these 16 derivations will be built: /nix/store/8hph2a7bdpgq3chysy22w6rm26bx9ndv-nixos-test-driver-1.1.drv /nix/store/blqbbs55ybz34x9414vvrd8c712gka1w-etc.drv /nix/store/wkxb8247lr7wggyxq9h8rd0xj6ka88d7-activate.drv /nix/store/d7yjpmw4gyl9v0z2qxf99cz95pqdqddw-nixos-system-client-test.drv /nix/store/fzni92rq2nknrxdjjvxid6ywhn6b37gm-run-client-nspawn.drv /nix/store/kvf39j5h2jmc637wrbszgam5b7cv7s2j-etc.drv /nix/store/w1qs02xxqi24q0h7hkbp7ljykmgqlj0h-activate.drv /nix/store/prdnk3hfa426x55fpn2nhp30pccq9hk4-nixos-system-ca-test.drv /nix/store/g208k6b7rx10xnxkjcj90waw6zmgpwp4-run-ca-nspawn.drv /nix/store/g3vvfjaa5ikkw942hf5k11ggakwcj3zd-etc.drv /nix/store/zx3mr3cyjbw7xvx4bf8bs14hidlirv2q-activate.drv /nix/store/cr5n5m9f03ycxzc2y5zhhshsqm4v1nxp-nixos-system-server-test.drv /nix/store/kia8gqif6d9bnmph8c2w74hv2bcyiw4h-run-server-nspawn.drv /nix/store/bhzf5hhvmsis6vr7m2jswxrdfrszfb76-driverConfiguration.json.drv /nix/store/2nhj9w53ca5ndkcsba36r7arv80cwvkq-nixos-test-driver-certificates.drv /nix/store/l15h1mv8wxjin60ls0rs713y5zi2mwnc-container-test-run-certificates.drv building '/nix/store/blqbbs55ybz34x9414vvrd8c712gka1w-etc.drv' building '/nix/store/g3vvfjaa5ikkw942hf5k11ggakwcj3zd-etc.drv' building '/nix/store/kvf39j5h2jmc637wrbszgam5b7cv7s2j-etc.drv' building '/nix/store/wkxb8247lr7wggyxq9h8rd0xj6ka88d7-activate.drv' building '/nix/store/w1qs02xxqi24q0h7hkbp7ljykmgqlj0h-activate.drv' building '/nix/store/zx3mr3cyjbw7xvx4bf8bs14hidlirv2q-activate.drv' building '/nix/store/d7yjpmw4gyl9v0z2qxf99cz95pqdqddw-nixos-system-client-test.drv' building '/nix/store/prdnk3hfa426x55fpn2nhp30pccq9hk4-nixos-system-ca-test.drv' building '/nix/store/cr5n5m9f03ycxzc2y5zhhshsqm4v1nxp-nixos-system-server-test.drv' nixos-system-ca-test> structuredAttrs is enabled nixos-system-client-test> structuredAttrs is enabled building '/nix/store/g208k6b7rx10xnxkjcj90waw6zmgpwp4-run-ca-nspawn.drv' building '/nix/store/fzni92rq2nknrxdjjvxid6ywhn6b37gm-run-client-nspawn.drv' nixos-system-server-test> structuredAttrs is enabled building '/nix/store/kia8gqif6d9bnmph8c2w74hv2bcyiw4h-run-server-nspawn.drv' building '/nix/store/bhzf5hhvmsis6vr7m2jswxrdfrszfb76-driverConfiguration.json.drv' driverConfiguration.json> structuredAttrs is enabled building '/nix/store/2nhj9w53ca5ndkcsba36r7arv80cwvkq-nixos-test-driver-certificates.drv' nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/l15h1mv8wxjin60ls0rs713y5zi2mwnc-container-test-run-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' building '/nix/store/l15h1mv8wxjin60ls0rs713y5zi2mwnc-container-test-run-certificates.drv' container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> start all VMs container-test-run-certificates> ca: systemd-nspawn running (pid 53) container-test-run-certificates> client: systemd-nspawn running (pid 54) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> server: systemd-nspawn running (pid 55) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> (finished: start all VMs, in 0.00 seconds) container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> client # No journal files were found. container-test-run-certificates> client # No journal boot entry found for the specified boot (+0). container-test-run-certificates> ca # No journal boot entry found for the specified boot (+0). container-test-run-certificates> server # No journal boot entry found for the specified boot (+0). container-test-run-certificates> client # [7812157.226370] client systemd-journald[69]: Journal started container-test-run-certificates> client # [7812157.226406] client systemd-journald[69]: Runtime Journal (/run/log/journal/843ad52583574394814a1b7608f3fdde) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [7812157.268953] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [7812157.269631] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [7812157.270076] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [7812157.274356] client systemd-journald[69]: Time spent on flushing to /var/log/journal/843ad52583574394814a1b7608f3fdde is 1.175ms for 5 entries. container-test-run-certificates> client # [7812157.274356] client systemd-journald[69]: System Journal (/var/log/journal/843ad52583574394814a1b7608f3fdde) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [7812157.284869] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [7812157.285138] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [7812157.285921] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [7812157.285971] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [7812157.286010] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [7812157.286431] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [7812157.286555] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [7812157.286577] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [7812157.286920] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [7812157.286939] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [7812157.287411] client systemd[1]: Starting Network Management... container-test-run-certificates> client # [7812157.421648] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [7812157.422693] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [7812157.443662] client systemd-tmpfiles[176]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [7812157.444029] client systemd-tmpfiles[176]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [7812157.444316] client systemd-tmpfiles[176]: fchmod() of /var/log/journal/843ad52583574394814a1b7608f3fdde failed: Operation not permitted container-test-run-certificates> client # [7812157.444601] client systemd-tmpfiles[176]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [7812157.446742] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [7812157.037275] server systemd-journald[69]: Journal started container-test-run-certificates> client # [7812157.447795] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [7812157.031908] ca systemd-journald[78]: Journal started container-test-run-certificates> client # [7812157.453984] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [7812157.031949] ca systemd-journald[78]: Runtime Journal (/run/log/journal/c13d14c776d248c1a814b27afe907d56) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [7812157.487851] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [7812157.493853] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [7812157.495190] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [7812157.504181] client systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [7812157.723416] client systemd-networkd[172]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [7812157.723495] client systemd-networkd[172]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [7812157.729065] client systemd-networkd[172]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [7812157.729213] client systemd-networkd[172]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [7812157.729290] client systemd-networkd[172]: lo: Link UP container-test-run-certificates> client # [7812157.729293] client systemd-networkd[172]: lo: Gained carrier container-test-run-certificates> client # [7812157.729430] client systemd-networkd[172]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [7812157.037304] server systemd-journald[69]: Runtime Journal (/run/log/journal/4da1ba3dc8904e0ab5060235b70ce1f6) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [7812157.729692] client systemd[1]: Started Network Management. container-test-run-certificates> server # [7812157.038340] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [7812157.044568] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [7812157.033249] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [7812157.729739] client systemd-networkd[172]: eth1: Link UP container-test-run-certificates> server # [7812157.044992] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [7812157.040404] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [7812157.046770] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [7812157.729885] client systemd-networkd[172]: eth1: Gained carrier container-test-run-certificates> server # [7812157.051339] server systemd-journald[69]: Time spent on flushing to /var/log/journal/4da1ba3dc8904e0ab5060235b70ce1f6 is 1.292ms for 6 entries. container-test-run-certificates> ca # [7812157.040943] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [7812157.043062] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [7812157.730377] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [7812157.051339] server systemd-journald[69]: System Journal (/var/log/journal/4da1ba3dc8904e0ab5060235b70ce1f6) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [7812157.062239] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [7812157.062592] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [7812157.062642] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [7812157.063091] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [7812157.063118] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [7812157.063522] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [7812157.063540] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [7812157.246906] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [7812157.247676] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [7812157.259573] server systemd-tmpfiles[147]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [7812157.259779] server systemd-tmpfiles[147]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [7812157.259918] server systemd-tmpfiles[147]: fchmod() of /var/log/journal/4da1ba3dc8904e0ab5060235b70ce1f6 failed: Operation not permitted container-test-run-certificates> server # [7812157.260129] server systemd-tmpfiles[147]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [7812157.262597] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [7812157.263677] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [7812157.264171] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [7812157.271748] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [7812157.288773] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [7812157.288873] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [7812157.289023] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [7812157.289543] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [7812157.401316] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [7812157.402259] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [7812157.427213] server systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [7812157.740882] server systemd-resolved[89]: Positive Trust Anchors: container-test-run-certificates> server # [7812157.740889] server systemd-resolved[89]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [7812157.740892] server systemd-resolved[89]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [7812157.740908] server systemd-resolved[89]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [7812157.752118] server systemd-resolved[89]: Using system hostname 'server'. container-test-run-certificates> server # [7812157.752843] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [7812157.752913] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [7812157.834960] server systemd-networkd[183]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [7812157.835081] server systemd-networkd[183]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [7812157.840595] server systemd-networkd[183]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [7812157.840740] server systemd-networkd[183]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [7812157.840800] server systemd-networkd[183]: lo: Link UP container-test-run-certificates> server # [7812157.840803] server systemd-networkd[183]: lo: Gained carrier container-test-run-certificates> server # [7812157.840928] server systemd-networkd[183]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [7812157.841491] server systemd-networkd[183]: eth1: Link UP container-test-run-certificates> server # [7812157.841606] server systemd-networkd[183]: eth1: Gained carrier container-test-run-certificates> server # [7812157.881499] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [7812157.881540] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [7812157.881563] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [7812157.881582] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [7812157.881696] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [7812157.881786] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [7812157.881887] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [7812157.881904] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [7812157.881939] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [7812157.883362] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [7812157.883929] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [7812157.883956] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [7812157.884441] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [7812157.884580] server systemd[1]: Started Network Management. container-test-run-certificates> server # [7812157.884891] server systemd[1]: Reached target Network. container-test-run-certificates> server # [7812157.884928] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [7812157.885482] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [7812157.887059] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [7812157.912099] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [7812157.915045] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [7812158.009636] server acme-setup-privileged[188]: + set -euo pipefail container-test-run-certificates> server # [7812158.009636] server acme-setup-privileged[188]: + cd /var/lib/acme container-test-run-certificates> server # [7812158.009636] server acme-setup-privileged[188]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [7812158.011646] server acme-setup-privileged[188]: + chown -R acme .lego/accounts container-test-run-certificates> server # [7812158.012956] server acme-setup-privileged[188]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [7812158.012991] server acme-setup-privileged[188]: + '[' -d test.foo ']' container-test-run-certificates> server # [7812158.012991] server acme-setup-privileged[188]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [7812158.012991] server acme-setup-privileged[188]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [7812158.039141] server nsncd[190]: Aug 29 20:03:35.404 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [7812158.039357] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [7812158.039418] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [7812158.039461] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [7812158.044176] server systemd[1]: Starting User Login Management... container-test-run-certificates> client # [7812157.901125] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [7812157.048680] ca systemd-journald[78]: Time spent on flushing to /var/log/journal/c13d14c776d248c1a814b27afe907d56 is 1.340ms for 6 entries. container-test-run-certificates> server # [7812158.044975] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [7812158.022978] client systemd-resolved[158]: Positive Trust Anchors: container-test-run-certificates> client # [7812158.022993] client systemd-resolved[158]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [7812157.048680] ca systemd-journald[78]: System Journal (/var/log/journal/c13d14c776d248c1a814b27afe907d56) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [7812157.055829] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [7812158.022996] client systemd-resolved[158]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [7812158.055151] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [7812157.056272] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [7812158.056059] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [7812158.056084] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [7812158.056102] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [7812158.196057] server dbus-broker-launch[191]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [7812158.197619] server dbus-broker-launch[191]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [7812158.197619] server dbus-broker-launch[191]: Invalid user-name in /nix/store/0pgc9air17alr427hx1lc5x9wnyi4fv0-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [7812158.197959] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [7812158.205037] server dbus-broker-launch[191]: Ready container-test-run-certificates> ca # [7812157.056327] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [7812157.056809] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [7812157.056837] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [7812157.057293] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [7812157.057310] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [7812157.244086] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [7812157.245024] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [7812157.259759] ca systemd-tmpfiles[156]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [7812157.259979] ca systemd-tmpfiles[156]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [7812157.260425] ca systemd-tmpfiles[156]: fchmod() of /var/log/journal/c13d14c776d248c1a814b27afe907d56 failed: Operation not permitted container-test-run-certificates> ca # [7812157.260656] ca