container-test-run-certificates
checks.aarch64-linux.certificates
· build #599
· raw
1Machine state will be reset. To keep it, pass --keep-machine-state2start all VLans3(finished: start all VLans, in 0.00 seconds)45Test will time out and terminate in 3600.0 seconds6run the VM test script7additionally exposed symbols:8 ca, client, server,9 vlan1,10 start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh11start all VMs12ca: systemd-nspawn running (pid 53)13client: systemd-nspawn running (pid 54)14server: systemd-nspawn running (pid 55)15client: Waiting for journal at /build/vm-state-client/var/log/journal...16server: Waiting for journal at /build/vm-state-server/var/log/journal...17ca: Waiting for journal at /build/vm-state-ca/var/log/journal...18(finished: start all VMs, in 0.00 seconds)19nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE20nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.21nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE22nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.23nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE24nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.25Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.26Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.27Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.28░ Spawning container ca on /build/vm-state-ca.29░ Spawning container client on /build/vm-state-client.30░ Spawning container server on /build/vm-state-server.31client # [335662.132990] client systemd-journald[69]: Journal started32client # [335662.133047] client systemd-journald[69]: Runtime Journal (/run/log/journal/2d0fb248cd0c4a229b666fd82810dbdc) is 8M, max 2.5G, 2.4G free.33client # [335662.141010] client systemd[1]: Starting Flush Journal to Persistent Storage...34client # [335662.141809] client systemd[1]: Starting Network Name Resolution...35client # [335662.142481] client systemd[1]: Starting Create Static Device Nodes in /dev...36client # [335662.151898] client systemd-journald[69]: Time spent on flushing to /var/log/journal/2d0fb248cd0c4a229b666fd82810dbdc is 1.860ms for 5 entries.37client # [335662.151898] client systemd-journald[69]: System Journal (/var/log/journal/2d0fb248cd0c4a229b666fd82810dbdc) is 8M, max 4G, 3.9G free.38client # [335662.160913] client systemd[1]: Finished Create Static Device Nodes in /dev.39client # [335662.161158] client systemd[1]: Reached target Preparation for Local File Systems.40client # [335662.161247] client systemd[1]: Reached target Local File Systems.41client # [335662.162000] client systemd[1]: Listening on Boot Loader Control Service Socket.42client # [335662.162045] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container43client # [335662.162930] client systemd[1]: Starting Save Transient machine-id to Disk...44client # [335662.162975] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys45client # [335662.170456] client systemd[1]: Finished Flush Journal to Persistent Storage.46client # [335662.171437] client systemd[1]: Starting Create System Files and Directories...47client # [335662.188398] client systemd-tmpfiles[112]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted48client # [335662.188637] client systemd-tmpfiles[112]: fchmod() of /var/log/journal failed: Operation not permitted49client # [335662.188783] client systemd-tmpfiles[112]: fchmod() of /var/log/journal/2d0fb248cd0c4a229b666fd82810dbdc failed: Operation not permitted50client # [335662.189004] client systemd-tmpfiles[112]: fchmod() of /run/log/journal failed: Operation not permitted51client # [335662.190551] client systemd[1]: Finished Create System Files and Directories.52client # [335662.191590] client systemd[1]: Starting Rebuild Journal Catalog...53client # [335662.192324] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...54client # [335662.204931] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.55client # [335662.214987] client systemd[1]: Finished Rebuild Journal Catalog.56client # [335662.215952] client systemd[1]: Starting Update is Completed...57client # [335662.226960] client systemd[1]: Finished Update is Completed.58server # [335662.122344] server systemd-journald[69]: Journal started59server # [335662.122401] server systemd-journald[69]: Runtime Journal (/run/log/journal/c440ef19e7de48948daef61c99217325) is 8M, max 2.5G, 2.4G free.60server # [335662.127352] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.61server # [335662.137261] server systemd[1]: Starting Flush Journal to Persistent Storage...62server # [335662.138177] server systemd[1]: Starting Network Name Resolution...63server # [335662.138959] server systemd[1]: Starting Create Static Device Nodes in /dev...64server # [335662.149094] server systemd-journald[69]: Time spent on flushing to /var/log/journal/c440ef19e7de48948daef61c99217325 is 1.829ms for 6 entries.65server # [335662.149094] server systemd-journald[69]: System Journal (/var/log/journal/c440ef19e7de48948daef61c99217325) is 8M, max 4G, 3.9G free.66server # [335662.157432] server systemd[1]: Finished Create Static Device Nodes in /dev.67server # [335662.157731] server systemd[1]: Reached target Preparation for Local File Systems.68server # [335662.157833] server systemd[1]: Reached target Local File Systems.69server # [335662.158624] server systemd[1]: Listening on Boot Loader Control Service Socket.70server # [335662.158667] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container71server # [335662.159526] server systemd[1]: Starting Save Transient machine-id to Disk...72server # [335662.159559] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys73server # [335662.160996] server systemd[1]: Finished Flush Journal to Persistent Storage.74server # [335662.161991] server systemd[1]: Starting Create System Files and Directories...75server # [335662.179477] server systemd-tmpfiles[111]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted76server # [335662.179662] server systemd-tmpfiles[111]: fchmod() of /var/log/journal failed: Operation not permitted77server # [335662.179784] server systemd-tmpfiles[111]: fchmod() of /var/log/journal/c440ef19e7de48948daef61c99217325 failed: Operation not permitted78server # [335662.179975] server systemd-tmpfiles[111]: fchmod() of /run/log/journal failed: Operation not permitted79server # [335662.181706] server systemd[1]: Finished Create System Files and Directories.80server # [335662.182866] server systemd[1]: Starting Rebuild Journal Catalog...81server # [335662.183634] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...82server # [335662.196762] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.83server # [335662.206086] server systemd[1]: Finished Rebuild Journal Catalog.84server # [335662.207207] server systemd[1]: Starting Update is Completed...85server # [335662.220651] server systemd[1]: Finished Update is Completed.86ca # [335662.132276] ca systemd-journald[78]: Journal started87ca # [335662.132332] ca systemd-journald[78]: Runtime Journal (/run/log/journal/46315d03d15c47b9b06f293ed403a1ae) is 8M, max 2.5G, 2.4G free.88ca # [335662.140213] ca systemd[1]: Starting Flush Journal to Persistent Storage...89ca # [335662.141101] ca systemd[1]: Starting Network Name Resolution...90ca # [335662.141786] ca systemd[1]: Starting Create Static Device Nodes in /dev...91ca # [335662.151248] ca systemd-journald[78]: Time spent on flushing to /var/log/journal/46315d03d15c47b9b06f293ed403a1ae is 1.823ms for 5 entries.92ca # [335662.151248] ca systemd-journald[78]: System Journal (/var/log/journal/46315d03d15c47b9b06f293ed403a1ae) is 8M, max 4G, 3.9G free.93ca # [335662.160883] ca systemd[1]: Finished Create Static Device Nodes in /dev.94ca # [335662.161160] ca systemd[1]: Reached target Preparation for Local File Systems.95ca # [335662.161244] ca systemd[1]: Reached target Local File Systems.96ca # [335662.162008] ca systemd[1]: Listening on Boot Loader Control Service Socket.97ca # [335662.162054] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container98ca # [335662.162930] ca systemd[1]: Starting Save Transient machine-id to Disk...99ca # [335662.162974] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys100ca # [335662.169925] ca systemd[1]: Finished Flush Journal to Persistent Storage.101ca # [335662.170823] ca systemd[1]: Starting Create System Files and Directories...102ca # [335662.186836] ca systemd-tmpfiles[119]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted103ca # [335662.187013] ca systemd-tmpfiles[119]: fchmod() of /var/log/journal failed: Operation not permitted104ca # [335662.187131] ca systemd-tmpfiles[119]: fchmod() of /var/log/journal/46315d03d15c47b9b06f293ed403a1ae failed: Operation not permitted105ca # [335662.187306] ca systemd-tmpfiles[119]: fchmod() of /run/log/journal failed: Operation not permitted106ca # [335662.189329] ca systemd[1]: Finished Create System Files and Directories.107ca # [335662.190564] ca systemd[1]: Starting Rebuild Journal Catalog...108ca # [335662.191301] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...109ca # [335662.204838] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.110ca # [335662.214889] ca systemd[1]: Finished Rebuild Journal Catalog.111ca # [335662.215915] ca systemd[1]: Starting Update is Completed...112ca # [335662.227392] ca systemd[1]: Finished Update is Completed.113client # [335662.289308] client systemd[1]: Finished Firewall.114client # [335662.289473] client systemd[1]: Reached target Preparation for Network.115client # [335662.289702] client systemd[1]: Listening on Network Management Resolve Hook Socket.116client # [335662.290991] client systemd[1]: Starting Network Management...117client # [335662.341273] client systemd[1]: Finished Save Transient machine-id to Disk.118ca # [335662.340423] ca systemd[1]: Finished Firewall.119server # [335662.290692] server systemd[1]: Finished Firewall.120ca # [335662.340636] ca systemd[1]: Finished Save Transient machine-id to Disk.121server # [335662.290865] server systemd[1]: Reached target Preparation for Network.122ca # [335662.341211] ca systemd[1]: Reached target Preparation for Network.123server # [335662.291095] server systemd[1]: Listening on Network Management Resolve Hook Socket.124ca # [335662.341488] ca systemd[1]: Listening on Network Management Resolve Hook Socket.125server # [335662.292338] server systemd[1]: Starting Network Management...126ca # [335662.342517] ca systemd[1]: Starting Network Management...127server # [335662.340808] server systemd[1]: Finished Save Transient machine-id to Disk.128server # [335662.750268] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted129server # [335662.750365] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted130server # [335662.757773] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.131server # [335662.757936] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.132server # [335662.758083] server systemd-networkd[186]: lo: Link UP133server # [335662.758087] server systemd-networkd[186]: lo: Gained carrier134server # [335662.758256] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network.135server # [335662.758693] server systemd[1]: Started Network Management.136server # [335662.758722] server systemd-networkd[186]: eth1: Link UP137server # [335662.759025] server systemd-networkd[186]: eth1: Gained carrier138server # [335662.792430] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...139server # [335662.804222] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.140server # [335662.864501] server systemd-resolved[93]: Positive Trust Anchors:141server # [335662.864513] server systemd-resolved[93]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d142server # [335662.864518] server systemd-resolved[93]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16143server # [335662.864554] server systemd-resolved[93]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test144server # [335662.887060] server systemd-resolved[93]: Using system hostname 'server'.145server # [335662.888447] server systemd[1]: Started Network Name Resolution.146server # [335662.888546] server systemd[1]: Reached target Network.147server # [335662.888618] server systemd[1]: Reached target Network is Online.148server # [335662.888673] server systemd[1]: Reached target System Initialization.149server # [335662.888933] server systemd[1]: Started Renew ACME Certificate for test.foo.150server # [335662.888971] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container151server # [335662.889001] server systemd[1]: Started Daily Cleanup of Temporary Directories.152server # [335662.889023] server systemd[1]: Reached target Timer Units.153server # [335662.889166] server systemd[1]: Listening on D-Bus System Message Bus Socket.154server # [335662.889291] server systemd[1]: Listening on Nix Daemon Socket.155server # [335662.889428] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.156server # [335662.889460] server systemd[1]: Reached target Socket Units.157server # [335662.889511] server systemd[1]: Reached target Basic System.158server # [335662.891091] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...159server # [335662.892284] server systemd[1]: Starting Import lastlog data into lastlog2 database...160server # [335662.892329] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem161server # [335662.893406] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...162server # [335662.895015] server systemd[1]: Starting D-Bus System Message Bus...163server # [335662.914881] server systemd[1]: Finished Import lastlog data into lastlog2 database.164server # [335663.001751] server acme-setup-privileged[192]: + set -euo pipefail165server # [335663.001751] server acme-setup-privileged[192]: + cd /var/lib/acme166server # [335663.001751] server acme-setup-privileged[192]: + chmod -R u=rwX,g=,o= .lego/accounts167ca # [335662.752640] ca systemd-networkd[196]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted168ca # [335662.752728] ca systemd-networkd[196]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted169ca # [335662.760222] ca systemd-networkd[196]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.170ca # [335662.760387] ca systemd-networkd[196]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.171ca # [335662.760527] ca systemd-networkd[196]: lo: Link UP172ca # [335662.760532] ca systemd-networkd[196]: lo: Gained carrier173ca # [335662.760713] ca systemd-networkd[196]: eth1: Configuring with /etc/systemd/network/40-eth1.network.174ca # [335662.761142] ca systemd[1]: Started Network Management.175ca # [335662.792368] ca systemd-networkd[196]: eth1: Link UP176ca # [335662.792460] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...177ca # [335662.792727] ca systemd-networkd[196]: eth1: Gained carrier178ca # [335662.834979] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.179ca # [335662.862725] ca systemd-resolved[98]: Positive Trust Anchors:180ca # [335662.862735] ca systemd-resolved[98]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d181ca # [335662.862738] ca systemd-resolved[98]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16182ca # [335662.862773] ca systemd-resolved[98]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test183ca # [335662.885245] ca systemd-resolved[98]: Using system hostname 'ca'.184ca # [335662.886696] ca systemd[1]: Started Network Name Resolution.185ca # [335662.886849] ca systemd[1]: Reached target Network.186ca # [335662.886964] ca systemd[1]: Reached target Network is Online.187ca # [335662.887071] ca systemd[1]: Reached target System Initialization.188ca # [335662.887460] ca systemd[1]: Started Renew ACME Certificate for ca.foo.189ca # [335662.887531] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container190ca # [335662.887588] ca systemd[1]: Started Daily Cleanup of Temporary Directories.191ca # [335662.887631] ca systemd[1]: Reached target Timer Units.192ca # [335662.887869] ca systemd[1]: Listening on D-Bus System Message Bus Socket.193ca # [335662.888110] ca systemd[1]: Listening on Nix Daemon Socket.194ca # [335662.888360] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.195ca # [335662.888410] ca systemd[1]: Reached target Socket Units.196ca # [335662.888491] ca systemd[1]: Reached target Basic System.197ca # [335662.890836] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...198ca # [335662.892130] ca systemd[1]: Starting Import lastlog data into lastlog2 database...199ca # [335662.892202] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem200ca # [335662.893788] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...201ca # [335662.895501] ca systemd[1]: Starting step-ca service...202ca # [335662.898012] ca systemd[1]: Starting D-Bus System Message Bus...203ca # [335662.914689] ca systemd[1]: Finished Import lastlog data into lastlog2 database.204ca # [335663.012474] ca acme-setup-privileged[201]: + set -euo pipefail205ca # [335663.012474] ca acme-setup-privileged[201]: + cd /var/lib/acme206ca # [335663.012474] ca acme-setup-privileged[201]: + chmod -R u=rwX,g=,o= .lego/accounts207ca # [335663.013932] ca acme-setup-privileged[201]: + chown -R acme .lego/accounts208client # [335662.745214] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted209client # [335662.745303] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted210client # [335662.751856] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.211client # [335662.752032] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.212client # [335662.752188] client