5o5SZl\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr/FuZ4vCQnUuvWW4VVjyCtyKvG5JrO7qFf\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"pa39Gcbot6LilOKAmdS5jm2F5u5o5SZl\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr/FuEPMcbPHi0RdXQG5CQ0GzT6ttQhoMvw\"}],\"wildcard\":false,\"expires\":\"2026-08-30T15:32:00Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795863.370477] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr container-test-run-certificates> ca # [7795863.370477] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01 container-test-run-certificates> ca # [7795863.370527] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] [ca.foo] acme: use http-01 solver container-test-run-certificates> ca # [7795863.370527] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] [ca.foo] acme: Trying to solve HTTP-01 container-test-run-certificates> ca # [7795863.372912] ca step-ca[203]: time="2026-08-29T15:32:00Z" level=info duration=2.149481ms duration-ns=2149481 fields.time="2026-08-29T15:32:00Z" method=POST name=ca nonce=NHM4R1Iydkx2c1dQN1dPUGg0TVpOMUZkSUFQQlNtQWk path=/acme/acme/challenge/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr/FuZ4vCQnUuvWW4VVjyCtyKvG5JrO7qFf protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=0acf8920-c2d8-4cca-87c3-c16d6bc20601 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"pa39Gcbot6LilOKAmdS5jm2F5u5o5SZl\",\"validated\":\"2026-08-29T15:32:00Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr/FuZ4vCQnUuvWW4VVjyCtyKvG5JrO7qFf\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795863.373100] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] [ca.foo] The server validated our request container-test-run-certificates> ca # [7795863.373192] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates container-test-run-certificates> ca # [7795863.376297] ca step-ca[203]: time="2026-08-29T15:32:00Z" level=info duration=2.668349ms duration-ns=2668349 fields.time="2026-08-29T15:32:00Z" method=POST name=ca nonce=aDRuR1hUMThhb09qaDhsZUNzajZ2MjBCZFloRDd5bVc path=/acme/acme/order/gGgOp8B6PixVIr6cnwm9vlE6ehn83ZvU/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=73b9f374-c836-4e5a-8a40-56eed8121809 response="{\"id\":\"gGgOp8B6PixVIr6cnwm9vlE6ehn83ZvU\",\"status\":\"valid\",\"expires\":\"2026-08-30T15:32:00Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-29T15:31:00Z\",\"notAfter\":\"2026-11-27T15:32:00Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/w54vWUTY6DH3hQaojMTPdgyJcmbOylwr\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/gGgOp8B6PixVIr6cnwm9vlE6ehn83ZvU/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/jqbcA5robDJdfxRgsvcvHeWamlzaaOlZ\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795863.377308] ca step-ca[203]: time="2026-08-29T15:32:00Z" level=info certificate="MIIB1DCCAXqgAwIBAgIRAOOUkwE7orYZkoBIZmH57UMwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODI5MTUzMTAwWhcNMjYxMTI3MTUzMjAwWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARjF49QzLFubtm25ZWPaBTMiqaKjopll0U9t1aZOmJqIdlRZuO+R9INnriPI+u8Bqcqh2YT37w8YQO/gsMMD35fo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFC5LlIZr+P6kuCKiEKafdWgnpvg7MB8GA1UdIwQYMBaAFJ1vVkpOmiY6PzLTFSrHz1QMM0gPMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIhAIOyDTm9e/PQ5hkjsXUcbdy7eCMgD7jIKROZhLs0pSTAAiAfMGtTHz5M92fQnXSlHQglljypiVYTvZvKKu4HCZjrNg==" duration="627.844µs" duration-ns=627844 fields.time="2026-08-29T15:32:00Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=RzBha1h5RkhOQ2U1YW1NcEVjZTFuOURPQUFLcW1wbXQ path=/acme/acme/certificate/jqbcA5robDJdfxRgsvcvHeWamlzaaOlZ protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=3b882a37-d7e9-4336-b403-247d7132c127 sans="map[dns:[ca.foo]]" serial=302506196590135278452665304210202029379 size=1344 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= valid-from="2026-08-29T15:31:00Z" valid-to="2026-11-27T15:32:00Z" container-test-run-certificates> ca # [7795863.377436] ca acme-order-renew-ca.foo-start[309]: 2026/08/29 15:32:00 [INFO] [ca.foo] Server responded with a certificate. container-test-run-certificates> ca # [7795863.380043] ca acme-order-renew-ca.foo-start[296]: + mv domainhash.txt certificates/ container-test-run-certificates> ca # [7795863.381068] ca acme-order-renew-ca.foo-start[296]: + touch out/acme-success container-test-run-certificates> ca # [7795863.381936] ca acme-order-renew-ca.foo-start[296]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [7795863.382598] ca acme-order-renew-ca.foo-start[296]: + touch