systemd-tmpfiles[156]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [7812157.264105] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [7812157.268985] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [7812157.270097] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [7812157.277363] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [7812157.281371] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [7812157.281438] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [7812157.281572] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [7812157.282112] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [7812157.401126] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [7812157.401820] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [7812157.426018] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [7812157.731869] ca systemd-resolved[98]: Positive Trust Anchors: container-test-run-certificates> ca # [7812157.731877] ca systemd-resolved[98]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [7812157.731881] ca systemd-resolved[98]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [7812157.731897] ca systemd-resolved[98]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [7812157.745256] ca systemd-resolved[98]: Using system hostname 'ca'. container-test-run-certificates> ca # [7812157.746111] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [7812157.746173] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [7812157.825189] ca systemd-networkd[192]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [7812157.825272] ca systemd-networkd[192]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [7812157.831249] ca systemd-networkd[192]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [7812157.831472] ca systemd-networkd[192]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [7812157.831558] ca systemd-networkd[192]: lo: Link UP container-test-run-certificates> ca # [7812157.831563] ca systemd-networkd[192]: lo: Gained carrier container-test-run-certificates> ca # [7812157.831737] ca systemd-networkd[192]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [7812157.832124] ca systemd-networkd[192]: eth1: Link UP container-test-run-certificates> ca # [7812157.832258] ca systemd-networkd[192]: eth1: Gained carrier container-test-run-certificates> ca # [7812157.881379] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [7812157.881439] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [7812157.881472] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [7812157.881494] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [7812157.881676] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [7812157.881788] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [7812157.881923] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [7812157.881946] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [7812157.882018] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [7812157.883260] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [7812157.883762] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [7812158.023478] client systemd-resolved[158]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [7812158.044524] client systemd-resolved[158]: Using system hostname 'client'. container-test-run-certificates> client # [7812158.045833] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [7812158.045910] client systemd[1]: Reached target Network. container-test-run-certificates> ca # [7812157.883787] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> client # [7812158.045962] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [7812158.046022] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [7812158.046046] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [7812158.046060] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [7812158.046186] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [7812158.046278] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [7812158.046390] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [7812158.046407] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [7812158.046441] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [7812158.047570] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [7812158.048332] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [7812158.049389] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [7812158.063898] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [7812158.190575] client nsncd[188]: Aug 29 20:03:35.555 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [7812158.189550] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [7812158.189612] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [7812158.189658] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [7812158.191417] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [7812158.192135] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [7812158.212862] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [7812157.885038] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [7812158.213417] client systemd[1]: Started Console Getty. container-test-run-certificates> ca # [7812157.885209] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [7812157.885555] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [7812157.885591] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [7812157.887229] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [7812157.901332] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [7812157.902257] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [7812157.912985] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [7812157.913216] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [7812158.030288] ca acme-setup-privileged[197]: + set -euo pipefail container-test-run-certificates> ca # [7812158.030288] ca acme-setup-privileged[197]: + cd /var/lib/acme container-test-run-certificates> ca # [7812158.030288] ca acme-setup-privileged[197]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> client # [7812158.460188] client dbus-broker-launch[189]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [7812158.460188] client dbus-broker-launch[189]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [7812158.031472] ca acme-setup-privileged[197]: + chown -R acme .lego/accounts container-test-run-certificates> client # [7812158.460188] client dbus-broker-launch[189]: Invalid user-name in /nix/store/91l6d2rr3446jkw7ll0r95z9ca8qijjq-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [7812158.032552] ca acme-setup-privileged[197]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> client # [7812158.213437] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [7812158.032552] ca acme-setup-privileged[197]: + '[' -d ca.foo ']' container-test-run-certificates> client # [7812158.213447] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [7812158.032552] ca acme-setup-privileged[197]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> client # [7812158.267310] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [7812158.032552] ca acme-setup-privileged[197]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> client # [7812158.270748] client dbus-broker-launch[189]: Ready container-test-run-certificates> ca # [7812158.047042] ca nsncd[199]: Aug 29 20:03:35.412 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [7812158.047094] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [7812158.047151] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [7812158.047196] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [7812158.048303] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [7812158.048871] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [7812158.057562] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [7812158.058405] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [7812158.058430] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [7812158.058448] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [7812158.459890] ca dbus-broker-launch[200]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [7812158.459890] ca dbus-broker-launch[200]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [7812158.459890] ca dbus-broker-launch[200]: Invalid user-name in /nix/store/gpdxpznvl5s3x1lll78m5sc9cdp1kx2s-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [7812158.212444] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [7812158.216075] ca dbus-broker-launch[200]: Ready container-test-run-certificates> server # [7812158.484911] server systemd-logind[220]: New seat seat0. container-test-run-certificates> client # [7812158.781274] client systemd-networkd[172]: eth1: Gained IPv6LL container-test-run-certificates> ca # [7812158.484522] ca systemd-logind[227]: New seat seat0. container-test-run-certificates> ca # [7812158.484950] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [7812158.486632] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [7812158.498740] ca acme-setup-start[218]: + set -euo pipefail container-test-run-certificates> ca # [7812158.498740] ca acme-setup-start[218]: + test -e ca/key.pem container-test-run-certificates> ca # [7812158.499098] ca acme-setup-start[218]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [7812158.508394] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [7812158.485412] server systemd[1]: Started User Login Management. container-test-run-certificates> ca # [7812158.508521] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [7812158.510379] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [7812158.486522] server systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [7812158.511464] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> server # [7812158.509437] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [7812158.509518] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [7812158.510158] server acme-setup-start[207]: + set -euo pipefail container-test-run-certificates> server # [7812158.510359] server acme-setup-start[207]: + test -e ca/key.pem container-test-run-certificates> server # [7812158.510359] server acme-setup-start[207]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [7812158.520251] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [7812158.522246] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> ca: must succeed: systemctl restart acme-order-renew-ca.foo.service container-test-run-certificates> server # [7812159.060751] server acme-test.foo-start[244]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [7812159.060751] server acme-test.foo-start[244]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [7812159.060751] server acme-test.foo-start[244]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [7812159.061112] server acme-test.foo-start[254]: + cd test.foo container-test-run-certificates> server # [7812159.061112] server acme-test.foo-start[254]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [7812159.061359] server acme-test.foo-start[255]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [7812159.061607] server acme-test.foo-start[254]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [7812159.062479] server acme-test.foo-start[254]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [7812159.062644] server acme-test.foo-start[244]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [7812159.064184] server acme-test.foo-start[244]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [7812159.065370] server acme-test.foo-start[244]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [7812159.067084] server acme-test.foo-start[244]: + for fixpath in out certificates container-test-run-certificates> server # [7812159.067084] server acme-test.foo-start[244]: + '[' -d out ']' container-test-run-certificates> server # [7812159.067140] server acme-test.foo-start[244]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [7812159.068211] server acme-test.foo-start[244]: + chown -R acme:nginx out container-test-run-certificates> server # [7812159.070181] server acme-test.foo-start[244]: + for fixpath in out certificates container-test-run-certificates> server # [7812159.070181] server acme-test.foo-start[244]: + '[' -d certificates ']' container-test-run-certificates> server # [7812159.072845] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [7812159.074352] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [7812159.294174] server systemd-networkd[183]: eth1: Gained IPv6LL container-test-run-certificates> ca # [7812159.060617] ca acme-ca.foo-start[255]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [7812159.060617] ca acme-ca.foo-start[255]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [7812159.060617] ca acme-ca.foo-start[255]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [7812159.060906] ca acme-ca.foo-start[281]: + cd ca.foo container-test-run-certificates> ca # [7812159.060906] ca acme-ca.foo-start[281]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [7812159.061388] ca acme-ca.foo-start[282]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [7812159.061563] ca acme-ca.foo-start[281]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [7812159.062637] ca acme-ca.foo-start[281]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [7812159.063017] ca acme-ca.foo-start[255]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [7812159.064159] ca acme-ca.foo-start[255]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [7812159.065316] ca acme-ca.foo-start[255]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [7812159.066978] ca acme-ca.foo-start[255]: + for fixpath in out certificates container-test-run-certificates> ca # [7812159.067015] ca acme-ca.foo-start[255]: + '[' -d out ']' container-test-run-certificates> ca # [7812159.067015] ca acme-ca.foo-start[255]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [7812159.068369] ca acme-ca.foo-start[255]: + chown -R acme:nginx out container-test-run-certificates> ca # [7812159.070176] ca acme-ca.foo-start[255]: + for fixpath in out certificates container-test-run-certificates> ca # [7812159.070176] ca acme-ca.foo-start[255]: + '[' -d certificates ']' container-test-run-certificates> ca # [7812159.070227] ca step-ca[201]: badger 2026/08/29 20:03:36 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [7812159.072806] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [7812159.074172] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [7812159.298199] ca step-ca[201]: 2026/08/29 20:03:36 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> client # [7812159.083178] client systemd-logind[204]: New seat seat0. container-test-run-certificates> client # [7812159.083363] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [7812159.096900] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [7812159.105893] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [7812159.106099] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [7812159.106597] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [7812159.550129] ca systemd-networkd[192]: eth1: Gained IPv6LL container-test-run-certificates> ca # [7812159.630444] ca nginx-pre-start[293]: nginx: the configuration file /nix/store/nhgkqzf0bl1zdjaabizjaga2992vk8lp-nginx.conf syntax is ok container-test-run-certificates> ca # [7812159.630826] ca nginx-pre-start[293]: nginx: configuration file /nix/store/nhgkqzf0bl1zdjaabizjaga2992vk8lp-nginx.conf test is successful container-test-run-certificates> ca # [7812159.634915] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [7812159.636160] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [7812159.748191] ca step-ca[201]: 2026/08/29 20:03:37 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [7812159.748191] ca step-ca[201]: 2026/08/29 20:03:37 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [7812159.748191] ca step-ca[201]: 2026/08/29 20:03:37 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [7812159.748191] ca step-ca[201]: 2026/08/29 20:03:37 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [7812159.748191] ca step-ca[201]: 2026/08/29 20:03:37 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [7812159.748191] ca step-ca[201]: 2026/08/29 20:03:37 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [7812159.748191] ca step-ca[201]: 2026/08/29 20:03:37 X.509 Root Fingerprint: e66e070a9af4f3b248f523bd3ca5cb4479186bff51ece71b355d138839702030 container-test-run-certificates> ca # [7812159.748398] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [7812159.748484] ca step-ca[201]: 2026/08/29 20:03:37 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [7812159.748568] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [7812159.630477] server nginx-pre-start[266]: nginx: the configuration file /nix/store/i3shb91swdhxxybfsz96km99fkcdhisp-nginx.conf syntax is ok container-test-run-certificates> server # [7812159.630824] server nginx-pre-start[266]: nginx: configuration file /nix/store/i3shb91swdhxxybfsz96km99fkcdhisp-nginx.conf test is successful container-test-run-certificates> server # [7812159.635139] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [7812159.635496] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [7812159.636471] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> ca # [7812160.122298] ca acme-order-renew-ca.foo-start[296]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [7812160.123924] ca acme-order-renew-ca.foo-start[296]: + set -euo pipefail container-test-run-certificates> ca # [7812160.123982] ca acme-order-renew-ca.foo-start[296]: + echo 88dc4fc401a6091a1bd9 container-test-run-certificates> ca # [7812160.124073] ca acme-order-renew-ca.foo-start[296]: + cmp -s domainhash.txt certificates/domainhash.txt container-test-run-certificates> ca # [7812160.124916] ca acme-order-renew-ca.foo-start[296]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run