systemd-networkd[182]: lo: Link UP213client # [335662.752193] client systemd-networkd[182]: lo: Gained carrier214client # [335662.752388] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network.215client # [335662.752814] client systemd[1]: Started Network Management.216client # [335662.752839] client systemd-networkd[182]: eth1: Link UP217client # [335662.753187] client systemd-networkd[182]: eth1: Gained carrier218client # [335662.754063] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...219client # [335662.802060] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.220client # [335662.848948] client systemd-resolved[90]: Positive Trust Anchors:221client # [335662.848959] client systemd-resolved[90]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d222client # [335662.848962] client systemd-resolved[90]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16223client # [335662.848998] client systemd-resolved[90]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test224client # [335662.871430] client systemd-resolved[90]: Using system hostname 'client'.225client # [335662.872844] client systemd[1]: Started Network Name Resolution.226client # [335662.872930] client systemd[1]: Reached target Network.227client # [335662.873009] client systemd[1]: Reached target System Initialization.228client # [335662.873076] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container229client # [335662.873110] client systemd[1]: Started Daily Cleanup of Temporary Directories.230client # [335662.873135] client systemd[1]: Reached target Timer Units.231client # [335662.873287] client systemd[1]: Listening on D-Bus System Message Bus Socket.232client # [335662.873431] client systemd[1]: Listening on Nix Daemon Socket.233client # [335662.873565] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.234client # [335662.873597] client systemd[1]: Reached target Socket Units.235client # [335662.873645] client systemd[1]: Reached target Basic System.236client # [335662.875023] client systemd[1]: Starting Import lastlog data into lastlog2 database...237client # [335662.876224] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...238client # [335662.877815] client systemd[1]: Starting D-Bus System Message Bus...239client # [335662.898513] client systemd[1]: Finished Import lastlog data into lastlog2 database.240client # [335663.028025] client systemd[1]: Started Name Service Cache Daemon (nsncd).241client # [335663.028225] client nsncd[189]: Sep 08 04:41:23.013 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"242client # [335663.028106] client systemd[1]: Reached target Host and Network Name Lookups.243client # [335663.028184] client systemd[1]: Reached target User and Group Name Lookups.244server # [335663.003234] server acme-setup-privileged[192]: + chown -R acme .lego/accounts245server # [335663.005515] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo246server # [335663.005567] server acme-setup-privileged[192]: + '[' -d test.foo ']'247server # [335663.005567] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo248server # [335663.005567] server acme-setup-privileged[192]: + '[' -d .lego/test.foo ']'249server # [335663.037029] server nsncd[194]: Sep 08 04:41:23.022 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"250server # [335663.037077] server systemd[1]: Started Name Service Cache Daemon (nsncd).251server # [335663.037195] server systemd[1]: Reached target Host and Network Name Lookups.252server # [335663.037299] server systemd[1]: Reached target User and Group Name Lookups.253server # [335663.057397] server systemd[1]: Starting User Login Management...254server # [335663.058465] server systemd[1]: Starting Permit User Sessions...255server # [335663.068456] server systemd[1]: Finished Permit User Sessions.256server # [335663.070161] server systemd[1]: Started Console Getty.257server # [335663.070217] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0258server # [335663.070242] server systemd[1]: Reached target Login Prompts.259server # [335663.110088] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.260server # [335663.145183] server dbus-broker-launch[195]: Looking up NSS user entry for 'systemd-timesync'...261server # [335663.146348] server dbus-broker-launch[195]: NSS returned no entry for 'systemd-timesync'262server # [335663.146348] server dbus-broker-launch[195]: Invalid user-name in /nix/store/xamxpwkpq9pj51cyi13j1rn4cfjsvpj5-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"263server # [335663.146824] server systemd[1]: Started D-Bus System Message Bus.264server # [335663.153734] server dbus-broker-launch[195]: Ready265ca # [335663.015411] ca acme-setup-privileged[201]: + for fixpath in ca.foo .lego/ca.foo266ca # [335663.015452] ca acme-setup-privileged[201]: + '[' -d ca.foo ']'267ca # [335663.015452] ca acme-setup-privileged[201]: + for fixpath in ca.foo .lego/ca.foo268ca # [335663.015452] ca acme-setup-privileged[201]: + '[' -d .lego/ca.foo ']'269ca # [335663.040194] ca nsncd[203]: Sep 08 04:41:23.026 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"270ca # [335663.056565] ca systemd[1]: Started Name Service Cache Daemon (nsncd).271ca # [335663.056734] ca systemd[1]: Reached target Host and Network Name Lookups.272ca # [335663.056809] ca systemd[1]: Reached target User and Group Name Lookups.273ca # [335663.058397] ca systemd[1]: Starting User Login Management...274ca # [335663.059257] ca systemd[1]: Starting Permit User Sessions...275ca # [335663.070085] ca systemd[1]: Finished Permit User Sessions.276ca # [335663.071249] ca systemd[1]: Started Console Getty.277ca # [335663.071298] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0278ca # [335663.071319] ca systemd[1]: Reached target Login Prompts.279ca # [335663.119545] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.280ca # [335663.148225] ca dbus-broker-launch[205]: Looking up NSS user entry for 'systemd-timesync'...281ca # [335663.149096] ca dbus-broker-launch[205]: NSS returned no entry for 'systemd-timesync'282ca # [335663.149096] ca dbus-broker-launch[205]: Invalid user-name in /nix/store/kb2b8z8qy8fbf7i5cavy9vvn05jlnfay-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"283ca # [335663.149469] ca systemd[1]: Started D-Bus System Message Bus.284ca # [335663.158046] ca dbus-broker-launch[205]: Ready285client # [335663.057409] client systemd[1]: Starting User Login Management...286client # [335663.058663] client systemd[1]: Starting Permit User Sessions...287client # [335663.068684] client systemd[1]: Finished Permit User Sessions.288client # [335663.070211] client systemd[1]: Started Console Getty.289client # [335663.070262] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0290client # [335663.070284] client systemd[1]: Reached target Login Prompts.291client # [335663.128099] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.292client # [335663.156960] client dbus-broker-launch[190]: Looking up NSS user entry for 'systemd-timesync'...293client # [335663.157847] client dbus-broker-launch[190]: NSS returned no entry for 'systemd-timesync'294client # [335663.157847] client dbus-broker-launch[190]: Invalid user-name in /nix/store/hcmnwjy5lp6bjqw8pvq2l5h1hh90qrh4-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"295client # [335663.158266] client systemd[1]: Started D-Bus System Message Bus.296client # [335663.167038] client dbus-broker-launch[190]: Ready297ca # [335663.586279] ca systemd-logind[230]: New seat seat0.298ca # [335663.586458] ca systemd[1]: Started User Login Management.299ca # [335663.587962] ca systemd[1]: Starting linger-users.service...300ca # [335663.646141] ca systemd[1]: linger-users.service: Deactivated successfully.301ca # [335663.646331] ca systemd[1]: Finished linger-users.service.302ca # [335663.650252] ca acme-setup-start[219]: + set -euo pipefail303ca # [335663.650578] ca acme-setup-start[219]: + test -e ca/key.pem304ca # [335663.650578] ca acme-setup-start[219]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local305ca # [335663.672557] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.306ca # [335663.674756] ca systemd[1]: Starting Ensure certificate for ca.foo...307ca # [335663.793568] ca step-ca[204]: badger 2026/09/08 04:41:23 INFO: All 0 tables opened in 0s308ca # [335663.798329] ca step-ca[204]: 2026/09/08 04:41:23 Building new tls configuration using step-ca x509 Signer Interface309ca # [335663.805582] ca step-ca[204]: 2026/09/08 04:41:23 Starting Smallstep CA/0.30.2 (linux/arm64)310ca # [335663.805582] ca step-ca[204]: 2026/09/08 04:41:23 Documentation: https://u.step.sm/docs/ca311ca # [335663.805582] ca step-ca[204]: 2026/09/08 04:41:23 Community Discord: https://u.step.sm/discord312ca # [335663.805582] ca step-ca[204]: 2026/09/08 04:41:23 Config