out/renewed container-test-run-certificates> ca # [7795863.383797] ca acme-order-renew-ca.foo-start[296]: + echo Installing new certificate container-test-run-certificates> ca # [7795863.383797] ca acme-order-renew-ca.foo-start[296]: Installing new certificate container-test-run-certificates> ca # [7795863.383841] ca acme-order-renew-ca.foo-start[296]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [7795863.384843] ca acme-order-renew-ca.foo-start[329]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [7795863.385050] ca acme-order-renew-ca.foo-start[296]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [7795863.385910] ca acme-order-renew-ca.foo-start[330]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [7795863.386161] ca acme-order-renew-ca.foo-start[296]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [7795863.387138] ca acme-order-renew-ca.foo-start[331]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [7795863.387302] ca acme-order-renew-ca.foo-start[296]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [7795863.388176] ca acme-order-renew-ca.foo-start[296]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [7795863.389096] ca acme-order-renew-ca.foo-start[296]: + for fixpath in out certificates container-test-run-certificates> ca # [7795863.389096] ca acme-order-renew-ca.foo-start[296]: + '[' -d out ']' container-test-run-certificates> ca # [7795863.389130] ca acme-order-renew-ca.foo-start[296]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [7795863.389966] ca acme-order-renew-ca.foo-start[296]: + chown -R acme:nginx out container-test-run-certificates> ca # [7795863.391803] ca acme-order-renew-ca.foo-start[296]: + for fixpath in out certificates container-test-run-certificates> ca # [7795863.391827] ca acme-order-renew-ca.foo-start[296]: + '[' -d certificates ']' container-test-run-certificates> ca # [7795863.391827] ca acme-order-renew-ca.foo-start[296]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [7795863.392754] ca acme-order-renew-ca.foo-start[296]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [7795863.394296] ca acme-order-renew-ca.foo-start[296]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [7795863.544335] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> client # [7795863.240543] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [7795863.241576] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [7795863.241725] client systemd[1]: Startup finished in 4.052s. container-test-run-certificates> ca # [7795863.547514] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [7795863.547686] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [7795864.003296] ca nginx[347]: nginx: the configuration file /nix/store/nhgkqzf0bl1zdjaabizjaga2992vk8lp-nginx.conf syntax is ok container-test-run-certificates> ca # [7795864.003586] ca nginx[347]: nginx: configuration file /nix/store/nhgkqzf0bl1zdjaabizjaga2992vk8lp-nginx.conf test is successful container-test-run-certificates> server # [7795864.163761] server acme-order-renew-test.foo-start[280]: 2026/08/29 15:32:01 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 2 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority container-test-run-certificates> server # [7795864.166420] server acme-order-renew-test.foo-start[269]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start. container-test-run-certificates> server # [7795864.166420] server acme-order-renew-test.foo-start[269]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start. container-test-run-certificates> server # [7795864.166678] server acme-order-renew-test.foo-start[269]: + exit 10 container-test-run-certificates> server # [7795864.171137] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a container-test-run-certificates> server # [7795864.171248] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'. container-test-run-certificates> server # [7795864.171466] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo. container-test-run-certificates> server # [7795864.171717] server systemd[1]: Startup finished in 4.976s. container-test-run-certificates> ca # [7795864.659987] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [7795864.660855] ca systemd[1]: Startup finished in 5.463s. container-test-run-certificates> ca # [7795865.083300] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [7795865.849844] ca acme-order-renew-ca.foo-start[362]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [7795865.851876] ca acme-order-renew-ca.foo-start[362]: + set -euo pipefail container-test-run-certificates> ca # [7795865.851944] ca acme-order-renew-ca.foo-start[362]: + echo 88dc4fc401a6091a1bd9 container-test-run-certificates> ca # [7795865.852021] ca acme-order-renew-ca.foo-start[362]: + cmp -s domainhash.txt certificates/domainhash.txt container-test-run-certificates> ca # [7795865.852855] ca acme-order-renew-ca.foo-start[362]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [7795865.852902] ca acme-order-renew-ca.foo-start[362]: + '[' -e certificates/ca.foo.crt ']' container-test-run-certificates> ca # [7795865.853205] ca acme-order-renew-ca.foo-start[370]: ++ find accounts -name none@none.tld.key container-test-run-certificates> ca # [7795865.854752] ca acme-order-renew-ca.foo-start[362]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']' container-test-run-certificates> ca # [7795865.854783] ca acme-order-renew-ca.foo-start[362]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic container-test-run-certificates> ca # [7795865.879487] ca step-ca[203]: time="2026-08-29T15:32:03Z" level=info duration="46.798µs" duration-ns=46798 fields.time="2026-08-29T15:32:03Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=d1dcdf64-d781-4648-b95d-7aa5c17fc80e response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795865.879890] ca acme-order-renew-ca.foo-start[371]: 2026/08/29 15:32:03 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint container-test-run-certificates> ca # [7795865.879890] ca acme-order-renew-ca.foo-start[371]: 2026/08/29 15:32:03 [INFO] [ca.foo] The certificate expires at 2026-11-27T15:32:00Z, the renewal can be performed in 1439h59m36.754653639s: no renewal. container-test-run-certificates> ca # [7795865.880023] ca acme-order-renew-ca.foo-start[362]: + mv domainhash.txt certificates/ container-test-run-certificates> ca # [7795865.881396] ca acme-order-renew-ca.foo-start[362]: + touch out/acme-success container-test-run-certificates> ca # [7795865.882579] ca acme-order-renew-ca.foo-start[362]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [7795865.883324] ca acme-order-renew-ca.foo-start[362]: + for fixpath in out certificates container-test-run-certificates> ca # [7795865.883350] ca acme-order-renew-ca.foo-start[362]: + '[' -d out ']' container-test-run-certificates> ca # [7795865.883350] ca acme-order-renew-ca.foo-start[362]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [7795865.884288] ca acme-order-renew-ca.foo-start[362]: + chown -R acme:nginx out container-test-run-certificates> ca # [7795865.886081] ca acme-order-renew-ca.foo-start[362]: + for fixpath in out certificates container-test-run-certificates> ca # [7795865.886081] ca acme-order-renew-ca.foo-start[362]: + '[' -d certificates ']' container-test-run-certificates> ca # [7795865.886127] ca acme-order-renew-ca.foo-start[362]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [7795865.887070] ca acme-order-renew-ca.foo-start[362]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [7795865.888589] ca acme-order-renew-ca.foo-start[362]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 4.35 seconds) container-test-run-certificates> ca # [7795866.287490] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [7795866.287643] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> server: must succeed: systemctl restart acme-test.foo.service container-test-run-certificates> server # [7795869.298369] server systemd[1]: acme-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [7795869.298466] server systemd[1]: Stopped Ensure certificate for test.foo. container-test-run-certificates> server # [7795869.299206] server systemd[1]: Stopping Ensure certificate for test.foo... container-test-run-certificates> server # [7795869.300330] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> server: (finished: must succeed: systemctl restart acme-test.foo.service, in 1.24 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [110 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 15:31:59 2026 GMT container-test-run-certificates> * expire date: Sep 28 15:31:59 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7074d2 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> server # [7795870.507461] server acme-test.foo-start[304]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [7795870.509257] server acme-test.foo-start[304]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [7795870.509257] server acme-test.foo-start[304]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [7795870.515504] server