container-test-run-certificates> ca # [7812160.229394] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 No key found for account none@none.tld. Generating a P256 key. container-test-run-certificates> ca # [7812160.302189] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key container-test-run-certificates> ca # [7812160.322465] ca step-ca[201]: time="2026-08-29T20:03:37Z" level=info duration="80.672µs" duration-ns=80672 fields.time="2026-08-29T20:03:37Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=4523d09b-edd1-4c0a-9675-e5c3092862ca response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812160.322890] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 [INFO] acme: Registering account for none@none.tld container-test-run-certificates> ca # [7812160.344286] ca step-ca[201]: time="2026-08-29T20:03:37Z" level=info duration=21.184705ms duration-ns=21184705 fields.time="2026-08-29T20:03:37Z" method=HEAD name=ca nonce=bWJ2RXcxbk5nUjhRaGJ0bHc0MldLeThJZk5oZVkxSTE path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a1d5c3ff-a680-4522-bce7-d4ecc0b96c7c size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812160.375209] ca step-ca[201]: time="2026-08-29T20:03:37Z" level=info duration=30.120133ms duration-ns=30120133 fields.time="2026-08-29T20:03:37Z" method=POST name=ca nonce=a0l1OHFuMFA1d3YyVm1kT2dmV2Qydm8wNzQ3d0xaS3c path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=5bb548c2-5e31-4364-bac2-d5b51c87a904 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/VFfOUleUKYuPTDzgqCANzD1lcomYkxj4/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> server # [7812160.301971] server acme-order-renew-test.foo-start[269]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [7812160.301971] server acme-order-renew-test.foo-start[269]: + set -euo pipefail container-test-run-certificates> server # [7812160.301971] server acme-order-renew-test.foo-start[269]: + echo ad12aa6741ce4bd2c108 container-test-run-certificates> server # [7812160.301971] server acme-order-renew-test.foo-start[269]: + cmp -s domainhash.txt certificates/domainhash.txt container-test-run-certificates> server # [7812160.301971] server acme-order-renew-test.foo-start[269]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run container-test-run-certificates> server # [7812160.302393] server acme-order-renew-test.foo-start[280]: 2026/08/29 20:03:37 No key found for account none@none.tld. Generating a P256 key. container-test-run-certificates> server # [7812160.302393] server acme-order-renew-test.foo-start[280]: 2026/08/29 20:03:37 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key container-test-run-certificates> server # [7812160.323062] server acme-order-renew-test.foo-start[280]: 2026/08/29 20:03:37 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority container-test-run-certificates> server # [7812160.325318] server acme-order-renew-test.foo-start[269]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start. container-test-run-certificates> server # [7812160.325318] server acme-order-renew-test.foo-start[269]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start. container-test-run-certificates> server # [7812160.325388] server acme-order-renew-test.foo-start[269]: + exit 10 container-test-run-certificates> server # [7812160.326906] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a container-test-run-certificates> server # [7812160.326998] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'. container-test-run-certificates> server # [7812160.327250] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo. container-test-run-certificates> ca # [7812160.375887] ca acme-order-renew-ca.foo-start[307]: !!!! HEADS UP !!!! container-test-run-certificates> ca # [7812160.375887] ca acme-order-renew-ca.foo-start[307]: Your account credentials have been saved in your container-test-run-certificates> ca # [7812160.375887] ca acme-order-renew-ca.foo-start[307]: configuration directory at "accounts". container-test-run-certificates> ca # [7812160.375887] ca acme-order-renew-ca.foo-start[307]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [7812160.375887] ca acme-order-renew-ca.foo-start[307]: configuration directory will also contain private keys container-test-run-certificates> ca # [7812160.375887] ca acme-order-renew-ca.foo-start[307]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [7812160.375887] ca acme-order-renew-ca.foo-start[307]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [7812160.375887] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate container-test-run-certificates> ca # [7812160.435558] ca step-ca[201]: time="2026-08-29T20:03:37Z" level=info duration=59.519308ms duration-ns=59519308 fields.time="2026-08-29T20:03:37Z" method=POST name=ca nonce=eGdvTnNCZEVDOXhRTURSVmNIVGZ3Mm94bnNaZWYzN1k path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=53dc8009-2349-45cd-8d3c-c4cdcf4679dd response="{\"id\":\"eAoq9kclygb4kA0nzjr1jobWjBOV0Sp2\",\"status\":\"pending\",\"expires\":\"2026-08-30T20:03:37Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-29T20:02:37Z\",\"notAfter\":\"2026-11-27T20:03:37Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/eAoq9kclygb4kA0nzjr1jobWjBOV0Sp2/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812160.553607] ca step-ca[201]: time="2026-08-29T20:03:37Z" level=info duration=60.883006ms duration-ns=60883006 fields.time="2026-08-29T20:03:37Z" method=POST name=ca nonce=dEZ4T1l2Nm56SkVMTDVybjhlbThPYmpMMHIxRWpBcEU path=/acme/acme/authz/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=898643ab-526f-4f3c-9d70-a8534236df53 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"DqbMQcTcM1n2FAcLVWStBdoopGmtfhVh\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk/fjEG9N7vv5DJV5yN9TnIyqKV7mJUmOGn\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"DqbMQcTcM1n2FAcLVWStBdoopGmtfhVh\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk/AX7z1vqepicLcPpkThbauy2cu0WWTWgR\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"DqbMQcTcM1n2FAcLVWStBdoopGmtfhVh\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk/73ltRgMhKODjPIwuO996kVnFCGMoGmpb\"}],\"wildcard\":false,\"expires\":\"2026-08-30T20:03:37Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812160.553930] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk container-test-run-certificates> ca # [7812160.553930] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01 container-test-run-certificates> ca # [7812160.553973] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 [INFO] [ca.foo] acme: use http-01 solver container-test-run-certificates> ca # [7812160.553973] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 [INFO] [ca.foo] acme: Trying to solve HTTP-01 container-test-run-certificates> ca # [7812160.580636] ca step-ca[201]: time="2026-08-29T20:03:37Z" level=info duration=26.262708ms duration-ns=26262708 fields.time="2026-08-29T20:03:37Z" method=POST name=ca nonce=YmxkaUphSXpjcURhekVJZHBFS1l5TEloVkVPZENpRkM path=/acme/acme/challenge/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk/AX7z1vqepicLcPpkThbauy2cu0WWTWgR protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b6f8a9fc-2b56-460b-8413-4afca2240535 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"DqbMQcTcM1n2FAcLVWStBdoopGmtfhVh\",\"validated\":\"2026-08-29T20:03:37Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk/AX7z1vqepicLcPpkThbauy2cu0WWTWgR\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812160.580915] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 [INFO] [ca.foo] The server validated our request container-test-run-certificates> ca # [7812160.580966] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:37 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates container-test-run-certificates> ca # [7812160.722425] ca step-ca[201]: time="2026-08-29T20:03:38Z" level=info duration=137.06833ms duration-ns=137068330 fields.time="2026-08-29T20:03:37Z" method=POST name=ca nonce=S0RCYkg0YmZDQTZzZzA4cThnMklvbW1pMmpyWTNlS0s path=/acme/acme/order/eAoq9kclygb4kA0nzjr1jobWjBOV0Sp2/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b46a5949-9d21-46e1-89cb-83df39d2e167 response="{\"id\":\"eAoq9kclygb4kA0nzjr1jobWjBOV0Sp2\",\"status\":\"valid\",\"expires\":\"2026-08-30T20:03:37Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-08-29T20:02:37Z\",\"notAfter\":\"2026-11-27T20:03:37Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/LNZrJHr8wuUQTI1s63q9WuxQTcmyYcpk\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/eAoq9kclygb4kA0nzjr1jobWjBOV0Sp2/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/caN6LML3hEUeCXjUYoUsmJCHOGGsObmV\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812160.734214] ca step-ca[201]: time="2026-08-29T20:03:38Z" level=info