Machine state will be reset. To keep it, pass --keep-machine-state start all VLans (finished: start all VLans, in 0.00 seconds) Test will time out and terminate in 3600.0 seconds run the VM test script additionally exposed symbols: ca, client, server, vlan1, start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh start all VMs ca: systemd-nspawn running (pid 53) client: systemd-nspawn running (pid 55) server: systemd-nspawn running (pid 56) ca: Waiting for journal at /build/vm-state-ca/var/log/journal... server: Waiting for journal at /build/vm-state-server/var/log/journal... client: Waiting for journal at /build/vm-state-client/var/log/journal... (finished: start all VMs, in 0.00 seconds) nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. ░ Spawning container server on /build/vm-state-server. ░ Spawning container client on /build/vm-state-client. Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. ░ Spawning container ca on /build/vm-state-ca. server # No journal boot entry found for the specified boot (+0). client # No journal boot entry found for the specified boot (+0). ca # No journal boot entry found for the specified boot (+0). server # [423617.432905] server systemd-journald[69]: Journal started server # [423617.432963] server systemd-journald[69]: Runtime Journal (/run/log/journal/3d9996a2d23b4c8f816d99f757cb7e56) is 8M, max 2.5G, 2.4G free. server # [423617.440246] server systemd[1]: Starting Flush Journal to Persistent Storage... server # [423617.441064] server systemd[1]: Starting Network Name Resolution... server # [423617.441728] server systemd[1]: Starting Create Static Device Nodes in /dev... server # [423617.449658] server systemd-journald[69]: Time spent on flushing to /var/log/journal/3d9996a2d23b4c8f816d99f757cb7e56 is 1.657ms for 5 entries. server # [423617.449658] server systemd-journald[69]: System Journal (/var/log/journal/3d9996a2d23b4c8f816d99f757cb7e56) is 8M, max 4G, 3.9G free. server # [423617.460619] server systemd[1]: Finished Create Static Device Nodes in /dev. server # [423617.461274] server systemd[1]: Reached target Preparation for Local File Systems. server # [423617.461401] server systemd[1]: Reached target Local File Systems. server # [423617.462247] server systemd[1]: Listening on Boot Loader Control Service Socket. server # [423617.462292] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container server # [423617.463120] server systemd[1]: Starting Save Transient machine-id to Disk... server # [423617.463155] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys server # [423617.515582] server systemd[1]: Finished Flush Journal to Persistent Storage. server # [423617.516649] server systemd[1]: Starting Create System Files and Directories... server # [423617.532526] server systemd-tmpfiles[134]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted server # [423617.532712] server systemd-tmpfiles[134]: fchmod() of /var/log/journal failed: Operation not permitted server # [423617.532831] server systemd-tmpfiles[134]: fchmod() of /var/log/journal/3d9996a2d23b4c8f816d99f757cb7e56 failed: Operation not permitted server # [423617.533013] server systemd-tmpfiles[134]: fchmod() of /run/log/journal failed: Operation not permitted server # [423617.535005] server systemd[1]: Finished Create System Files and Directories. server # [423617.536241] server systemd[1]: Starting Rebuild Journal Catalog... server # [423617.537043] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... server # [423617.551250] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. server # [423617.556769] server systemd[1]: Finished Rebuild Journal Catalog. server # [423617.558083] server systemd[1]: Starting Update is Completed... server # [423617.570023] server systemd[1]: Finished Update is Completed. server # [423617.601960] server systemd[1]: Finished Firewall. server # [423617.602113] server systemd[1]: Reached target Preparation for Network. server # [423617.602341] server systemd[1]: Listening on Network Management Resolve Hook Socket. server # [423617.603362] server systemd[1]: Starting Network Management... server # [423617.999324] server systemd[1]: Finished Save Transient machine-id to Disk. server # [423618.068737] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted server # [423618.068833] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted server # [423618.079753] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. ca # [423617.432036] ca systemd-journald[77]: Journal started server # [423618.079923] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. ca # [423617.432096] ca systemd-journald[77]: Runtime Journal (/run/log/journal/9c4c675b61f34b578fd7739b315e3598) is 8M, max 2.5G, 2.4G free. server # [423618.080096] server systemd-networkd[186]: lo: Link UP ca # [423617.440568] ca systemd[1]: Starting Flush Journal to Persistent Storage... server # [423618.080099] server systemd-networkd[186]: lo: Gained carrier ca # [423617.441401] ca systemd[1]: Starting Network Name Resolution... server # [423618.080292] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network. ca # [423617.442026] ca systemd[1]: Starting Create Static Device Nodes in /dev... server # [423618.080768] server systemd-networkd[186]: eth1: Link UP ca # [423617.452324] ca systemd-journald[77]: Time spent on flushing to /var/log/journal/9c4c675b61f34b578fd7739b315e3598 is 1.965ms for 5 entries. server # [423618.080820] server systemd[1]: Started Network Management. ca # [423617.452324] ca systemd-journald[77]: System Journal (/var/log/journal/9c4c675b61f34b578fd7739b315e3598) is 8M, max 4G, 3.9G free. server # [423618.081071] server systemd-networkd[186]: eth1: Gained carrier ca # [423617.460660] ca systemd[1]: Finished Create Static Device Nodes in /dev. server # [423618.082695] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... ca # [423617.461352] ca systemd[1]: Reached target Preparation for Local File Systems. server # [423618.129890] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. ca # [423617.461475] ca systemd[1]: Reached