acme-test.foo-start[314]: + cd test.foo container-test-run-certificates> server # [7795870.515825] server acme-test.foo-start[314]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [7795870.516765] server acme-test.foo-start[315]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [7795870.516976] server acme-test.foo-start[314]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [7795870.517853] server acme-test.foo-start[314]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [7795870.518025] server acme-test.foo-start[304]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [7795870.519103] server acme-test.foo-start[304]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [7795870.520214] server acme-test.foo-start[304]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [7795870.521180] server acme-test.foo-start[304]: + for fixpath in out certificates container-test-run-certificates> server # [7795870.521216] server acme-test.foo-start[304]: + '[' -d out ']' container-test-run-certificates> server # [7795870.521216] server acme-test.foo-start[304]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [7795870.522294] server acme-test.foo-start[304]: + chown -R acme:nginx out container-test-run-certificates> server # [7795870.524089] server acme-test.foo-start[304]: + for fixpath in out certificates container-test-run-certificates> server # [7795870.524120] server acme-test.foo-start[304]: + '[' -d certificates ']' container-test-run-certificates> server # [7795870.526270] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [7795870.528454] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [112 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 15:31:59 2026 GMT container-test-run-certificates> * expire date: Sep 28 15:31:59 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7074d2 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [111 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 15:31:59 2026 GMT container-test-run-certificates> * expire date: Sep 28 15:31:59 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7074d2 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> server # [7795872.773649] server acme-order-renew-test.foo-start[322]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [7795872.775602] server acme-order-renew-test.foo-start[322]: + set -euo pipefail container-test-run-certificates> server # [7795872.775665] server acme-order-renew-test.foo-start[322]: + echo ad12aa6741ce4bd2c108 container-test-run-certificates> server # [7795872.775751] server acme-order-renew-test.foo-start[322]: + cmp -s domainhash.txt certificates/domainhash.txt container-test-run-certificates> server # [7795872.776615] server acme-order-renew-test.foo-start[322]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run container-test-run-certificates> server # [7795872.831327] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] acme: Registering account for none@none.tld container-test-run-certificates> ca # [7795872.829277] ca step-ca[203]: time="2026-08-29T15:32:10Z" level=info duration="69.17µs" duration-ns=69170 fields.time="2026-08-29T15:32:10Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=1204847d-bd45-4f9b-a275-ec2680e7bcf3 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795872.994695] ca step-ca[203]: time="2026-08-29T15:32:10Z" level=info duration=162.705791ms duration-ns=162705791 fields.time="2026-08-29T15:32:10Z" method=HEAD name=ca nonce=cG1uQnFVSjJ3emtBZTRGeUpmbnZCWElNOGhwMXJOYTI path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=ed15e1b6-5a89-4218-908f-df49edc27483 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795873.050416] ca step-ca[203]: time="2026-08-29T15:32:10Z" level=info duration=53.720707ms duration-ns=53720707 fields.time="2026-08-29T15:32:10Z" method=POST name=ca nonce=WXVhTmhTd1ZSeHk3RTFHOTFPc2ZjWHNhRFFUdlJXcTk path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=a8d44eb0-c45d-4792-bf20-05f14bb205f7 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/0NIVkNK0KGF7gAXwj4GQP0ltgGuHt66a/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795873.086167] ca step-ca[203]: time="2026-08-29T15:32:10Z" level=info duration=32.958367ms duration-ns=32958367 fields.time="2026-08-29T15:32:10Z" method=POST name=ca nonce=cHpKNW5WZHN1TWI0cWFmeGFZUFVETTVtNVRJbUNicWI path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=87d4fb19-6d82-40d4-a327-4d445920b550 