certificate="MIIB1TCCAXqgAwIBAgIRALu1KWECVzNun6+FNqtMooUwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODI5MjAwMjM3WhcNMjYxMTI3MjAwMzM3WjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATxThBtZOqlDXIKBykntfDubtgtqcNPeHoYhe/m0CniyZuBRnWOfi2NmNfMqrvFGDfXvMBeTOYhCb39k/TvVJmto4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFGESrj+EDwe1BWyk9/qm0f8e1fA4MB8GA1UdIwQYMBaAFJ1vVkpOmiY6PzLTFSrHz1QMM0gPMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSQAwRgIhAKA8uir/1pjh6VH0lNT8r+1/Uwa9t1SVamoKnYIF/0EWAiEApnm1hTWlXlR3yf5jRh6r1Ppvd2eSKjsJyS/dDGhwQm0=" duration=11.961597ms duration-ns=11961597 fields.time="2026-08-29T20:03:38Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=cDFVSFNPeXpWNjdHYXV3cWJWemhFV2lybGFBM3cwOWk path=/acme/acme/certificate/caN6LML3hEUeCXjUYoUsmJCHOGGsObmV protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=01023156-c9a4-447b-85a2-10906ac49aac sans="map[dns:[ca.foo]]" serial=249506280207823975083192267897488319109 size=1344 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= valid-from="2026-08-29T20:02:37Z" valid-to="2026-11-27T20:03:37Z" container-test-run-certificates> ca # [7812160.734478] ca acme-order-renew-ca.foo-start[307]: 2026/08/29 20:03:38 [INFO] [ca.foo] Server responded with a certificate. container-test-run-certificates> ca # [7812160.737996] ca acme-order-renew-ca.foo-start[296]: + mv domainhash.txt certificates/ container-test-run-certificates> ca # [7812160.739551] ca acme-order-renew-ca.foo-start[296]: + touch out/acme-success container-test-run-certificates> ca # [7812160.740662] ca acme-order-renew-ca.foo-start[296]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [7812160.741741] ca acme-order-renew-ca.foo-start[296]: + touch out/renewed container-test-run-certificates> ca # [7812160.742887] ca acme-order-renew-ca.foo-start[296]: + echo Installing new certificate container-test-run-certificates> ca # [7812160.742887] ca acme-order-renew-ca.foo-start[296]: Installing new certificate container-test-run-certificates> ca # [7812160.742925] ca acme-order-renew-ca.foo-start[296]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [7812160.744335] ca acme-order-renew-ca.foo-start[327]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [7812160.744592] ca acme-order-renew-ca.foo-start[296]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [7812160.745804] ca acme-order-renew-ca.foo-start[328]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [7812160.745980] ca acme-order-renew-ca.foo-start[296]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [7812160.746975] ca acme-order-renew-ca.foo-start[329]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [7812160.747136] ca acme-order-renew-ca.foo-start[296]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [7812160.748145] ca acme-order-renew-ca.foo-start[296]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [7812160.749762] ca acme-order-renew-ca.foo-start[296]: + for fixpath in out certificates container-test-run-certificates> ca # [7812160.749793] ca acme-order-renew-ca.foo-start[296]: + '[' -d out ']' container-test-run-certificates> ca # [7812160.749793] ca acme-order-renew-ca.foo-start[296]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [7812160.750675] ca acme-order-renew-ca.foo-start[296]: + chown -R acme:nginx out container-test-run-certificates> ca # [7812160.752244] ca acme-order-renew-ca.foo-start[296]: + for fixpath in out certificates container-test-run-certificates> ca # [7812160.752244] ca acme-order-renew-ca.foo-start[296]: + '[' -d certificates ']' container-test-run-certificates> ca # [7812160.752290] ca acme-order-renew-ca.foo-start[296]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [7812160.753069] ca acme-order-renew-ca.foo-start[296]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [7812160.754738] ca acme-order-renew-ca.foo-start[296]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [7812160.853772] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [7812160.856677] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [7812160.856812] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [7812161.278718] ca nginx[345]: nginx: the configuration file /nix/store/nhgkqzf0bl1zdjaabizjaga2992vk8lp-nginx.conf syntax is ok container-test-run-certificates> ca # [7812161.278920] ca nginx[345]: nginx: configuration file /nix/store/nhgkqzf0bl1zdjaabizjaga2992vk8lp-nginx.conf test is successful container-test-run-certificates> ca # [7812161.743307] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [7812165.818906] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [7812165.822309] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [7812165.822433] server systemd[1]: Startup finished in 9.387s. container-test-run-certificates> ca # [7812165.816920] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [7812165.817673] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [7812165.817802] ca systemd[1]: Startup finished in 9.151s. container-test-run-certificates> client # [7812165.817900] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [7812165.818462] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [7812165.818581] client systemd[1]: Startup finished in 9.053s. container-test-run-certificates> ca # [7812166.284650] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 7.66 seconds) container-test-run-certificates> ca # [7812166.661801] ca acme-order-renew-ca.foo-start[361]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [7812166.663467] ca acme-order-renew-ca.foo-start[361]: + set -euo pipefail container-test-run-certificates> ca # [7812166.663505] ca acme-order-renew-ca.foo-start[361]: + echo 88dc4fc401a6091a1bd9 container-test-run-certificates> ca # [7812166.663557] ca acme-order-renew-ca.foo-start[361]: + cmp -s domainhash.txt certificates/domainhash.txt container-test-run-certificates> ca # [7812166.664250] ca acme-order-renew-ca.foo-start[361]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [7812166.664281] ca acme-order-renew-ca.foo-start[361]: + '[' -e certificates/ca.foo.crt ']' container-test-run-certificates> ca # [7812166.664495] ca acme-order-renew-ca.foo-start[369]: ++ find accounts -name none@none.tld.key container-test-run-certificates> ca # [7812166.665981] ca acme-order-renew-ca.foo-start[361]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']' container-test-run-certificates> ca # [7812166.666058] ca acme-order-renew-ca.foo-start[361]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic container-test-run-certificates> ca # [7812166.689442] ca step-ca[201]: time="2026-08-29T20:03:44Z" level=info duration="42.41µs" duration-ns=42410 fields.time="2026-08-29T20:03:44Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c596c4c3-63bd-4575-a9fd-933eb0e7587f response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812166.689849] ca acme-order-renew-ca.foo-start[370]: 2026/08/29 20:03:44 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint container-test-run-certificates> ca # [7812166.689849] ca acme-order-renew-ca.foo-start[370]: 2026/08/29 20:03:44 [INFO] [ca.foo] The certificate expires at 2026-11-27T20:03:37Z, the renewal can be performed in 1439h59m32.944689329s: no renewal. container-test-run-certificates> ca # [7812166.689965] ca acme-order-renew-ca.foo-start[361]: + mv domainhash.txt certificates/ container-test-run-certificates> ca # [7812166.691129] ca acme-order-renew-ca.foo-start[361]: + touch out/acme-success container-test-run-certificates> ca # [7812166.691900] ca acme-order-renew-ca.foo-start[361]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [7812166.692577] ca acme-order-renew-ca.foo-start[361]: + for fixpath in out certificates container-test-run-certificates> ca # [7812166.692595] ca acme-order-renew-ca.foo-start[361]: + '[' -d out ']' container-test-run-certificates> ca # [7812166.692595] ca acme-order-renew-ca.foo-start[361]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [7812166.693408] ca acme-order-renew-ca.foo-start[361]: + chown -R acme:nginx out container-test-run-certificates> ca # [7812166.694828] ca acme-order-renew-ca.foo-start[361]: + for fixpath in out certificates container-test-run-certificates> ca # [7812166.694839] ca acme-order-renew-ca.foo-start[361]: + '[' -d certificates ']' container-test-run-certificates> ca # [7812166.694849] ca acme-order-renew-ca.foo-start[361]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [7812166.695807] ca acme-order-renew-ca.foo-start[361]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [7812166.697390] ca acme-order-renew-ca.foo-start[361]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [7812166.781854] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [7812166.798146] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> server: must succeed: systemctl restart acme-test.foo.service container-test-run-certificates> server # [7812169.807587] server