file: /etc/smallstep/ca.json313ca # [335663.805582] ca step-ca[204]: 2026/09/08 04:41:23 The primary server URL is https://ca.foo:1443314ca # [335663.805582] ca step-ca[204]: 2026/09/08 04:41:23 Root certificates are available at https://ca.foo:1443/roots.pem315ca # [335663.805767] ca step-ca[204]: 2026/09/08 04:41:23 X.509 Root Fingerprint: 5e6eb42ec221aa44c6f2ddc42f73ca50c7e87ec1868dc2686e725a3670dccf25316ca # [335663.806141] ca systemd[1]: Started step-ca service.317ca # [335663.806439] ca step-ca[204]: 2026/09/08 04:41:23 Serving HTTPS on 0.0.0.0:1443 ...318client # [335663.599589] client systemd-logind[205]: New seat seat0.319client # [335663.599793] client systemd[1]: Started User Login Management.320client # [335663.636482] client systemd[1]: Starting linger-users.service...321client # [335663.650749] client systemd[1]: linger-users.service: Deactivated successfully.322client # [335663.650893] client systemd[1]: Finished linger-users.service.323client # [335663.651704] client systemd[1]: Reached target Multi-User System.324client # [335663.652737] client systemd[1]: Startup finished in 1.928s.325client # [335663.780196] client systemd-networkd[182]: eth1: Gained IPv6LL326server # [335663.591030] server systemd-logind[220]: New seat seat0.327server # [335663.591207] server systemd[1]: Started User Login Management.328server # [335663.636580] server systemd[1]: Starting linger-users.service...329server # [335663.640873] server acme-setup-start[208]: + set -euo pipefail330server # [335663.641178] server acme-setup-start[208]: + test -e ca/key.pem331server # [335663.641178] server acme-setup-start[208]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local332server # [335663.651117] server systemd[1]: linger-users.service: Deactivated successfully.333server # [335663.651203] server systemd[1]: Finished linger-users.service.334server # [335663.663334] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.335server # [335663.664823] server systemd[1]: Starting Ensure certificate for test.foo...336ca # [335663.904241] ca systemd-networkd[196]: eth1: Gained IPv6LL337ca # [335664.144336] ca acme-ca.foo-start[255]: Waiting to acquire lock in /run/acme/338ca # [335664.147028] ca acme-ca.foo-start[255]: + '[' -e out/acme-success ']'339ca # [335664.147124] ca acme-ca.foo-start[255]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=340ca: must succeed: systemctl restart acme-order-renew-ca.foo.service 341server # [335663.968166] server systemd-networkd[186]: eth1: Gained IPv6LL342server # [335664.132398] server acme-test.foo-start[245]: Waiting to acquire lock in /run/acme/343server # [335664.135581] server acme-test.foo-start[245]: + '[' -e out/acme-success ']'344server # [335664.135677] server acme-test.foo-start[245]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=345server # [335664.151084] server acme-test.foo-start[255]: + cd test.foo346server # [335664.151527] server acme-test.foo-start[255]: + cp -vp cert.pem ../out/cert.pem347server # [335664.153086] server acme-test.foo-start[256]: 'cert.pem' -> '../out/cert.pem'348server # [335664.153383] server acme-test.foo-start[255]: + cp -vp key.pem ../out/key.pem349server # [335664.155297] server acme-test.foo-start[255]: 'key.pem' -> '../out/key.pem'350server # [335664.155590] server acme-test.foo-start[245]: + cat out/cert.pem ca/cert.pem351server # [335664.157437] server acme-test.foo-start[245]: + cp ca/cert.pem out/chain.pem352server # [335664.159384] server acme-test.foo-start[245]: + cat out/key.pem out/fullchain.pem353server # [335664.161865] server acme-test.foo-start[245]: + for fixpath in out certificates354server # [335664.161907] server acme-test.foo-start[245]: + '[' -d out ']'355server # [335664.161907] server acme-test.foo-start[245]: + chmod -R u=rwX,g=rX,o= out356server # [335664.163657] server acme-test.foo-start[245]: + chown -R acme:nginx out357server # [335664.168873] server acme-test.foo-start[245]: + for fixpath in out certificates358server # [335664.168905] server acme-test.foo-start[245]: + '[' -d certificates ']'359server # [335664.172768] server systemd[1]: Finished Ensure certificate for test.foo.360server # [335664.175292] server systemd[1]: Starting Nginx Web Server...361ca # [335664.161994] ca acme-ca.foo-start[293]: + cd ca.foo362ca # [335664.161994] ca acme-ca.foo-start[293]: + cp -vp cert.pem ../out/cert.pem363ca # [335664.163963] ca acme-ca.foo-start[294]: 'cert.pem' -> '../out/cert.pem'364ca # [335664.164470] ca acme-ca.foo-start[293]: + cp -vp key.pem ../out/key.pem365ca # [335664.165951] ca acme-ca.foo-start[293]: 'key.pem' -> '../out/key.pem'366ca # [335664.166227] ca acme-ca.foo-start[255]: + cat out/cert.pem ca/cert.pem367ca # [335664.168401] ca acme-ca.foo-start[255]: + cp ca/cert.pem out/chain.pem368ca # [335664.170441] ca acme-ca.foo-start[255]: + cat out/key.pem out/fullchain.pem369ca # [335664.172554] ca acme-ca.foo-start[255]: + for fixpath in out certificates370ca # [335664.172582] ca acme-ca.foo-start[255]: + '[' -d out ']'371ca # [335664.172582] ca acme-ca.foo-start[255]: + chmod -R u=rwX,g=rX,o= out372ca # [335664.174442] ca acme-ca.foo-start[255]: + chown -R acme:nginx out373ca # [335664.178133] ca acme-ca.foo-start[255]: + for fixpath in out certificates374ca # [335664.178153] ca acme-ca.foo-start[255]: + '[' -d certificates ']'375ca # [335664.180958] ca systemd[1]: Finished Ensure certificate for ca.foo.376ca # [335664.212543] ca systemd[1]: Starting Nginx Web Server...377server # [335664.704328] server nginx-pre-start[267]: nginx: the configuration file /nix/store/1hcqj3qwgk1l5wg86fhwxyq6ddsn1ggy-nginx.conf syntax is ok378server # [335664.704752] server nginx-pre-start[267]: nginx: configuration file /nix/store/1hcqj3qwgk1l5wg86fhwxyq6ddsn1ggy-nginx.conf test is successful379server # [335664.709571] server systemd[1]: Started Nginx Web Server.380server # [335664.710059] server systemd[1]: Reached target Multi-User System.381server # [335664.711599] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...382ca # [335664.716171] ca nginx-pre-start[305]: nginx: the configuration file /nix/store/272j8qwxx36pi0ykqmh0mpvz81k0cysm-nginx.conf syntax is ok383ca # [335664.716575] ca nginx-pre-start[305]: nginx: configuration file /nix/store/272j8qwxx36pi0ykqmh0mpvz81k0cysm-nginx.conf test is successful384ca # [335664.744492] ca systemd[1]: Started Nginx Web Server.385ca # [335664.744993] ca systemd[1]: Reached target Multi-User System.386ca # [335664.746445] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...387server # [335665.251350] server acme-order-renew-test.foo-start[270]: Waiting to acquire lock in /run/acme/388server # [335665.255365] server acme-order-renew-test.foo-start[270]: + set -euo pipefail389server # [335665.255486] server acme-order-renew-test.foo-start[270]: + echo ad12aa6741ce4bd2c108390server # [335665.255570] server acme-order-renew-test.foo-start[270]: + cmp -s domainhash.txt certificates/domainhash.txt391server # [335665.257159] server acme-order-renew-test.foo-start[270]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run392server # [335665.287685] server acme-order-renew-test.foo-start[282]: 2026/09/08 04:41:25 No key found for account none@none.tld. Generating a P256 key.393server # [335665.288061] server acme-order-renew-test.foo-start[282]: 2026/09/08 04:41:25 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key394server # [335665.324795] server acme-order-renew-test.foo-start[282]: 2026/09/08 04:41:25 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority395server # [335665.325540] server acme-order-renew-test.foo-start[270]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.396server # [335665.325540] server acme-order-renew-test.foo-start[270]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.397server # [335665.325540] server acme-order-renew-test.foo-start[270]: + exit 10398server # [335665.329960] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a399server # [335665.330057] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'.400server # [335665.330304] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo.401server # [335665.330605] server systemd[1]: Startup finished in 3.602s.402ca # [335665.264405] ca acme-order-renew-ca.foo-start[308]: Waiting to acquire lock in /run/acme/403ca # [335665.267834] ca acme-order-renew-ca.foo-start[308]: + set -euo pipefail404ca # [335665.267919] ca acme-order-renew-ca.foo-start[308]: + echo 88dc4fc401a6091a1bd9405ca # [335665.268076] ca acme-order-renew-ca.foo-start[308]: + cmp -s domainhash.txt certificates/domainhash.txt406ca # [335665.269235] ca acme-order-renew-ca.foo-start[308]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run407ca # [335665.290533] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 