response="{\"id\":\"bRcteXh3J3eJF6Gr23UGCcaNsjBUf3vf\",\"status\":\"pending\",\"expires\":\"2026-08-30T15:32:10Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-29T15:31:10Z\",\"notAfter\":\"2026-11-27T15:32:10Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d\"],\"finalize\":\"https://ca.foo/acme/acme/order/bRcteXh3J3eJF6Gr23UGCcaNsjBUf3vf/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> server # [7795873.051359] server acme-order-renew-test.foo-start[330]: !!!! HEADS UP !!!! container-test-run-certificates> server # [7795873.051359] server acme-order-renew-test.foo-start[330]: Your account credentials have been saved in your container-test-run-certificates> server # [7795873.051359] server acme-order-renew-test.foo-start[330]: configuration directory at "accounts". container-test-run-certificates> server # [7795873.051359] server acme-order-renew-test.foo-start[330]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [7795873.051359] server acme-order-renew-test.foo-start[330]: configuration directory will also contain private keys container-test-run-certificates> server # [7795873.051359] server acme-order-renew-test.foo-start[330]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [7795873.051359] server acme-order-renew-test.foo-start[330]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [7795873.051359] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] [test.foo] acme: Obtaining bundled SAN certificate container-test-run-certificates> server # [7795873.170020] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d container-test-run-certificates> server # [7795873.170020] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01 container-test-run-certificates> server # [7795873.170020] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] [test.foo] acme: use http-01 solver container-test-run-certificates> server # [7795873.170020] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] [test.foo] acme: Trying to solve HTTP-01 container-test-run-certificates> server # [7795873.186234] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] [test.foo] The server validated our request container-test-run-certificates> server # [7795873.186234] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] [test.foo] acme: Validations succeeded; requesting certificates container-test-run-certificates> server # [7795873.205653] server acme-order-renew-test.foo-start[330]: 2026/08/29 15:32:10 [INFO] [test.foo] Server responded with a certificate. container-test-run-certificates> server # [7795873.208796] server acme-order-renew-test.foo-start[322]: + mv domainhash.txt certificates/ container-test-run-certificates> server # [7795873.210453] server acme-order-renew-test.foo-start[322]: + touch out/acme-success container-test-run-certificates> server # [7795873.212338] server acme-order-renew-test.foo-start[322]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [7795873.213532] server acme-order-renew-test.foo-start[322]: + touch out/renewed container-test-run-certificates> server # [7795873.214730] server acme-order-renew-test.foo-start[322]: + echo Installing new certificate container-test-run-certificates> server # [7795873.214730] server acme-order-renew-test.foo-start[322]: Installing new certificate container-test-run-certificates> server # [7795873.214730] server acme-order-renew-test.foo-start[322]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [7795873.216140] server acme-order-renew-test.foo-start[349]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [7795873.216266] server acme-order-renew-test.foo-start[322]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [7795873.217427] server acme-order-renew-test.foo-start[350]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [7795873.217771] server acme-order-renew-test.foo-start[322]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [7795873.219391] server acme-order-renew-test.foo-start[351]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [7795873.219644] server acme-order-renew-test.foo-start[322]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [7795873.220975] server acme-order-renew-test.foo-start[322]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [7795873.222267] server acme-order-renew-test.foo-start[322]: + for fixpath in out certificates container-test-run-certificates> server # [7795873.222267] server acme-order-renew-test.foo-start[322]: + '[' -d out ']' container-test-run-certificates> server # [7795873.222267] server acme-order-renew-test.foo-start[322]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [7795873.223328] server