systemd[1]: acme-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [7812169.807662] server systemd[1]: Stopped Ensure certificate for test.foo. container-test-run-certificates> server # [7812169.808171] server systemd[1]: Stopping Ensure certificate for test.foo... container-test-run-certificates> server # [7812169.808872] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.35 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1008 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [111 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 20:03:36 2026 GMT container-test-run-certificates> * expire date: Sep 28 20:03:36 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 44a528 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> server # [7812170.140725] server acme-test.foo-start[302]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [7812170.142500] server acme-test.foo-start[302]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [7812170.142500] server acme-test.foo-start[302]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [7812170.146990] server acme-test.foo-start[312]: + cd test.foo container-test-run-certificates> server # [7812170.147146] server acme-test.foo-start[312]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [7812170.147889] server acme-test.foo-start[313]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [7812170.148029] server acme-test.foo-start[312]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [7812170.148639] server acme-test.foo-start[312]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [7812170.148797] server acme-test.foo-start[302]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [7812170.149739] server acme-test.foo-start[302]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [7812170.150567] server acme-test.foo-start[302]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [7812170.151406] server acme-test.foo-start[302]: + for fixpath in out certificates container-test-run-certificates> server # [7812170.151417] server acme-test.foo-start[302]: + '[' -d out ']' container-test-run-certificates> server # [7812170.151428] server acme-test.foo-start[302]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [7812170.152241] server acme-test.foo-start[302]: + chown -R acme:nginx out container-test-run-certificates> server # [7812170.153742] server acme-test.foo-start[302]: + for fixpath in out certificates container-test-run-certificates> server # [7812170.153742] server acme-test.foo-start[302]: + '[' -d certificates ']' container-test-run-certificates> server # [7812170.155330] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [7812170.156872] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [7812170.503028] server acme-order-renew-test.foo-start[320]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [7812170.504507] server acme-order-renew-test.foo-start[320]: + set -euo pipefail container-test-run-certificates> server # [7812170.504537] server acme-order-renew-test.foo-start[320]: + echo ad12aa6741ce4bd2c108 container-test-run-certificates> server # [7812170.504591] server acme-order-renew-test.foo-start[320]: + cmp -s domainhash.txt certificates/domainhash.txt container-test-run-certificates> server # [7812170.505170] server acme-order-renew-test.foo-start[320]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run container-test-run-certificates> server # [7812170.527462] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] acme: Registering account for none@none.tld container-test-run-certificates> server # [7812170.532259] server acme-order-renew-test.foo-start[328]: !!!! HEADS UP !!!! container-test-run-certificates> server # [7812170.532259] server acme-order-renew-test.foo-start[328]: Your account credentials have been saved in your container-test-run-certificates> server # [7812170.532259] server acme-order-renew-test.foo-start[328]: configuration directory at "accounts". container-test-run-certificates> server # [7812170.532259] server acme-order-renew-test.foo-start[328]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [7812170.532259] server acme-order-renew-test.foo-start[328]: configuration directory will also contain private keys container-test-run-certificates> server # [7812170.532259] server acme-order-renew-test.foo-start[328]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [7812170.532259] server acme-order-renew-test.foo-start[328]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [7812170.532372] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] [test.foo] acme: Obtaining bundled SAN certificate container-test-run-certificates> server # [7812170.591997] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/xjoanhSGq1KRP9ekzu65t9jANRXgos96 container-test-run-certificates> server # [7812170.591997] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01 container-test-run-certificates> server # [7812170.591997] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] [test.foo] acme: use http-01 solver container-test-run-certificates> server # [7812170.592072] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] [test.foo] acme: Trying to solve HTTP-01 container-test-run-certificates> server # [7812170.594147] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] [test.foo] The server validated our request container-test-run-certificates> server # [7812170.594183] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] [test.foo] acme: Validations succeeded; requesting certificates container-test-run-certificates> server # [7812170.597912] server acme-order-renew-test.foo-start[328]: 2026/08/29 20:03:47 [INFO] [test.foo] Server responded with a certificate. container-test-run-certificates> server # [7812170.600942] server acme-order-renew-test.foo-start[320]: + mv domainhash.txt certificates/ container-test-run-certificates> server # [7812170.602104] server acme-order-renew-test.foo-start[320]: + touch out/acme-success container-test-run-certificates> server # [7812170.602911] server acme-order-renew-test.foo-start[320]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [7812170.603513] server acme-order-renew-test.foo-start[320]: + touch out/renewed container-test-run-certificates> server # [7812170.604288] server acme-order-renew-test.foo-start[320]: + echo Installing new certificate container-test-run-certificates> server # [7812170.604288] server acme-order-renew-test.foo-start[320]: Installing new certificate container-test-run-certificates> server # [7812170.604318] server acme-order-renew-test.foo-start[320]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [7812170.605036] server acme-order-renew-test.foo-start[348]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [7812170.605172] server acme-order-renew-test.foo-start[320]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [7812170.605916] server acme-order-renew-test.foo-start[349]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [7812170.606088] server acme-order-renew-test.foo-start[320]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [7812170.606754] server acme-order-renew-test.foo-start[350]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [7812170.606871] server acme-order-renew-test.foo-start[320]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [7812170.607913] server acme-order-renew-test.foo-start[320]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [7812170.608856] server acme-order-renew-test.foo-start[320]: + for fixpath in out certificates container-test-run-certificates> server # [7812170.608870] server acme-order-renew-test.foo-start[320]: + '[' -d out ']' container-test-run-certificates> server # [7812170.608870] server acme-order-renew-test.foo-start[320]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [7812170.609713] server acme-order-renew-test.foo-start[320]: + chown -R acme:nginx out container-test-run-certificates> server # [7812170.611201] server acme-order-renew-test.foo-start[320]: + for fixpath in out certificates container-test-run-certificates> server # [7812170.611238] server acme-order-renew-test.foo-start[320]: + '[' -d certificates ']' container-test-run-certificates> server # [7812170.611238] server acme-order-renew-test.foo-start[320]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [7812170.612280] server acme-order-renew-test.foo-start[320]: + chown -R acme:nginx certificates container-test-run-certificates> server # [7812170.613848] server acme-order-renew-test.foo-start[320]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [7812170.689774] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [7812170.691959] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [7812170.692063] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> ca # [7812170.527239] ca step-ca[201]: time="2026-08-29T20:03:47Z" level=info