No key found for account none@none.tld. Generating a P256 key.408ca # [335665.290867] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key409ca # [335665.313719] ca step-ca[204]: time="2026-09-08T04:41:25Z" level=info duration="124.721µs" duration-ns=124721 fields.time="2026-09-08T04:41:25Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=21db949e-9fe3-4597-988a-8d17009a6656 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=410ca # [335665.314234] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] acme: Registering account for none@none.tld411ca # [335665.322682] ca step-ca[204]: time="2026-09-08T04:41:25Z" level=info duration=8.407676ms duration-ns=8407676 fields.time="2026-09-08T04:41:25Z" method=HEAD name=ca nonce=c2ZJdzdaTGFSVWJlQ0JmWGx2ZVZ0ZTh5d1M5YVJzMno path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=fd334c87-bc1f-411d-86b5-96ad707db199 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=412ca # [335665.328534] ca step-ca[204]: time="2026-09-08T04:41:25Z" level=info duration=5.128991ms duration-ns=5128991 fields.time="2026-09-08T04:41:25Z" method=POST name=ca nonce=TkQyakg2N1piWGJDMWt4Z3hUUVhCam1nR1Fqb2kwR2k path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=293ae7cf-3a8e-476f-89ab-e091c586b717 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/EEqTtieC3zDj76v7OS0LDhTZVcSaNegf/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=413ca # [335665.328844] ca acme-order-renew-ca.foo-start[319]: !!!! HEADS UP !!!!414ca # [335665.328844] ca acme-order-renew-ca.foo-start[319]: Your account credentials have been saved in your415ca # [335665.328844] ca acme-order-renew-ca.foo-start[319]: configuration directory at "accounts".416ca # [335665.328844] ca acme-order-renew-ca.foo-start[319]: You should make a secure backup of this folder now. This417ca # [335665.328844] ca acme-order-renew-ca.foo-start[319]: configuration directory will also contain private keys418ca # [335665.328844] ca acme-order-renew-ca.foo-start[319]: generated by lego and certificates obtained from the ACME419ca # [335665.328844] ca acme-order-renew-ca.foo-start[319]: server. Making regular backups of this folder is ideal.420ca # [335665.329052] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate421ca # [335665.333278] ca step-ca[204]: time="2026-09-08T04:41:25Z" level=info duration=3.954135ms duration-ns=3954135 fields.time="2026-09-08T04:41:25Z" method=POST name=ca nonce=dGhabW9VOUV1d3NCd0laVGRYR3ZDZU5lSXdRUHlZbHo path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=58fbd716-4792-4a16-8678-fb384b81ae28 response="{\"id\":\"YPILRqvlGJk3BuuqxYwN0gFqky2RifoB\",\"status\":\"pending\",\"expires\":\"2026-09-09T04:41:25Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-08T04:40:25Z\",\"notAfter\":\"2026-12-07T04:41:25Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/lR21x3EbpTSI0psb63mHmYeModCBzwsX\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/YPILRqvlGJk3BuuqxYwN0gFqky2RifoB/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=422ca # [335665.397043] ca step-ca[204]: time="2026-09-08T04:41:25Z" level=info duration=6.683452ms duration-ns=6683452 fields.time="2026-09-08T04:41:25Z" method=POST name=ca nonce=M3p2ampKQXZSZ2FzU0lyTkV1YmFsWEZOcmRuQ0tjY2Y path=/acme/acme/authz/lR21x3EbpTSI0psb63mHmYeModCBzwsX protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=2175ce23-e944-4c94-9148-3fae1e01d034 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"cn8RjUAmfv7tcGwJtv9CCauWtEPD8D3h\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/lR21x3EbpTSI0psb63mHmYeModCBzwsX/alqPU7nvPXBfJNPqPixhbXhcv3pNf2Oy\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"cn8RjUAmfv7tcGwJtv9CCauWtEPD8D3h\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/lR21x3EbpTSI0psb63mHmYeModCBzwsX/JjbQ7IM9lh0rjukGwlX7SLw7n0jIVjOk\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"cn8RjUAmfv7tcGwJtv9CCauWtEPD8D3h\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/lR21x3EbpTSI0psb63mHmYeModCBzwsX/xvDDbL6cGROWRnmSfugYpGtPd5pMBnlq\"}],\"wildcard\":false,\"expires\":\"2026-09-09T04:41:25Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=423ca # [335665.397349] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/lR21x3EbpTSI0psb63mHmYeModCBzwsX424ca # [335665.397349] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01425ca # [335665.397349] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] [ca.foo] acme: use http-01 solver426ca # [335665.397349] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] [ca.foo] acme: Trying to solve HTTP-01427ca # [335665.402342] ca step-ca[204]: time="2026-09-08T04:41:25Z" level=info duration=4.511542ms duration-ns=4511542 fields.time="2026-09-08T04:41:25Z" method=POST name=ca nonce=WldUV2FsUXBRVUV1ZmpUNjRmVGFDSTRWV1hDdEtPNkY path=/acme/acme/challenge/lR21x3EbpTSI0psb63mHmYeModCBzwsX/JjbQ7IM9lh0rjukGwlX7SLw7n0jIVjOk protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=6c8d31d7-7fd0-454c-bbd2-e22418e15b81 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"cn8RjUAmfv7tcGwJtv9CCauWtEPD8D3h\",\"validated\":\"2026-09-08T04:41:25Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/lR21x3EbpTSI0psb63mHmYeModCBzwsX/JjbQ7IM9lh0rjukGwlX7SLw7n0jIVjOk\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=428ca # [335665.402581] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] [ca.foo] The server validated our request429ca # [335665.402661] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates430ca # [335665.412417] ca step-ca[204]: time="2026-09-08T04:41:25Z" level=info duration=8.965684ms duration-ns=8965684 fields.time="2026-09-08T04:41:25Z" method=POST name=ca nonce=ZE5mekFTYTlHVEJLcWR0ckd5ZVZVd1ZnUzlKbDNHQmo path=/acme/acme/order/YPILRqvlGJk3BuuqxYwN0gFqky2RifoB/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=6ec94118-db55-415f-8b47-2f82d8c7879e response="{\"id\":\"YPILRqvlGJk3BuuqxYwN0gFqky2RifoB\",\"status\":\"valid\",\"expires\":\"2026-09-09T04:41:25Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-08T04:40:25Z\",\"notAfter\":\"2026-12-07T04:41:25Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/lR21x3EbpTSI0psb63mHmYeModCBzwsX\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/YPILRqvlGJk3BuuqxYwN0gFqky2RifoB/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/mJrD3OY50CznvhEnuGiQTGCn2GFvSVvJ\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=431ca # [335665.415095] ca step-ca[204]: time="2026-09-08T04:41:25Z" level=info certificate="MIIB1TCCAXqgAwIBAgIRAMcJzsQA8DJp4mpycYZAYn4wCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTA4MDQ0MDI1WhcNMjYxMjA3MDQ0MTI1WjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARn6gyQYh+V9JGmcCnRw5UoUbhpdxHiL6oiO3iz3L47L7Keb5WMF8hFNph5K5oH++lAMSFLoPBwfHMIzocTJRk3o4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFL8aqCk5z0fVxrf2UFQYArZAhzU8MB8GA1UdIwQYMBaAFD7ALaERTl73Xrf/M/P6lhVzCJg1MBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSQAwRgIhAOa0oR79NQVdxIp4pqzvo+KIz4XiApEKpN0UyF8D6m+zAiEA6qMdDKNZBpYjVMrMsKtsIWdDE6C9OiGBYTkv36y9Dkc=" duration=1.738184ms duration-ns=1738184 fields.time="2026-09-08T04:41:25Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=eExPTVZuMTdhNTgyZTk0b2k0dEhEcFNQeEp5VXI0WXA path=/acme/acme/certificate/mJrD3OY50CznvhEnuGiQTGCn2GFvSVvJ protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=454eb6b3-6805-42f2-886c-9ef93752cf3c sans="map[dns:[ca.foo]]" serial=264567295538313657464686641586836103806 size=1344 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-09-08T04:40:25Z" valid-to="2026-12-07T04:41:25Z"432ca # [335665.415317] ca acme-order-renew-ca.foo-start[319]: 2026/09/08 04:41:25 [INFO] [ca.foo] Server responded with a certificate.433ca # [335665.420121] ca acme-order-renew-ca.foo-start[308]: + mv domainhash.txt certificates/434ca # [335665.422170] ca acme-order-renew-ca.foo-start[308]: + touch out/acme-success435ca # [335665.423928] ca acme-order-renew-ca.foo-start[308]: + cmp -s certificates/ca.foo.crt out/fullchain.pem436ca # [335665.425895] ca acme-order-renew-ca.foo-start[308]: + touch out/renewed437ca # [335665.427600] ca acme-order-renew-ca.foo-start[308]: + echo Installing new certificate438ca # [335665.427600] ca acme-order-renew-ca.foo-start[308]: Installing new certificate439ca # [335665.427662] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.crt out/fullchain.pem440ca # [335665.429277] ca acme-order-renew-ca.foo-start[352]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'441ca # [335665.429565] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.key out/key.pem442ca # [335665.431015] ca acme-order-renew-ca.foo-start[353]: 'certificates/ca.foo.key' -> 'out/key.pem'443ca # [335665.431335] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem444ca # [335665.433175] ca acme-order-renew-ca.foo-start[354]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'445ca # [335665.433479] ca acme-order-renew-ca.foo-start[308]: + ln -sf fullchain.pem out/cert.pem446ca # [335665.435355] ca acme-order-renew-ca.foo-start[308]: + cat out/key.pem out/fullchain.pem447ca # [335665.437690] ca acme-order-renew-ca.foo-start[308]: + for fixpath in out certificates448ca # [335665.437721] ca acme-order-renew-ca.foo-start[308]: + '[' -d out ']'449ca # [335665.437721] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=rX,o= out450ca # [335665.439492] ca acme-order-renew-ca.foo-start[308]: + chown -R acme:nginx out451ca # [335665.442217] ca acme-order-renew-ca.foo-start[308]: + for fixpath in out certificates452ca # [335665.442255] ca acme-order-renew-ca.foo-start[308]: + '[' -d certificates ']'453ca # [335665.442284] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=rX,o= certificates454ca # [335665.443927] ca acme-order-renew-ca.foo-start[308]: + chown -R acme:nginx certificates455ca # [335665.446620] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=,o= accounts/.456ca # [335665.534336] ca systemd[1]: Reloading Nginx Web Server...457ca # [335665.537582] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.458ca # [335665.537743] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.459ca # [335666.076824] ca nginx[370]: nginx: the configuration file /nix/store/272j8qwxx36pi0ykqmh0mpvz81k0cysm-nginx.conf syntax is ok460ca # [335666.077203] ca nginx[370]: nginx: configuration file /nix/store/272j8qwxx36pi0ykqmh0mpvz81k0cysm-nginx.conf test is successful461ca # [335666.609203] ca systemd[1]: Reloaded Nginx Web Server.462ca # [335666.609783] ca systemd[1]: Startup finished in 4.860s.463ca # [335666.903684] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...464ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 3.37 seconds)465ca # [335667.416755] ca acme-order-renew-ca.foo-start[385]: Waiting to acquire lock in /run/acme/466ca # [335667.419645] ca acme-order-renew-ca.foo-start[385]: + set -euo pipefail467ca # [335667.419722] ca acme-order-renew-ca.foo-start[385]: + echo 88dc4fc401a6091a1bd9468ca # [335667.419836] ca acme-order-renew-ca.foo-start[385]: + cmp -s domainhash.txt certificates/domainhash.txt469ca # [335667.421214] ca acme-order-renew-ca.foo-start[385]: + '[' -e certificates/ca.foo.key ']'470ca # [335667.421214] ca acme-order-renew-ca.foo-start[385]: + '[' -e certificates/ca.foo.crt ']'471ca # [335667.421643] ca acme-order-renew-ca.foo-start[393]: ++ find accounts -name none@none.tld.key472ca # [335667.423868] ca acme-order-renew-ca.foo-start[385]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']'473ca # [335667.423954] ca acme-order-renew-ca.foo-start[385]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic474ca # [335667.467240] ca step-ca[204]: time="2026-09-08T04:41:27Z" level=info duration="52.681µs" duration-ns=52681 fields.time="2026-09-08T04:41:27Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=cf97ad53-38fd-47de-8ce7-82d6435eeec9 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=475ca # [335667.467713] ca acme-order-renew-ca.foo-start[394]: 2026/09/08 04:41:27 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint476ca # [335667.467713] ca acme-order-renew-ca.foo-start[394]: 2026/09/08 04:41:27 [INFO] [ca.foo] The certificate expires at 2026-12-07T04:41:25Z, the renewal can be performed in 1439h59m37.546574221s: no renewal.477ca # [335667.468269] ca acme-order-renew-ca.foo-start[385]: + mv domainhash.txt certificates/478ca # [335667.470245] ca acme-order-renew-ca.foo-start[385]: + touch out/acme-success479ca # [335667.471962] ca acme-order-renew-ca.foo-start[385]: + cmp -s certificates/ca.foo.crt out/fullchain.pem480ca # [335667.473110] ca acme-order-renew-ca.foo-start[385]: + for fixpath in out certificates481ca # [335667.473143] ca acme-order-renew-ca.foo-start[385]: + '[' -d out ']'482ca # [335667.473143] ca acme-order-renew-ca.foo-start[385]: + chmod -R u=rwX,g=rX,o= out483ca # [335667.474677] ca acme-order-renew-ca.foo-start[385]: + chown -R acme:nginx out484ca # [335667.477993] ca acme-order-renew-ca.foo-start[385]: + for fixpath in out certificates485ca # [335667.477993] ca acme-order-renew-ca.foo-start[385]: + '[' -d certificates ']'486ca # [335667.478081] ca acme-order-renew-ca.foo-start[385]: + chmod -R u=rwX,g=rX,o= certificates487ca # [335667.480292] ca acme-order-renew-ca.foo-start[385]: + chown -R acme:nginx certificates488ca # [335667.482857] ca acme-order-renew-ca.foo-start[385]: + chmod -R u=rwX,g=,o= accounts/.489ca # [335667.598679] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.490ca # [335667.599012] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.491server: must succeed: systemctl restart acme-test.foo.service492server # [335670.620588] server systemd[1]: acme-test.foo.service: Deactivated successfully.493server # [335670.620975] server systemd[1]: Stopped Ensure certificate for test.foo.494server # [335670.622269] server systemd[1]: Stopping Ensure certificate for test.foo...495server # [335670.624663] server systemd[1]: Starting Ensure certificate for test.foo...496server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.56 seconds)497client: waiting for success: curl -v https://test.foo498* Trying [2001:db8:1::3]:443...499* Host test.foo:443 was resolved.500* IPv6: 2001:db8:1::3501* IPv4: 192.168.1.3502* ALPN: curl offers h2,http/1.1503} [5 bytes data]504* TLSv1.3 (OUT), TLS handshake, Client hello (1):505} [1552 bytes data]506* SSL Trust Anchors:507* OpenSSL default paths (fallback)508{ [5 bytes data]509* TLSv1.3 (IN), TLS handshake, Server hello (2):510{ [1210 bytes data]511* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):512{ [1 bytes data]513* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):514{ [19 bytes data]515* TLSv1.3 (IN), TLS handshake, Certificate (11):516{ [1010 bytes data]517* TLSv1.3 (IN), TLS handshake, CERT verify (15):518{ [111 bytes data]519* TLSv1.3 (IN), TLS handshake, Finished (20):520{ [52 bytes data]521* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):522} [1 bytes data]523* TLSv1.3 (OUT), TLS handshake, Finished (20):524} [52 bytes data]525* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey526* ALPN: server accepted h2527* Server certificate:528* subject: CN=test.foo529* start date: Sep 8 04:41:24 2026 GMT530* expire date: Oct 8 04:41:24 2028 GMT531* issuer: CN=minica root ca 3da640532* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384533* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384534* subjectAltName: "test.foo" matches cert's "test.foo"535* OpenSSL verify result: 13536* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)537* closing connection #0538curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)539More details here: https://curl.se/docs/sslcerts.html540541curl failed to verify the legitimacy of the server and therefore could not542establish a secure connection to it. To learn more about this situation and543how to fix it, please visit the webpage mentioned above.544server # [335671.129572] server acme-test.foo-start[315]: Waiting to acquire lock in /run/acme/545server # [335671.133126] server acme-test.foo-start[315]: + '[' -e out/acme-success ']'546server # [335671.133126] server acme-test.foo-start[315]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=547server # [335671.148762] server acme-test.foo-start[324]: + cd test.foo548server # [335671.149297] server acme-test.foo-start[324]: + cp -vp cert.pem ../out/cert.pem549server # [335671.150623] server acme-test.foo-start[325]: 'cert.pem' -> '../out/cert.pem'550server # [335671.150929] server acme-test.foo-start[324]: + cp -vp key.pem ../out/key.pem551server # [335671.152367] server acme-test.foo-start[324]: 'key.pem' -> '../out/key.pem'552server # [335671.152634] server acme-test.foo-start[315]: + cat out/cert.pem ca/cert.pem553server # [335671.154785] server acme-test.foo-start[315]: + cp ca/cert.pem out/chain.pem554server # [335671.157134] server acme-test.foo-start[315]: + cat out/key.pem out/fullchain.pem555server # [335671.159231] server acme-test.foo-start[315]: + for fixpath in out certificates556server # [335671.159231] server acme-test.foo-start[315]: + '[' -d out ']'557server # [335671.159336] server acme-test.foo-start[315]: + chmod -R u=rwX,g=rX,o= out558server # [335671.160690] server acme-test.foo-start[315]: + chown -R acme:nginx out559server # [335671.164072] server acme-test.foo-start[315]: + for fixpath in out certificates560server # [335671.164072] server acme-test.foo-start[315]: + '[' -d certificates ']'561server # [335671.167648] server systemd[1]: Finished Ensure certificate for test.foo.562server # [335671.172358] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...563server # [335671.670520] server