target Local File Systems. server # [423618.226715] server systemd-resolved[89]: Positive Trust Anchors: ca # [423617.462337] ca systemd[1]: Listening on Boot Loader Control Service Socket. server # [423618.226727] server systemd-resolved[89]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d ca # [423617.462390] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container server # [423618.226730] server systemd-resolved[89]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 ca # [423617.463332] ca systemd[1]: Starting Save Transient machine-id to Disk... server # [423618.226763] server systemd-resolved[89]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test ca # [423617.463370] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys server # [423618.248714] server systemd-resolved[89]: Using system hostname 'server'. ca # [423617.517808] ca systemd[1]: Finished Flush Journal to Persistent Storage. server # [423618.250078] server systemd[1]: Started Network Name Resolution. ca # [423617.519399] ca systemd[1]: Starting Create System Files and Directories... server # [423618.250174] server systemd[1]: Reached target Network. ca # [423617.534398] ca systemd-tmpfiles[143]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted server # [423618.250253] server systemd[1]: Reached target Network is Online. ca # [423617.534589] ca systemd-tmpfiles[143]: fchmod() of /var/log/journal failed: Operation not permitted server # [423618.250306] server systemd[1]: Reached target System Initialization. ca # [423617.534709] ca systemd-tmpfiles[143]: fchmod() of /var/log/journal/9c4c675b61f34b578fd7739b315e3598 failed: Operation not permitted server # [423618.250580] server systemd[1]: Started Renew ACME Certificate for test.foo. ca # [423617.534894] ca systemd-tmpfiles[143]: fchmod() of /run/log/journal failed: Operation not permitted server # [423618.250619] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container ca # [423617.536328] ca systemd[1]: Finished Create System Files and Directories. server # [423618.250646] server systemd[1]: Started Daily Cleanup of Temporary Directories. ca # [423617.537421] ca systemd[1]: Starting Rebuild Journal Catalog... server # [423618.250668] server systemd[1]: Reached target Timer Units. ca # [423617.538117] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... server # [423618.250811] server systemd[1]: Listening on D-Bus System Message Bus Socket. ca # [423617.550434] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. server # [423618.250942] server systemd[1]: Listening on Nix Daemon Socket. ca # [423617.556670] ca systemd[1]: Finished Rebuild Journal Catalog. server # [423618.251085] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. ca # [423617.558101] ca systemd[1]: Starting Update is Completed... server # [423618.251111] server systemd[1]: Reached target Socket Units. ca # [423617.569944] ca systemd[1]: Finished Update is Completed. server # [423618.251159] server systemd[1]: Reached target Basic System. ca # [423617.598400] ca systemd[1]: Finished Firewall. server # [423618.252808] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... ca # [423617.598630] ca systemd[1]: Reached target Preparation for Network. client # [423617.423738] client systemd-journald[69]: Journal started server # [423618.253845] server systemd[1]: Starting Import lastlog data into lastlog2 database... ca # [423617.598986] ca systemd[1]: Listening on Network Management Resolve Hook Socket. server # [423618.253888] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem ca # [423617.600490] ca systemd[1]: Starting Network Management... client # [423617.423797] client systemd-journald[69]: Runtime Journal (/run/log/journal/ce5034a360474b65ac0261d50422b2ea) is 8M, max 2.5G, 2.4G free. ca # [423617.999303] ca systemd[1]: Finished Save Transient machine-id to Disk. client # [423617.427567] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. server # [423618.254986] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... ca # [423618.092157] ca systemd-networkd[194]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted server # [423618.256525] server systemd[1]: Starting D-Bus System Message Bus... client # [423617.436431] client systemd[1]: Starting Flush Journal to Persistent Storage... server # [423618.319349] server systemd[1]: Finished Import lastlog data into lastlog2 database. ca # [423618.092249] ca systemd-networkd[194]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted server # [423618.419310] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. client # [423617.437329] client systemd[1]: Starting Network Name Resolution... server # [423618.426313] server acme-setup-privileged[192]: + set -euo pipefail ca # [423618.099908] ca systemd-networkd[194]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. server # [423618.426313] server acme-setup-privileged[192]: + cd /var/lib/acme client # [423617.438137] client systemd[1]: Starting Create Static Device Nodes in /dev... server # [423618.426728] server acme-setup-privileged[192]: + chmod -R u=rwX,g=,o= .lego/accounts ca # [423618.100091] ca systemd-networkd[194]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. server # [423618.427908] server acme-setup-privileged[192]: + chown -R acme .lego/accounts client # [423617.448013] client systemd-journald[69]: Time spent on flushing to /var/log/journal/ce5034a360474b65ac0261d50422b2ea is 1.677ms for 6 entries. server # [423618.429513] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo ca # [423618.100238] ca systemd-networkd[194]: lo: Link UP server # [423618.429537] server acme-setup-privileged[192]: + '[' -d test.foo ']' client # [423617.448013] client systemd-journald[69]: System Journal (/var/log/journal/ce5034a360474b65ac0261d50422b2ea) is 8M, max 4G, 3.9G free. server # [423618.429537] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo ca # [423618.100242] ca systemd-networkd[194]: lo: Gained carrier server # [423618.429579] server acme-setup-privileged[192]: + '[' -d .lego/test.foo ']' client # [423617.455622] client