duration="35.987µs" duration-ns=35987 fields.time="2026-08-29T20:03:47Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=be7fa155-1a3b-41fc-9244-1331b320a3e5 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812170.530247] ca step-ca[201]: time="2026-08-29T20:03:47Z" level=info duration=1.981501ms duration-ns=1981501 fields.time="2026-08-29T20:03:47Z" method=HEAD name=ca nonce=d0xCTHBxMVRHZU5jajdSWmhPMXRHVEVrUmJxVHNublg path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=8e2338ba-0921-4e3d-bc2e-70afc04ab027 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812170.531995] ca step-ca[201]: time="2026-08-29T20:03:47Z" level=info duration="806.108µs" duration-ns=806108 fields.time="2026-08-29T20:03:47Z" method=POST name=ca nonce=TTRtZjBwUXl0WndieFd3cFowdnJFOElGRG1ObTBSZzA path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=25e5c86a-0455-4b28-9d9b-4f8131eb6573 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/4cUWQPesY6NjOy9Ze4JYX1RqsjuerPI3/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812170.534213] ca step-ca[201]: time="2026-08-29T20:03:47Z" level=info duration=1.22103ms duration-ns=1221030 fields.time="2026-08-29T20:03:47Z" method=POST name=ca nonce=TlJEQVp1R0RaQjVUQnVnTkxqVlF0dWFtakduUkdvUU4 path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=eb61d8f6-eda8-40f0-834e-c6aeafd04904 response="{\"id\":\"VU389x1nUTI8lY6T9Cc73tk1o8LolpVM\",\"status\":\"pending\",\"expires\":\"2026-08-30T20:03:47Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-29T20:02:47Z\",\"notAfter\":\"2026-11-27T20:03:47Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/xjoanhSGq1KRP9ekzu65t9jANRXgos96\"],\"finalize\":\"https://ca.foo/acme/acme/order/VU389x1nUTI8lY6T9Cc73tk1o8LolpVM/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812170.591849] ca step-ca[201]: time="2026-08-29T20:03:47Z" level=info duration="591.804µs" duration-ns=591804 fields.time="2026-08-29T20:03:47Z" method=POST name=ca nonce=RnRRdW81eWVhWlVKWGxDYXVqakVMa1NIaWs0Y3NsMFM path=/acme/acme/authz/xjoanhSGq1KRP9ekzu65t9jANRXgos96 protocol=HTTP/1.1 referer= remote-address="::1" request-id=63513255-1aba-4ad2-a3ab-c32b7ecd06e9 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"UhhkoRqHuez0MHxCF38X4y5uoRvXqcju\",\"url\":\"https://ca.foo/acme/acme/challenge/xjoanhSGq1KRP9ekzu65t9jANRXgos96/YC4ABtsvoBxyvwR79beYWUUeOjigNCQJ\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"UhhkoRqHuez0MHxCF38X4y5uoRvXqcju\",\"url\":\"https://ca.foo/acme/acme/challenge/xjoanhSGq1KRP9ekzu65t9jANRXgos96/7jyeVGT3IdoL5AW2hNL57AZNXgjJmq7j\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"UhhkoRqHuez0MHxCF38X4y5uoRvXqcju\",\"url\":\"https://ca.foo/acme/acme/challenge/xjoanhSGq1KRP9ekzu65t9jANRXgos96/VmYE3a5wJCo5DcQBO5cfZ9L7GrhQH5px\"}],\"wildcard\":false,\"expires\":\"2026-08-30T20:03:47Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812170.594004] ca step-ca[201]: time="2026-08-29T20:03:47Z" level=info duration=1.347077ms duration-ns=1347077 fields.time="2026-08-29T20:03:47Z" method=POST name=ca nonce=cGlkTVBsbWtZbU16Ymd0blNWV1FSRnJwSVE0WmVQQmc path=/acme/acme/challenge/xjoanhSGq1KRP9ekzu65t9jANRXgos96/7jyeVGT3IdoL5AW2hNL57AZNXgjJmq7j protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=cbe3785f-7b5b-477a-8885-b34caba99766 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"UhhkoRqHuez0MHxCF38X4y5uoRvXqcju\",\"validated\":\"2026-08-29T20:03:47Z\",\"url\":\"https://ca.foo/acme/acme/challenge/xjoanhSGq1KRP9ekzu65t9jANRXgos96/7jyeVGT3IdoL5AW2hNL57AZNXgjJmq7j\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812170.596656] ca step-ca[201]: time="2026-08-29T20:03:47Z" level=info duration=1.729156ms duration-ns=1729156 fields.time="2026-08-29T20:03:47Z" method=POST name=ca nonce=OTRVbkxDZTdvc1hWTkR1RmF4OGowVEhRYVVJUGVFaEY path=/acme/acme/order/VU389x1nUTI8lY6T9Cc73tk1o8LolpVM/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=6ee9aa4d-5bae-4686-9d42-2bf54ad6ab07 response="{\"id\":\"VU389x1nUTI8lY6T9Cc73tk1o8LolpVM\",\"status\":\"valid\",\"expires\":\"2026-08-30T20:03:47Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-08-29T20:02:47Z\",\"notAfter\":\"2026-11-27T20:03:47Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/xjoanhSGq1KRP9ekzu65t9jANRXgos96\"],\"finalize\":\"https://ca.foo/acme/acme/order/VU389x1nUTI8lY6T9Cc73tk1o8LolpVM/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/Bck5aasx6hX64XjIgmgSRbhdKyOTG9bn\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [7812170.597787] ca step-ca[201]: time="2026-08-29T20:03:47Z" level=info certificate="MIIB2DCCAX6gAwIBAgIRALIBTFILql26g/mJJMVA/9IwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwODI5MjAwMjQ3WhcNMjYxMTI3MjAwMzQ3WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDuv0TFy9vrMGP68WL99EcfYv7MB3pZtg+pFkSeLYSRf+LFYECl9ChTk0rLcnKdKDsCUvYqpDZVBgixwUwkiukKjgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUEna/YT563m8w8guiSW42n+YNTrIwHwYDVR0jBBgwFoAUnW9WSk6aJjo/MtMVKsfPVAwzSA8wEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0gAMEUCIQC6I+VRdxh3XEo5InJrDi4xBAbynelwzKWRywfnaLuDrAIgEvZHLsloB/uahqHiiK9c6M/Qv6sNRnPoGD+TvjV8YG8=" duration="388.451µs" duration-ns=388451 fields.time="2026-08-29T20:03:47Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=ZjlBVlBaNzRvVmg3aFNiZVAyOXdjRmJ1VW9NZ244dGE path=/acme/acme/certificate/Bck5aasx6hX64XjIgmgSRbhdKyOTG9bn protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=726434b6-6a7a-47db-9cb8-cc440ae7d7e0 sans="map[dns:[test.foo]]" serial=236609323510023059019190460069777047506 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; amd64)" user-id= valid-from="2026-08-29T20:02:47Z" valid-to="2026-11-27T20:03:47Z" container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1008 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [110 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 20:03:36 2026 GMT container-test-run-certificates> * expire date: Sep 28 20:03:36 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 44a528 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> server # [7812171.048725] server nginx[366]: nginx: the configuration file /nix/store/i3shb91swdhxxybfsz96km99fkcdhisp-nginx.conf syntax is ok container-test-run-certificates> server # [7812171.049048] server nginx[366]: nginx: configuration file /nix/store/i3shb91swdhxxybfsz96km99fkcdhisp-nginx.conf test is successful container-test-run-certificates> server # [7812171.378052] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [932 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [79 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Aug 29 20:02:47 2026 GMT container-test-run-certificates> * expire date: Nov 27 20:03:47 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 37078 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.21.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1819 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 2.06 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> b2:01:4c:52:0b:aa:5d:ba:83:f9:89:24:c5:40:ff:d2 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Aug 29 20:02:47 2026 GMT container-test-run-certificates> Not After : Nov 27 20:03:47 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:3b:af:d1:31:72:f6:fa:cc:18:fe:bc:58:bf:7d: container-test-run-certificates> 11:c7:d8:bf:b3:01:de:96:6d:83:ea:45:91:27:8b: container-test-run-certificates> 61:24:5f:f8:b1:58:10:29:7d:0a:14:e4:d2:b2:dc: container-test-run-certificates> 9c:a7:4a:0e:c0:94:bd:8a:a9:0d:95:41:82:2c:70: container-test-run-certificates> 53:09:22:ba:42 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> 12:76:BF:61:3E:7A:DE:6F:30:F2:0B:A2:49:6E:36:9F:E6:0D:4E:B2 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 9D:6F:56:4A:4E:9A:26:3A:3F:32:D3:15:2A:C7:CF:54:0C:33:48:0F container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:45:02:21:00:ba:23:e5:51:77:18:77:5c:4a:39:22:72:6b: container-test-run-certificates> 0e:2e:31:04:06:f2:9d:e9:70:cc:a5:91:cb:07:e7:68:bb:83: container-test-run-certificates> ac:02:20:12:f6:47:2e:c9:68:07:fb:9a:86:a1:e2:88:af:5c: container-test-run-certificates> e8:cf:d0:bf:ab:0d:46:73:e8:18:3f:93:be:35:7c:60:6f container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 16.09 seconds) container-test-run-certificates> test script finished in 16.12s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 53) container-test-run-certificates> kill NspawnMachine (pid 54) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> kill NspawnMachine (pid 55) container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> Container server terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.29 seconds) post-build step Upload to niks3: ok time=2026-08-29T20:03:50.265Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)" time=2026-08-29T20:03:50.907Z level=INFO msg="Uploading 1 narinfos" time=2026-08-29T20:03:51.530Z level=INFO msg="Upload complete. (1.422s)"