acme-order-renew-test.foo-start[332]: Waiting to acquire lock in /run/acme/564server # [335671.674440] server acme-order-renew-test.foo-start[332]: + set -euo pipefail565server # [335671.674517] server acme-order-renew-test.foo-start[332]: + echo ad12aa6741ce4bd2c108566server # [335671.674633] server acme-order-renew-test.foo-start[332]: + cmp -s domainhash.txt certificates/domainhash.txt567server # [335671.676390] server acme-order-renew-test.foo-start[332]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run568server # [335671.718884] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] acme: Registering account for none@none.tld569server # [335671.808586] server acme-order-renew-test.foo-start[340]: !!!! HEADS UP !!!!570server # [335671.808586] server acme-order-renew-test.foo-start[340]: Your account credentials have been saved in your571server # [335671.808586] server acme-order-renew-test.foo-start[340]: configuration directory at "accounts".572server # [335671.808586] server acme-order-renew-test.foo-start[340]: You should make a secure backup of this folder now. This573server # [335671.808586] server acme-order-renew-test.foo-start[340]: configuration directory will also contain private keys574server # [335671.808586] server acme-order-renew-test.foo-start[340]: generated by lego and certificates obtained from the ACME575server # [335671.808586] server acme-order-renew-test.foo-start[340]: server. Making regular backups of this folder is ideal.576server # [335671.808938] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] [test.foo] acme: Obtaining bundled SAN certificate577server # [335671.898230] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9578server # [335671.898230] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01579server # [335671.898230] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] [test.foo] acme: use http-01 solver580server # [335671.898405] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] [test.foo] acme: Trying to solve HTTP-01581server # [335671.916495] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] [test.foo] The server validated our request582server # [335671.916617] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] [test.foo] acme: Validations succeeded; requesting certificates583server # [335671.944960] server acme-order-renew-test.foo-start[340]: 2026/09/08 04:41:31 [INFO] [test.foo] Server responded with a certificate.584ca # [335671.718166] ca step-ca[204]: time="2026-09-08T04:41:31Z" level=info duration="63.56µs" duration-ns=63560 fields.time="2026-09-08T04:41:31Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=8fb994b4-be65-4534-90f8-358774a2f455 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=585ca # [335671.799662] ca step-ca[204]: time="2026-09-08T04:41:31Z" level=info duration=76.79622ms duration-ns=76796220 fields.time="2026-09-08T04:41:31Z" method=HEAD name=ca nonce=TzJpb25QbUNzd2xROU5UZThmcXp3c2FzSFk1U1Q5bHI path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=8d6c6112-bb1b-48c3-8834-ec472ebdce88 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=586ca # [335671.807680] ca step-ca[204]: time="2026-09-08T04:41:31Z" level=info duration=3.260925ms duration-ns=3260925 fields.time="2026-09-08T04:41:31Z" method=POST name=ca nonce=OEdSdzFKMXYwOEN5MHZMREpiOUNIQVl4cTBHeWJxRVM path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=2071577a-3443-480c-b5e3-e5d101a59169 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/frGIfGbwRZawMz7GFmTfyGxIxKfZubPL/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=587ca # [335671.816805] ca step-ca[204]: time="2026-09-08T04:41:31Z" level=info duration=4.273259ms duration-ns=4273259 fields.time="2026-09-08T04:41:31Z" method=POST name=ca nonce=T1ZqYXk0b3d4V3gwekdrdm9lVGc1QUR3eG5FM2Zuc3c path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=8e554981-9215-493f-8f7d-d47fc972df45 response="{\"id\":\"LtRaw6mq5lnmGvG2Aa1cVDB7U2VlEWp5\",\"status\":\"pending\",\"expires\":\"2026-09-09T04:41:31Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-08T04:40:31Z\",\"notAfter\":\"2026-12-07T04:41:31Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9\"],\"finalize\":\"https://ca.foo/acme/acme/order/LtRaw6mq5lnmGvG2Aa1cVDB7U2VlEWp5/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=588ca # [335671.897407] ca step-ca[204]: time="2026-09-08T04:41:31Z" level=info duration=19.469389ms duration-ns=19469389 fields.time="2026-09-08T04:41:31Z" method=POST name=ca nonce=SXU3ekxEbkdNZHFtV1lvb2FRbHAyS1NXOEVaR1A1WXA path=/acme/acme/authz/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9 protocol=HTTP/1.1 referer= remote-address="::1" request-id=de31d07f-08c9-48aa-9bf4-093c3a8495a6 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"bLo4VdeM0GWrCqoW49gQGgfUd7dPCOW7\",\"url\":\"https://ca.foo/acme/acme/challenge/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9/80yNBqq06ycP0kXDibKvKIHQ4meDkrWv\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"bLo4VdeM0GWrCqoW49gQGgfUd7dPCOW7\",\"url\":\"https://ca.foo/acme/acme/challenge/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9/OpKugflQXvTijrI3YqPMfFAqWhzkEjU2\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"bLo4VdeM0GWrCqoW49gQGgfUd7dPCOW7\",\"url\":\"https://ca.foo/acme/acme/challenge/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9/3SviXDP5v5ybWeTZYAphtuJtJ8o7qHF6\"}],\"wildcard\":false,\"expires\":\"2026-09-09T04:41:31Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=589ca # [335671.915817] ca step-ca[204]: time="2026-09-08T04:41:31Z" level=info duration=13.295543ms duration-ns=13295543 fields.time="2026-09-08T04:41:31Z" method=POST name=ca nonce=R1ViOFdJOHhPUUdYM3NER0lYOTV2SDBoSms0b1N2azI path=/acme/acme/challenge/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9/OpKugflQXvTijrI3YqPMfFAqWhzkEjU2 protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=8b9c606f-0f25-404a-adeb-be5c1c89432c response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"bLo4VdeM0GWrCqoW49gQGgfUd7dPCOW7\",\"validated\":\"2026-09-08T04:41:31Z\",\"url\":\"https://ca.foo/acme/acme/challenge/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9/OpKugflQXvTijrI3YqPMfFAqWhzkEjU2\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=590ca # [335671.937769] ca step-ca[204]: time="2026-09-08T04:41:31Z" level=info duration=16.790831ms duration-ns=16790831 fields.time="2026-09-08T04:41:31Z" method=POST name=ca nonce=bjZVb1daZUdaV01VdFdWeDZ5cTZzTlFvWHFmekhqZXY path=/acme/acme/order/LtRaw6mq5lnmGvG2Aa1cVDB7U2VlEWp5/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=dc2a7ab4-4cc5-4b56-9c6f-415e9c348abc response="{\"id\":\"LtRaw6mq5lnmGvG2Aa1cVDB7U2VlEWp5\",\"status\":\"valid\",\"expires\":\"2026-09-09T04:41:31Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-08T04:40:31Z\",\"notAfter\":\"2026-12-07T04:41:31Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/iH8z2aALYD8mw9nfQrPfajxAUZ2VHMY9\"],\"finalize\":\"https://ca.foo/acme/acme/order/LtRaw6mq5lnmGvG2Aa1cVDB7U2VlEWp5/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/9l66vj03f22fnbtgfaFqnE6Ax7Qoaxbp\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=591ca # [335671.944082] ca step-ca[204]: time="2026-09-08T04:41:31Z" level=info certificate="MIIB2DCCAX2gAwIBAgIQGN2lAEGEcpFRtKdUL9xiojAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MDgwNDQwMzFaFw0yNjEyMDcwNDQxMzFaMBMxETAPBgNVBAMTCHRlc3QuZm9vMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpwEK34Vsfmm0rTXG3U5uKPbyOHpIDaXSK8E/L4P2DNznl3sQuS89jMpqQoMlRFPQNep5AyZfz0tFLu6HJpdIq6OBpjCBozAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBSnnyVtO9yoilpZgl1tSycjaHSdQDAfBgNVHSMEGDAWgBQ+wC2hEU5e9163/zPz+pYVcwiYNTATBgNVHREEDDAKggh0ZXN0LmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSQAwRgIhAOuS1efyKndHbmZ6J1zY5+J+VrzWbqkBy21wQUCk8RWmAiEAy4y8iJVnmGpGljinVcZG4Q8bUG/kA+GEtF4kftw9NT0=" duration=2.539275ms duration-ns=2539275 fields.time="2026-09-08T04:41:31Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=WUNsQU54T2tMRjlaU2VXQ0cyRnVtR0xENm1XTUl0WDc path=/acme/acme/certificate/9l66vj03f22fnbtgfaFqnE6Ax7Qoaxbp protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=bce990d0-986f-4bb1-a361-1e8894141386 sans="map[dns:[test.foo]]" serial=33052316122435425258237573370461577890 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-09-08T04:40:31Z" valid-to="2026-12-07T04:41:31Z"592* Trying [2001:db8:1::3]:443...593* Host test.foo:443 was resolved.594* IPv6: 2001:db8:1::3595* IPv4: 192.168.1.3596* ALPN: curl offers h2,http/1.1597} [5 bytes data]598* TLSv1.3 (OUT), TLS handshake, Client hello (1):599} [1552 bytes data]600* SSL Trust Anchors:601* OpenSSL default paths (fallback)602{ [5 bytes data]603* TLSv1.3 (IN), TLS handshake, Server hello (2):604{ [1210 bytes data]605* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):606{ [1 bytes data]607* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):608{ [19 bytes data]609* TLSv1.3 (IN), TLS handshake, Certificate (11):610{ [1010 bytes data]611* TLSv1.3 (IN), TLS handshake, CERT verify (15):612{ [111 bytes data]613* TLSv1.3 (IN), TLS handshake, Finished (20):614{ [52 bytes data]615* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):616} [1 bytes data]617* TLSv1.3 (OUT), TLS handshake, Finished (20):618} [52 bytes data]619* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey620* ALPN: server accepted h2621* Server certificate:622* subject: CN=test.foo623* start date: Sep 8 04:41:24 2026 GMT624* expire date: Oct 8 04:41:24 2028 GMT625* issuer: CN=minica root ca 3da640626* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384627* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384628* subjectAltName: "test.foo" matches cert's "test.foo"629* OpenSSL verify result: 13630* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)631* closing connection #0632curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)633More details here: https://curl.se/docs/sslcerts.html634635curl failed to verify the legitimacy of the server and therefore could not636establish a secure connection to it. To learn more about this situation and637how to fix it, please visit the webpage mentioned above.638server # [335671.949847] server acme-order-renew-test.foo-start[332]: + mv domainhash.txt certificates/639server # [335671.951994] server acme-order-renew-test.foo-start[332]: + touch out/acme-success640server # [335671.954498] server acme-order-renew-test.foo-start[332]: + cmp -s certificates/test.foo.crt out/fullchain.pem641server # [335671.956128] server acme-order-renew-test.foo-start[332]: + touch out/renewed642server # [335671.958005] server acme-order-renew-test.foo-start[332]: + echo Installing new certificate643server # [335671.958005] server acme-order-renew-test.foo-start[332]: Installing new certificate644server # [335671.958005] server acme-order-renew-test.foo-start[332]: + cp -vp certificates/test.foo.crt out/fullchain.pem645server # [335671.959730] server acme-order-renew-test.foo-start[371]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'646server # [335671.960119] server acme-order-renew-test.foo-start[332]: + cp -vp certificates/test.foo.key out/key.pem647server # [335671.961781] server acme-order-renew-test.foo-start[372]: 'certificates/test.foo.key' -> 'out/key.pem'648server # [335671.962115] server acme-order-renew-test.foo-start[332]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem649server # [335671.963819] server acme-order-renew-test.foo-start[373]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'650server # [335671.964151] server acme-order-renew-test.foo-start[332]: + ln -sf fullchain.pem out/cert.pem651server # [335671.965892] server acme-order-renew-test.foo-start[332]: + cat out/key.pem out/fullchain.pem652server # [335671.968105] server acme-order-renew-test.foo-start[332]: + for fixpath in out certificates653server # [335671.968105] server acme-order-renew-test.foo-start[332]: + '[' -d out ']'654server # [335671.968105] server acme-order-renew-test.foo-start[332]: + chmod -R u=rwX,g=rX,o= out655server # [335671.970093] server acme-order-renew-test.foo-start[332]: + chown -R acme:nginx out656server # [335671.973038] server acme-order-renew-test.foo-start[332]: + for fixpath in out certificates657server # [335671.973038] server acme-order-renew-test.foo-start[332]: + '[' -d certificates ']'658server # [335671.973038] server acme-order-renew-test.foo-start[332]: + chmod -R u=rwX,g=rX,o= certificates659server # [335671.974891] server acme-order-renew-test.foo-start[332]: + chown -R acme:nginx certificates660server # [335671.978090] server acme-order-renew-test.foo-start[332]: + chmod -R u=rwX,g=,o= accounts/.661server # [335672.152864] server systemd[1]: Reloading Nginx Web Server...662server # [335672.158062] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.663server # [335672.158380] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.664server # [335672.650025] server nginx[389]: nginx: the configuration file /nix/store/1hcqj3qwgk1l5wg86fhwxyq6ddsn1ggy-nginx.conf syntax is ok665server # [335672.650540] server nginx[389]: nginx: configuration file /nix/store/1hcqj3qwgk1l5wg86fhwxyq6ddsn1ggy-nginx.conf test is successful666* Host test.foo:443 was resolved.667* IPv6: 2001:db8:1::3668* IPv4: 192.168.1.3669* Trying [2001:db8:1::3]:443...670* ALPN: curl offers h2,http/1.1671} [5 bytes data]672* TLSv1.3 (OUT), TLS handshake, Client hello (1):673} [1552 bytes data]674* SSL Trust Anchors:675* OpenSSL default paths (fallback)676{ [5 bytes data]677* TLSv1.3 (IN), TLS handshake, Server hello (2):678{ [1210 bytes data]679* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):680{ [1 bytes data]681* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):682{ [19 bytes data]683* TLSv1.3 (IN), TLS handshake, Certificate (11):684{ [932 bytes data]685* TLSv1.3 (IN), TLS handshake, CERT verify (15):686{ [79 bytes data]687* TLSv1.3 (IN), TLS handshake, Finished (20):688{ [52 bytes data]689* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):690} [1 bytes data]691* TLSv1.3 (OUT), TLS handshake, Finished (20):692} [52 bytes data]693* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey694* ALPN: server accepted h2695* Server certificate:696* subject: CN=test.foo697* start date: Sep 8 04:40:31 2026 GMT698* expire date: Dec 7 04:41:31 2026 GMT699* issuer: CN=Clan Intermediate CA700* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256701* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256702* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256703* subjectAltName: "test.foo" matches cert's "test.foo"704* OpenSSL verify result: 0705* SSL certificate verified via OpenSSL.706* Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 50752 707 % Total % Received % Xferd Average Speed Time Time Time Current708 Dload Upload Total Spent Left Speed709 0 0 0 0 0 0 0 0 0* using HTTP/2710* [HTTP/2] [1] OPENED stream for https://test.foo/711* [HTTP/2] [1] [:method: GET]712* [HTTP/2] [1] [:scheme: https]713* [HTTP/2] [1] [:authority: test.foo]714* [HTTP/2] [1] [:path: /]715* [HTTP/2] [1] [user-agent: curl/8.21.0]716* [HTTP/2] [1] [accept: */*]717} [5 bytes data]718719720721722723* Request completely sent off724{ [5 bytes data]725* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):726{ [265 bytes data]727* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):728{ [265 bytes data]729730731732733734735736{ [5 bytes data]737100 20 100 20 0 0 653 0 0738* Connection #0 to host test.foo:443 left intact739client: (finished: waiting for success: curl -v https://test.foo, in 2.16 seconds)740client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2741Certificate:742 Data:743 Version: 3 (0x2)744 Serial Number:745 18:dd:a5:00:41:84:72:91:51:b4:a7:54:2f:dc:62:a2746 Signature Algorithm: ecdsa-with-SHA256747 Issuer: CN=Clan Intermediate CA748 Validity749 Not Before: Sep 8 04:40:31 2026 GMT750 Not After : Dec 7 04:41:31 2026 GMT751 Subject: CN=test.foo752 Subject Public Key Info:753 Public Key Algorithm: id-ecPublicKey754 Public-Key: (256 bit)755 pub:756 04:a7:01:0a:df:85:6c:7e:69:b4:ad:35:c6:dd:4e:757 6e:28:f6:f2:38:7a:48:0d:a5:d2:2b:c1:3f:2f:83:758 f6:0c:dc:e7:97:7b:10:b9:2f:3d:8c:ca:6a:42:83:759 25:44:53:d0:35:ea:79:03:26:5f:cf:4b:45:2e:ee:760 87:26:97:48:ab761 ASN1 OID: prime256v1762 NIST CURVE: P-256763 X509v3 extensions:764 X509v3 Key Usage: critical765 Digital Signature766 X509v3 Extended Key Usage: 767 TLS Web Server Authentication, TLS Web Client Authentication768 X509v3 Subject Key Identifier: 769 A7:9F:25:6D:3B:DC:A8:8A:5A:59:82:5D:6D:4B:27:23:68:74:9D:40770 X509v3 Authority Key Identifier: 771 3E:C0:2D:A1:11:4E:5E:F7:5E:B7:FF:33:F3:FA:96:15:73:08:98:35772 X509v3 Subject Alternative Name: 773 DNS:test.foo774 1.3.6.1.4.1.37476.9000.64.1: 775 0......acme..776 Signature Algorithm: ecdsa-with-SHA256777 Signature Value:778 30:46:02:21:00:eb:92:d5:e7:f2:2a:77:47:6e:66:7a:27:5c:779 d8:e7:e2:7e:56:bc:d6:6e:a9:01:cb:6d:70:41:40:a4:f1:15:780 a6:02:21:00:cb:8c:bc:88:95:67:98:6a:46:96:38:a7:55:c6:781 46:e1:0f:1b:50:6f:e4:03:e1:84:b4:5e:24:7e:dc:3d:35:3d782client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.05 seconds)783(finished: run the VM test script, in 12.14 seconds)784test script finished in 12.22s785cleanup786kill NspawnMachine (pid 53)787server # [335673.166205] server systemd[1]: Reloaded Nginx Web Server.788kill NspawnMachine (pid 54)789Container ca terminated by signal KILL.790kill NspawnMachine (pid 55)791Container client terminated by signal KILL.792Container server terminated by signal KILL.793(finished: cleanup, in 0.49 seconds)