systemd[1]: Finished Create Static Device Nodes in /dev. server # [423618.465714] server nsncd[194]: Sep 09 05:07:18.451 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" ca # [423618.100409] ca systemd-networkd[194]: eth1: Configuring with /etc/systemd/network/40-eth1.network. server # [423618.465698] server systemd[1]: Started Name Service Cache Daemon (nsncd). client # [423617.455880] client systemd[1]: Reached target Preparation for Local File Systems. server # [423618.465806] server systemd[1]: Reached target Host and Network Name Lookups. ca # [423618.100830] ca systemd[1]: Started Network Management. server # [423618.465906] server systemd[1]: Reached target User and Group Name Lookups. client # [423617.455974] client systemd[1]: Reached target Local File Systems. server # [423618.469412] server systemd[1]: Starting User Login Management... ca # [423618.120322] ca systemd-networkd[194]: eth1: Link UP server # [423618.470845] server systemd[1]: Starting Permit User Sessions... client # [423617.456742] client systemd[1]: Listening on Boot Loader Control Service Socket. ca # [423618.120631] ca systemd-networkd[194]: eth1: Gained carrier client # [423617.456790] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container ca # [423618.120665] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... client # [423617.457660] client systemd[1]: Starting Save Transient machine-id to Disk... ca # [423618.142004] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. client # [423617.457698] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys ca # [423618.240170] ca systemd-resolved[96]: Positive Trust Anchors: client # [423617.517799] client systemd[1]: Finished Flush Journal to Persistent Storage. ca # [423618.240181] ca systemd-resolved[96]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d client # [423617.519572] client systemd[1]: Starting Create System Files and Directories... ca # [423618.240185] ca systemd-resolved[96]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 client # [423617.535013] client systemd-tmpfiles[137]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted ca # [423618.240219] ca systemd-resolved[96]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test client # [423617.535201] client systemd-tmpfiles[137]: fchmod() of /var/log/journal failed: Operation not permitted ca # [423618.261996] ca systemd-resolved[96]: Using system hostname 'ca'. client # [423617.535332] client systemd-tmpfiles[137]: fchmod() of /var/log/journal/ce5034a360474b65ac0261d50422b2ea failed: Operation not permitted ca # [423618.263360] ca systemd[1]: Started Network Name Resolution. client # [423617.535523] client systemd-tmpfiles[137]: fchmod() of /run/log/journal failed: Operation not permitted ca # [423618.263460] ca systemd[1]: Reached target Network. client # [423617.536411] client systemd[1]: Finished Create System Files and Directories. ca # [423618.263542] ca systemd[1]: Reached target Network is Online. client # [423617.538038] client systemd[1]: Starting Rebuild Journal Catalog... ca # [423618.263598] ca systemd[1]: Reached target System Initialization. client # [423617.538878] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... ca # [423618.263858] ca systemd[1]: Started Renew ACME Certificate for ca.foo. client # [423617.554064] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. ca # [423618.263891] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container client # [423617.561800] client systemd[1]: Finished Rebuild Journal Catalog. ca # [423618.263920] ca systemd[1]: Started Daily Cleanup of Temporary Directories. client # [423617.562863] client systemd[1]: Starting Update is Completed... ca # [423618.263942] ca systemd[1]: Reached target Timer Units. client # [423617.573408] client systemd[1]: Finished Update is Completed. ca # [423618.264123] ca systemd[1]: Listening on D-Bus System Message Bus Socket. client # [423617.588661] client systemd[1]: Finished Firewall. ca # [423618.264259] ca systemd[1]: Listening on Nix Daemon Socket. client # [423617.588826] client systemd[1]: Reached target Preparation for Network. ca # [423618.264397] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. client # [423617.589060] client systemd[1]: Listening on Network Management Resolve Hook Socket. ca # [423618.264422] ca systemd[1]: Reached target Socket Units. client # [423617.590170] client systemd[1]: Starting Network Management... ca # [423618.264478] ca systemd[1]: Reached target Basic System. client # [423617.999293] client systemd[1]: Finished Save Transient machine-id to Disk. ca # [423618.304689] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... client # [423618.122474] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted ca # [423618.306107] ca systemd[1]: Starting Import lastlog data into lastlog2 database... client # [423618.122573] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted client # [423618.129765] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. client # [423618.129932] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. client # [423618.130081] client systemd-networkd[182]: lo: Link UP client # [423618.130085] client systemd-networkd[182]: lo: Gained carrier client # [423618.130256] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network. client # [423618.130703] client systemd[1]: Started Network Management. client # [423618.130751] client systemd-networkd[182]: eth1: Link UP client # [423618.131059] client systemd-networkd[182]: eth1: Gained carrier client # [423618.132357] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... client # [423618.162321] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. client # [423618.229394] client systemd-resolved[90]: Positive Trust Anchors: client # [423618.229403] client systemd-resolved[90]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d client # [423618.229407] client systemd-resolved[90]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 client # [423618.229440] client systemd-resolved[90]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test