acme-order-renew-test.foo-start[322]: + chown -R acme:nginx out container-test-run-certificates> server # [7795873.225924] server acme-order-renew-test.foo-start[322]: + for fixpath in out certificates container-test-run-certificates> server # [7795873.225924] server acme-order-renew-test.foo-start[322]: + '[' -d certificates ']' container-test-run-certificates> server # [7795873.225924] server acme-order-renew-test.foo-start[322]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [7795873.228246] server acme-order-renew-test.foo-start[322]: + chown -R acme:nginx certificates container-test-run-certificates> server # [7795873.230851] server acme-order-renew-test.foo-start[322]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [7795873.168843] ca step-ca[203]: time="2026-08-29T15:32:10Z" level=info duration=24.161347ms duration-ns=24161347 fields.time="2026-08-29T15:32:10Z" method=POST name=ca nonce=MmJkQ3V0YWY4Zm1HWGpneXVick8xMDVtdTczTVJkc0o path=/acme/acme/authz/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d protocol=HTTP/1.1 referer= remote-address="::1" request-id=97cfa0a9-91d9-4bdd-9db0-6f9fdc7de109 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"CmXR4PWHNN8sS4cy3TSwAFPiiOVHQ0UL\",\"url\":\"https://ca.foo/acme/acme/challenge/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d/CBsx3d608yru06suQxgI21uVjQnz3Qq1\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"CmXR4PWHNN8sS4cy3TSwAFPiiOVHQ0UL\",\"url\":\"https://ca.foo/acme/acme/challenge/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d/1lAO8hWlGMpcmyFr4XeVWLllDyfahB4e\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"CmXR4PWHNN8sS4cy3TSwAFPiiOVHQ0UL\",\"url\":\"https://ca.foo/acme/acme/challenge/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d/skRzG4ap967fmBqvEZjZ00AoacMqf21w\"}],\"wildcard\":false,\"expires\":\"2026-08-30T15:32:10Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795873.187023] ca step-ca[203]: time="2026-08-29T15:32:10Z" level=info duration=13.183357ms duration-ns=13183357 fields.time="2026-08-29T15:32:10Z" method=POST name=ca nonce=Q2k3dmJ6MnpZcU5RZHdmeFIzYU1ybnR6S3E0cXFxMXM path=/acme/acme/challenge/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d/1lAO8hWlGMpcmyFr4XeVWLllDyfahB4e protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=3bfbdb6e-2917-4013-b7e6-9e156ce96866 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"CmXR4PWHNN8sS4cy3TSwAFPiiOVHQ0UL\",\"validated\":\"2026-08-29T15:32:10Z\",\"url\":\"https://ca.foo/acme/acme/challenge/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d/1lAO8hWlGMpcmyFr4XeVWLllDyfahB4e\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795873.199265] ca step-ca[203]: time="2026-08-29T15:32:10Z" level=info duration=10.510108ms duration-ns=10510108 fields.time="2026-08-29T15:32:10Z" method=POST name=ca nonce=QWF3VVYzV3RrVWFqMVNOYnpNRFVWNExHZ2VRTnNKQWY path=/acme/acme/order/bRcteXh3J3eJF6Gr23UGCcaNsjBUf3vf/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=8c6b26ad-14dc-4e25-a916-88d53da70531 response="{\"id\":\"bRcteXh3J3eJF6Gr23UGCcaNsjBUf3vf\",\"status\":\"valid\",\"expires\":\"2026-08-30T15:32:10Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-29T15:31:10Z\",\"notAfter\":\"2026-11-27T15:32:10Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/7Ku2cCVJE7LZ55P0uWNcd7L0JZutFj0d\"],\"finalize\":\"https://ca.foo/acme/acme/order/bRcteXh3J3eJF6Gr23UGCcaNsjBUf3vf/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/J6D4LYuBjxuP8ObhoTGYrgkqbNHlKPDp\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7795873.203993] ca step-ca[203]: time="2026-08-29T15:32:10Z" level=info certificate="MIIB1zCCAX2gAwIBAgIQHGFvc5WvATyFKHvA0w8EbTAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA4MjkxNTMxMTBaFw0yNjExMjcxNTMyMTBaMBMxETAPBgNVBAMTCHRlc3QuZm9vMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcMxc7OsiX7v6QdDcBcU06uArrVA6d/uHhJHaXyz+bd2LLVkvIpkXt769Du+tSxD4YGrb+nAFDRCHeN26bjadKqOBpjCBozAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQKoBHNk1BAt/xIXjeFdjYX3fFFgDAfBgNVHSMEGDAWgBSdb1ZKTpomOj8y0xUqx89UDDNIDzATBgNVHREEDDAKggh0ZXN0LmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIhAPcGXqdjBcaYsuLCErtqr4GMRE3Y6K/Z//gRu2y5edfjAiAz9lcQSrC36e5nDCBUCz4EQCx7wQ4eWvVFQwyKoVxjGA==" duration=2.662658ms duration-ns=2662658 fields.time="2026-08-29T15:32:10Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=TzJja2ZuUVZIbzlyQ1pyaXd0ZzZ5ak5ZR1RRTnRPeDk path=/acme/acme/certificate/J6D4LYuBjxuP8ObhoTGYrgkqbNHlKPDp protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=d7f868c1-85c8-4217-a2c4-5e4a82eac0c0 