client # [423618.251034] client systemd-resolved[90]: Using system hostname 'client'. client # [423618.252825] client systemd[1]: Started Network Name Resolution. client # [423618.252916] client systemd[1]: Reached target Network. client # [423618.252992] client systemd[1]: Reached target System Initialization. client # [423618.253053] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container client # [423618.253089] client systemd[1]: Started Daily Cleanup of Temporary Directories. client # [423618.253112] client systemd[1]: Reached target Timer Units. client # [423618.253342] client systemd[1]: Listening on D-Bus System Message Bus Socket. client # [423618.253496] client systemd[1]: Listening on Nix Daemon Socket. client # [423618.253633] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. client # [423618.253664] client systemd[1]: Reached target Socket Units. client # [423618.253712] client systemd[1]: Reached target Basic System. client # [423618.254892] client systemd[1]: Starting Import lastlog data into lastlog2 database... client # [423618.255967] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... client # [423618.257457] client systemd[1]: Starting D-Bus System Message Bus... client # [423618.321343] client systemd[1]: Finished Import lastlog data into lastlog2 database. client # [423618.409606] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. client # [423618.475008] client nsncd[189]: Sep 09 05:07:18.460 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" client # [423618.475124] client systemd[1]: Started Name Service Cache Daemon (nsncd). client # [423618.475172] client systemd[1]: Reached target Host and Network Name Lookups. client # [423618.475230] client systemd[1]: Reached target User and Group Name Lookups. ca # [423618.306190] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem ca # [423618.307570] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... ca # [423618.309299] ca systemd[1]: Starting step-ca service... ca # [423618.311713] ca systemd[1]: Starting D-Bus System Message Bus... ca # [423618.326233] ca systemd[1]: Finished Import lastlog data into lastlog2 database. ca # [423618.423061] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. ca # [423618.441949] ca acme-setup-privileged[200]: + set -euo pipefail client # [423618.476797] client systemd[1]: Starting User Login Management... ca # [423618.441949] ca acme-setup-privileged[200]: + cd /var/lib/acme ca # [423618.441949] ca acme-setup-privileged[200]: + chmod -R u=rwX,g=,o= .lego/accounts ca # [423618.443398] ca acme-setup-privileged[200]: + chown -R acme .lego/accounts ca # [423618.444823] ca acme-setup-privileged[200]: + for fixpath in ca.foo .lego/ca.foo ca # [423618.444823] ca acme-setup-privileged[200]: + '[' -d ca.foo ']' ca # [423618.444956] ca acme-setup-privileged[200]: + for fixpath in ca.foo .lego/ca.foo ca # [423618.444956] ca acme-setup-privileged[200]: + '[' -d .lego/ca.foo ']' client # [423618.477606] client systemd[1]: Starting Permit User Sessions... client # [423618.488628] client systemd[1]: Finished Permit User Sessions. client # [423618.489714] client systemd[1]: Started Console Getty. client # [423618.489763] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 client # [423618.489780] client systemd[1]: Reached target Login Prompts. server # [423618.481240] server systemd[1]: Finished Permit User Sessions. server # [423618.483313] server systemd[1]: Started Console Getty. server # [423618.483365] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 server # [423618.483385] server systemd[1]: Reached target Login Prompts. ca # [423618.476545] ca nsncd[202]: Sep 09 05:07:18.462 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" ca # [423618.476318] ca systemd[1]: Started Name Service Cache Daemon (nsncd). ca # [423618.476378] ca systemd[1]: Reached target Host and Network Name Lookups. ca # [423618.476444] ca systemd[1]: Reached target User and Group Name Lookups. ca # [423618.477865] ca systemd[1]: Starting User Login Management... ca # [423618.478647] ca systemd[1]: Starting Permit User Sessions... ca # [423618.488416] ca systemd[1]: Finished Permit User Sessions. ca # [423618.489502] ca systemd[1]: Started Console Getty. ca # [423618.489545] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 ca # [423618.489566] ca systemd[1]: Reached target Login Prompts. server # [423618.566743] server dbus-broker-launch[195]: Looking up NSS user entry for 'systemd-timesync'... server # [423618.567414] server dbus-broker-launch[195]: NSS returned no entry for 'systemd-timesync' server # [423618.567414] server dbus-broker-launch[195]: Invalid user-name in /nix/store/fb9fkv4xj60yflm8pgkwj109ysiqv6y9-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" server # [423618.567808] server systemd[1]: Started D-Bus System Message Bus. server # [423618.575289] server dbus-broker-launch[195]: Ready ca # [423618.571071] ca dbus-broker-launch[206]: Looking up NSS user entry for 'systemd-timesync'... ca # [423618.571679] ca dbus-broker-launch[206]: NSS returned no entry for 'systemd-timesync' ca # [423618.571679] ca dbus-broker-launch[206]: Invalid user-name in /nix/store/krq5730hygnqgccm0vn905nahz484539-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" ca # [423618.572035] ca systemd[1]: Started D-Bus System Message Bus. ca # [423618.579775] ca dbus-broker-launch[206]: Ready client # [423618.589772] client dbus-broker-launch[190]: Looking up NSS user entry for 'systemd-timesync'... client # [423618.590702] client dbus-broker-launch[190]: NSS returned no entry for 'systemd-timesync' client # [423618.590702] client dbus-broker-launch[190]: Invalid user-name in /nix/store/i4syq4zsqasv8ffdwnv5zwlla4nascy0-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" client # [423618.591130] client systemd[1]: Started D-Bus System Message Bus. client # [423618.599077] client dbus-broker-launch[190]: Ready client # [423618.964146] client systemd-logind[205]: New seat seat0. client # [423618.964351] client systemd[1]: Started User Login Management. client # [423618.965921] client systemd[1]: Starting linger-users.service... client # [423619.010670] client systemd[1]: linger-users.service: Deactivated successfully. client # [423619.010976] client systemd[1]: Finished linger-users.service. client # [423619.011855] client systemd[1]: Reached target Multi-User System. client # [423619.012335] client systemd[1]: Startup finished in 2.043s. server # [423618.989418] server systemd-logind[220]: New seat seat0. server # [423618.989662] server systemd[1]: Started User Login Management. server # [423619.001009] server systemd[1]: Starting linger-users.service... server # [423619.014281] server acme-setup-start[208]: + set -euo pipefail server # [423619.014281] server acme-setup-start[208]: + test -e ca/key.pem server # [423619.014733] server acme-setup-start[208]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local server # [423619.015696] server systemd[1]: linger-users.service: Deactivated successfully. server # [423619.015773] server systemd[1]: Finished linger-users.service. server # [423619.036834] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. server # [423619.038556] server systemd[1]: Starting Ensure certificate for test.foo... ca # [423618.974525] ca systemd-logind[233]: New seat seat0. ca # [423618.974721] ca systemd[1]: Started User Login Management. ca # [423619.000756] ca systemd[1]: Starting linger-users.service... ca # [423619.014727] ca systemd[1]: linger-users.service: Deactivated successfully. ca # [423619.014851] ca systemd[1]: Finished linger-users.service. ca # [423619.023279] ca acme-setup-start[218]: + set -euo pipefail ca # [423619.023279] ca acme-setup-start[218]: + test -e ca/key.pem ca # [423619.023811] ca acme-setup-start[218]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local ca # [423619.045144] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. ca # [423619.047516] ca systemd[1]: Starting Ensure certificate for ca.foo... ca # [423619.153363] ca step-ca[203]: badger 2026/09/09 05:07:19 INFO: All 0 tables opened in 0s ca # [423619.160278] ca step-ca[203]: 2026/09/09 05:07:19 Building new tls configuration using step-ca x509 Signer Interface ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 Starting Smallstep CA/0.30.2 (linux/arm64) ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 Documentation: https://u.step.sm/docs/ca ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 Community Discord: https://u.step.sm/discord ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 Config file: /etc/smallstep/ca.json ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 The primary server URL is https://ca.foo:1443 ca # [423619.164805] ca step-ca[203]: 2026/09/09 05:07:19 Root certificates are available at https://ca.foo:1443/roots.pem ca # [423619.164805] ca step-ca[203]: 2026/09/09 05:07:19 X.509 Root Fingerprint: 032c1fb9b944e1d93c405b4ade61e18b575594ecc2ea3b5ae5824e6cd948d63e ca # [423619.165314] ca systemd[1]: Started step-ca service. ca # [423619.165557] ca step-ca[203]: 2026/09/09 05:07:19 Serving HTTPS on 0.0.0.0:1443 ... ca: must succeed: systemctl restart acme-order-renew-ca.foo.service ca # [423619.549412] ca acme-ca.foo-start[255]: Waiting to acquire lock in /run/acme/ ca # [423619.553927] ca acme-ca.foo-start[255]: + '[' -e out/acme-success ']' ca # [423619.554004] ca acme-ca.foo-start[255]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= ca # [423619.569333] ca acme-ca.foo-start[293]: + cd ca.foo ca # [423619.569914] ca acme-ca.foo-start[293]: + cp -vp cert.pem ../out/cert.pem ca # [423619.571046] ca acme-ca.foo-start[294]: 'cert.pem' -> '../out/cert.pem' ca # [423619.571379] ca acme-ca.foo-start[293]: + cp -vp key.pem ../out/key.pem ca # [423619.572643] ca acme-ca.foo-start[293]: 'key.pem' -> '../out/key.pem' ca # [423619.572924] ca acme-ca.foo-start[255]: + cat out/cert.pem ca/cert.pem server # [423619.526198] server acme-test.foo-start[245]: Waiting to acquire lock in /run/acme/ ca # [423619.574604] ca acme-ca.foo-start[255]: + cp ca/cert.pem out/chain.pem server # [423619.528871] server acme-test.foo-start[245]: + '[' -e out/acme-success ']' ca # [423619.576724] ca acme-ca.foo-start[255]: + cat out/key.pem out/fullchain.pem server # [423619.528871] server acme-test.foo-start[245]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= ca # [423619.578601] ca acme-ca.foo-start[255]: + for fixpath in out certificates server # [423619.543507] server acme-test.foo-start[255]: + cd test.foo ca # [423619.578601] ca acme-ca.foo-start[255]: + '[' -d out ']' server # [423619.544171] server acme-test.foo-start[255]: + cp -vp cert.pem ../out/cert.pem ca # [423619.578708] ca acme-ca.foo-start[255]: + chmod -R u=rwX,g=rX,o= out server # [423619.545358] server acme-test.foo-start[256]: 'cert.pem' -> '../out/cert.pem' ca # [423619.580250] ca acme-ca.foo-start[255]: + chown -R acme:nginx out server # [423619.545798] server acme-test.foo-start[255]: + cp -vp key.pem ../out/key.pem ca # [423619.583184] ca acme-ca.foo-start[255]: + for fixpath in out certificates server # [423619.547109] server acme-test.foo-start[255]: 'key.pem' -> '../out/key.pem' ca # [423619.583184] ca acme-ca.foo-start[255]: + '[' -d certificates ']' server # [423619.547396] server acme-test.foo-start[245]: + cat out/cert.pem ca/cert.pem ca # [423619.608467] ca systemd[1]: Finished Ensure certificate for ca.foo. server # [423619.549673] server acme-test.foo-start[245]: + cp ca/cert.pem out/chain.pem ca # [423619.610228] ca systemd[1]: Starting Nginx Web Server... server # [423619.551890] server acme-test.foo-start[245]: + cat out/key.pem out/fullchain.pem ca # [423619.777660] ca systemd-networkd[194]: eth1: Gained IPv6LL server # [423619.553873] server acme-test.foo-start[245]: + for fixpath in out certificates server # [423619.553901] server acme-test.foo-start[245]: + '[' -d out ']' server # [423619.553901] server acme-test.foo-start[245]: + chmod -R u=rwX,g=rX,o= out server # [423619.555772] server acme-test.foo-start[245]: + chown -R acme:nginx out server # [423619.559047] server acme-test.foo-start[245]: + for fixpath in out certificates server # [423619.559088] server acme-test.foo-start[245]: + '[' -d certificates ']' server # [423619.562162] server systemd[1]: Finished Ensure certificate for test.foo. server # [423619.564049] server systemd[1]: Starting Nginx Web Server... server # [423619.652209] server systemd-networkd[186]: eth1: Gained IPv6LL client # [423620.096274] client systemd-networkd[182]: eth1: Gained IPv6LL server # [423620.162815] server nginx-pre-start[267]: nginx: the configuration file /nix/store/vbja0ggj33nc6zf5lkzfrkd8ijv2r819-nginx.conf syntax is ok server # [423620.163144] server nginx-pre-start[267]: nginx: configuration file /nix/store/vbja0ggj33nc6zf5lkzfrkd8ijv2r819-nginx.conf test is successful server # [423620.184590] server systemd[1]: Started Nginx Web Server. server # [423620.185031] server systemd[1]: Reached target Multi-User System. server # [423620.187097] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... ca # [423620.164608] ca nginx-pre-start[305]: nginx: the configuration file /nix/store/xhml9fz6gx0h63h36sd1j5ba87wd00y2-nginx.conf syntax is ok ca # [423620.165038] ca nginx-pre-start[305]: nginx: configuration file /nix/store/xhml9fz6gx0h63h36sd1j5ba87wd00y2-nginx.conf test is successful ca # [423620.184626] ca systemd[1]: Started Nginx Web Server. ca # [423620.185160] ca systemd[1]: Reached target Multi-User System. ca # [423620.187255] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... ca # [423620.745202] ca acme-order-renew-ca.foo-start[308]: Waiting to acquire lock in /run/acme/ ca # [423620.747963] ca acme-order-renew-ca.foo-start[308]: + set -euo pipefail ca # [423620.748111] ca acme-order-renew-ca.foo-start[308]: + echo 88dc4fc401a6091a1bd9 ca # [423620.748209] ca acme-order-renew-ca.foo-start[308]: + cmp -s domainhash.txt certificates/domainhash.txt ca # [423620.749372] ca acme-order-renew-ca.foo-start[308]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run ca # [423620.764704] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 No key found for account none@none.tld. Generating a P256 key. ca # [423620.764987] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ca # [423620.791068] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration="88.641µs" duration-ns=88641 fields.time="2026-09-09T05:07:20Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a7822826-3018-42a5-9b07-58c65ed87e2b response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423620.791458] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] acme: Registering account for none@none.tld ca # [423620.796639] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=5.05051ms duration-ns=5050510 fields.time="2026-09-09T05:07:20Z" method=HEAD name=ca nonce=a1NOZTFvV0EwMW1GTVE3QTR3T1VJS0JwQllNaDE5ekc path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f8204dd1-21a9-4c49-a45f-82fa559c4973 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423620.798920] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=1.614983ms duration-ns=1614983 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=UWRiSFpOWUhNRHk0dGgxcFg5d3F5MlhxUnY5NURJYnc path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=60a79045-be90-426d-8dd4-e1ab2d714f53 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/6rCFQjDOYyVMijaE7Z6hHO9kQKSOwAKK/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: !!!! HEADS UP !!!! ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: Your account credentials have been saved in your ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: configuration directory at "accounts". ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: You should make a secure backup of this folder now. This ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: configuration directory will also contain private keys ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: generated by lego and certificates obtained from the ACME ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: server. Making regular backups of this folder is ideal. ca # [423620.799314] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate ca # [423620.802303] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=2.612396ms duration-ns=2612396 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=UFlsQ0JVcEpjU2ZkZEN3dEJLRnhDOXA1Q1EzZWtQdEo path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=6f15ef3e-8fee-4e7c-adda-a25e92760cc6 response="{\"id\":\"yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj\",\"status\":\"pending\",\"expires\":\"2026-09-10T05:07:20Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-09T05:06:20Z\",\"notAfter\":\"2026-12-08T05:07:20Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423620.865255] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=6.126405ms duration-ns=6126405 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=c1pFR2NYRUc1a0IwVWtOUDRmVlpvUWhaYUVhUlhOTUQ path=/acme/acme/authz/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=4f94032e-c03f-482b-882b-68667d1083bd response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"p9Ir8XApySkGvTwU7rIZkBP2HfBmZOqd\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/XUso3R2lIi1l4dTJo7Kr5QwDqW7q4MFT\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"p9Ir8XApySkGvTwU7rIZkBP2HfBmZOqd\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/WkXqgvhP2WIEgbF5GlFoGUfi7EucHRIK\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"p9Ir8XApySkGvTwU7rIZkBP2HfBmZOqd\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/9Nb6nKKtOso9R3UYv6Af60rtHWm8BQ0P\"}],\"wildcard\":false,\"expires\":\"2026-09-10T05:07:20Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423620.865543] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J ca # [423620.865543] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01 ca # [423620.865543] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: use http-01 solver ca # [423620.865543] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: Trying to solve HTTP-01 ca # [423620.870651] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=4.569423ms