sans="map[dns:[test.foo]]" serial=37724297182285051517669094946233058413 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= valid-from="2026-08-29T15:31:10Z" valid-to="2026-11-27T15:32:10Z" container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [110 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 15:31:59 2026 GMT container-test-run-certificates> * expire date: Sep 28 15:31:59 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7074d2 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> server # [7795874.373975] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [7795874.379160] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [7795874.379361] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [111 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 15:31:59 2026 GMT container-test-run-certificates> * expire date: Sep 28 15:31:59 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7074d2 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [112 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 15:31:59 2026 GMT container-test-run-certificates> * expire date: Sep 28 15:31:59 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7074d2 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> server # [7795875.457785] server nginx[367]: nginx: the configuration file /nix/store/i3shb91swdhxxybfsz96km99fkcdhisp-nginx.conf syntax is ok container-test-run-certificates> server # [7795875.458148] server nginx[367]: nginx: configuration file /nix/store/i3shb91swdhxxybfsz96km99fkcdhisp-nginx.conf test is successful container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [111 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 15:31:59 2026 GMT container-test-run-certificates> * expire date: Sep 28 15:31:59 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7074d2 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> server # [7795876.884258] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [931 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [80 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 15:31:10 2026 GMT container-test-run-certificates> * expire date: Nov 27 15:32:10 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 50064 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.21.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1165 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 7.25 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> 1c:61:6f:73:95:af:01:3c:85:28:7b:c0:d3:0f:04:6d container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Aug 29 15:31:10 2026 GMT container-test-run-certificates> Not After : Nov 27 15:32:10 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:70:cc:5c:ec:eb:22:5f:bb:fa:41:d0:dc:05:c5: container-test-run-certificates> 34:ea:e0:2b:ad:50:3a:77:fb:87:84:91:da:5f:2c: container-test-run-certificates> fe:6d:dd:8b:2d:59:2f:22:99:17:b7:be:bd:0e:ef: container-test-run-certificates> ad:4b:10:f8:60:6a:db:fa:70:05:0d:10:87:78:dd: container-test-run-certificates> ba:6e:36:9d:2a container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> 0A:A0:11:CD:93:50:40:B7:FC:48:5E:37:85:76:36:17:DD:F1:45:80 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 9D:6F:56:4A:4E:9A:26:3A:3F:32:D3:15:2A:C7:CF:54:0C:33:48:0F container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:45:02:21:00:f7:06:5e:a7:63:05:c6:98:b2:e2:c2:12:bb: container-test-run-certificates> 6a:af:81:8c:44:4d:d8:e8:af:d9:ff:f8:11:bb:6c:b9:79:d7: container-test-run-certificates> e3:02:20:33:f6:57:10:4a:b0:b7:e9:ee:67:0c:20:54:0b:3e: container-test-run-certificates> 04:40:2c:7b:c1:0e:1e:5a:f5:45:43:0c:8a:a1:5c:63:18 container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.03 seconds) container-test-run-certificates> (finished: run the VM test script, in 18.87 seconds) container-test-run-certificates> test script finished in 20.47s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 51) container-test-run-certificates> kill NspawnMachine (pid 56) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> kill NspawnMachine (pid 57) container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> Container server terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.24 seconds) post-build step Upload to niks3: ok time=2026-08-29T15:32:17.579Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)" time=2026-08-29T15:32:17.813Z level=INFO msg="Uploading 1 narinfos" time=2026-08-29T15:32:17.891Z level=INFO msg="Upload complete. (444ms)"