duration-ns=4569423 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=ZHZEWUVEaDFDM1FlWlJLTkRxOEJFVTVmTkNFNERCS1Q path=/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/WkXqgvhP2WIEgbF5GlFoGUfi7EucHRIK protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=81e9208e-dddc-4225-b1f7-bcf57d44943b response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"p9Ir8XApySkGvTwU7rIZkBP2HfBmZOqd\",\"validated\":\"2026-09-09T05:07:20Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/WkXqgvhP2WIEgbF5GlFoGUfi7EucHRIK\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423620.870990] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] The server validated our request ca # [423620.871069] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates ca # [423620.881126] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=8.806242ms duration-ns=8806242 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=U3Noek5YS3VBajM1dWJGOXkzWE1WWnJvNkR0OHljMno path=/acme/acme/order/yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=18db613c-a2c5-45e9-b991-50a16befbe73 response="{\"id\":\"yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj\",\"status\":\"valid\",\"expires\":\"2026-09-10T05:07:20Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-09T05:06:20Z\",\"notAfter\":\"2026-12-08T05:07:20Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/CIAUZ9S5ObswPej5z6HAFPaj3kIPtJJn\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423620.883725] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info certificate="MIIB1DCCAXqgAwIBAgIRAJkZQ9YJfffNZx1qy+Kxbz4wCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTA5MDUwNjIwWhcNMjYxMjA4MDUwNzIwWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQuaDY41NjXQXzmsP0mcL6nOvSZ6cgspYf+5Q3GRhwoDXE8hbMQBvgGCHJq9oWDvqmC4GWjbARRUiwcFlhur+avo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFKMtX7HcV76PemyeFC7iWPdvghq/MB8GA1UdIwQYMBaAFIyb39UByLb1OGgcnj4IHZWsJ3yFMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIgEmsZzYmjzdqU+SW3SiDGVWrwn+3DQtJOe0lpoWhXQO0CIQDz56V0XNfRZShfNH64mmL3JG6ajFH06vvSixWHgjvNvw==" duration=1.814106ms duration-ns=1814106 fields.time="2026-09-09T05:07:20Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=clVQNXRWY0lrdDlUMmtodkRqWUlqS0l3eVQwWU90MG8 path=/acme/acme/certificate/CIAUZ9S5ObswPej5z6HAFPaj3kIPtJJn protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=70787dcc-7f8a-451d-8f86-42643cde15ce sans="map[dns:[ca.foo]]" serial=203503066655763372988860342677697294142 size=1344 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-09-09T05:06:20Z" valid-to="2026-12-08T05:07:20Z" ca # [423620.884057] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] Server responded with a certificate. ca # [423620.889349] ca acme-order-renew-ca.foo-start[308]: + mv domainhash.txt certificates/ ca # [423620.891499] ca acme-order-renew-ca.foo-start[308]: + touch out/acme-success ca # [423620.893491] ca acme-order-renew-ca.foo-start[308]: + cmp -s certificates/ca.foo.crt out/fullchain.pem ca # [423620.894784] ca acme-order-renew-ca.foo-start[308]: + touch out/renewed ca # [423620.896411] ca acme-order-renew-ca.foo-start[308]: + echo Installing new certificate ca # [423620.896411] ca acme-order-renew-ca.foo-start[308]: Installing new certificate ca # [423620.896458] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.crt out/fullchain.pem ca # [423620.898041] ca acme-order-renew-ca.foo-start[353]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' ca # [423620.898317] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.key out/key.pem ca # [423620.900005] ca acme-order-renew-ca.foo-start[354]: 'certificates/ca.foo.key' -> 'out/key.pem' ca # [423620.900353] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem ca # [423620.901823] ca acme-order-renew-ca.foo-start[355]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' ca # [423620.902083] ca acme-order-renew-ca.foo-start[308]: + ln -sf fullchain.pem out/cert.pem ca # [423620.903712] ca acme-order-renew-ca.foo-start[308]: + cat out/key.pem out/fullchain.pem ca # [423620.905346] ca acme-order-renew-ca.foo-start[308]: + for fixpath in out certificates ca # [423620.905372] ca acme-order-renew-ca.foo-start[308]: + '[' -d out ']' ca # [423620.905372] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=rX,o= out ca # [423620.907049] ca acme-order-renew-ca.foo-start[308]: + chown -R acme:nginx out ca # [423620.910060] ca acme-order-renew-ca.foo-start[308]: + for fixpath in out certificates ca # [423620.910082] ca acme-order-renew-ca.foo-start[308]: + '[' -d certificates ']' ca # [423620.910110] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=rX,o= certificates ca # [423620.911800] ca acme-order-renew-ca.foo-start[308]: + chown -R acme:nginx certificates ca # [423620.914510] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=,o= accounts/. ca # [423621.068557] ca systemd[1]: Reloading Nginx Web Server... server # [423620.715872] server acme-order-renew-test.foo-start[270]: Waiting to acquire lock in /run/acme/ server # [423620.718375] server acme-order-renew-test.foo-start[270]: + set -euo pipefail server # [423620.718452] server acme-order-renew-test.foo-start[270]: + echo ad12aa6741ce4bd2c108 server # [423620.718563] server acme-order-renew-test.foo-start[270]: + cmp -s domainhash.txt certificates/domainhash.txt server # [423620.719810] server acme-order-renew-test.foo-start[270]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run server # [423620.750937] server acme-order-renew-test.foo-start[281]: 2026/09/09 05:07:20 No key found for account none@none.tld. Generating a P256 key. server # [423620.751302] server acme-order-renew-test.foo-start[281]: 2026/09/09 05:07:20 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key server # [423620.795395] server acme-order-renew-test.foo-start[281]: 2026/09/09 05:07:20 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority server # [423620.799648] server acme-order-renew-test.foo-start[270]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start. server # [423620.799648] server acme-order-renew-test.foo-start[270]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start. server # [423620.799718] server acme-order-renew-test.foo-start[270]: + exit 10 server # [423620.803007] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a server # [423620.803211] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'. server # [423620.808382] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo. server # [423620.808987] server systemd[1]: Startup finished in 3.845s. ca # [423621.073876] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. ca # [423621.074178] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. ca # [423621.737133] ca nginx[371]: nginx: the configuration file /nix/store/xhml9fz6gx0h63h36sd1j5ba87wd00y2-nginx.conf syntax is ok ca # [423621.737473] ca nginx[371]: nginx: configuration file /nix/store/xhml9fz6gx0h63h36sd1j5ba87wd00y2-nginx.conf test is successful ca # [423622.282739] ca systemd[1]: Reloaded Nginx Web Server. ca # [423622.283539] ca systemd[1]: Startup finished in 5.301s. ca # [423622.635720] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 3.99 seconds) ca # [423623.255350] ca acme-order-renew-ca.foo-start[386]: Waiting to acquire lock in /run/acme/ ca # [423623.257857] ca acme-order-renew-ca.foo-start[386]: + set -euo pipefail ca # [423623.257936] ca acme-order-renew-ca.foo-start[386]: + echo 88dc4fc401a6091a1bd9 ca # [423623.258051] ca acme-order-renew-ca.foo-start[386]: + cmp -s domainhash.txt certificates/domainhash.txt ca # [423623.259418] ca acme-order-renew-ca.foo-start[386]: + '[' -e certificates/ca.foo.key ']' ca # [423623.259418] ca acme-order-renew-ca.foo-start[386]: + '[' -e certificates/ca.foo.crt ']' ca # [423623.259835] ca acme-order-renew-ca.foo-start[394]: ++ find accounts -name none@none.tld.key ca # [423623.262108] ca acme-order-renew-ca.foo-start[386]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']' ca # [423623.262157] ca acme-order-renew-ca.foo-start[386]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic ca # [423623.302407] ca step-ca[203]: time="2026-09-09T05:07:23Z" level=info duration="74.682µs" duration-ns=74682 fields.time="2026-09-09T05:07:23Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1f2d0679-31d7-4e85-b916-70baaa7a2c6e response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423623.302880] ca acme-order-renew-ca.foo-start[395]: 2026/09/09 05:07:23 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint ca # [423623.302880] ca acme-order-renew-ca.foo-start[395]: 2026/09/09 05:07:23 [INFO] [ca.foo] The certificate expires at 2026-12-08T05:07:20Z, the renewal can be performed in 1439h59m36.711435541s: no renewal. ca # [423623.303432] ca acme-order-renew-ca.foo-start[386]: + mv domainhash.txt certificates/ ca # [423623.305113] ca acme-order-renew-ca.foo-start[386]: + touch out/acme-success ca # [423623.306548] ca acme-order-renew-ca.foo-start[386]: + cmp -s certificates/ca.foo.crt out/fullchain.pem ca # [423623.307633] ca acme-order-renew-ca.foo-start[386]: + for fixpath in out certificates ca # [423623.307664] ca acme-order-renew-ca.foo-start[386]: + '[' -d out ']' ca # [423623.307664] ca acme-order-renew-ca.foo-start[386]: + chmod -R u=rwX,g=rX,o= out ca # [423623.309174] ca acme-order-renew-ca.foo-start[386]: + chown -R acme:nginx out ca # [423623.311627] ca acme-order-renew-ca.foo-start[386]: + for fixpath in out certificates ca # [423623.311659] ca acme-order-renew-ca.foo-start[386]: + '[' -d certificates ']' ca # [423623.311659] ca acme-order-renew-ca.foo-start[386]: + chmod -R u=rwX,g=rX,o= certificates ca # [423623.313390] ca acme-order-renew-ca.foo-start[386]: + chown -R acme:nginx certificates ca # [423623.315920] ca acme-order-renew-ca.foo-start[386]: + chmod -R u=rwX,g=,o= accounts/. ca # [423623.448909] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. ca # [423623.449286] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. server: must succeed: systemctl restart acme-test.foo.service server # [423626.472329] server systemd[1]: acme-test.foo.service: Deactivated successfully. server # [423626.472701] server systemd[1]: Stopped Ensure certificate for test.foo. server # [423626.474053] server systemd[1]: Stopping Ensure certificate for test.foo... server # [423626.476552] server systemd[1]: Starting Ensure certificate for test.foo... server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.62 seconds) client: waiting for success: curl -v https://test.foo * Host test.foo:443 was resolved. * IPv6: 2001:db8:1::3 * IPv4: 192.168.1.3 * Trying [2001:db8:1::3]:443... * ALPN: curl offers h2,http/1.1 } [5 bytes data] * TLSv1.3 (OUT), TLS handshake, Client hello (1): } [1552 bytes data] * SSL Trust Anchors: * OpenSSL default paths (fallback) { [5 bytes data] * TLSv1.3 (IN), TLS handshake, Server hello (2): { [1210 bytes data] * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): { [19 bytes data] * TLSv1.3 (IN), TLS handshake, Certificate (11): { [1010 bytes data] * TLSv1.3 (IN), TLS handshake, CERT verify (15): { [110 bytes data] * TLSv1.3 (IN), TLS handshake, Finished (20): { [52 bytes data] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.3 (OUT), TLS handshake, Finished (20): } [52 bytes data] * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey * ALPN: server accepted h2 * Server certificate: * subject: CN=test.foo * start date: Sep 9 05:07:19 2026 GMT * expire date: Oct 9 05:07:19 2028 GMT * issuer: CN=minica root ca 6fa36f * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 * subjectAltName: "test.foo" matches cert's "test.foo" * OpenSSL verify result: 13 * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) * closing connection #0 curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above. server # [423627.034730] server acme-test.foo-start[316]: Waiting to acquire lock in /run/acme/ server # [423627.038460] server acme-test.foo-start[316]: + '[' -e out/acme-success ']' server # [423627.038507] server acme-test.foo-start[316]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= server # [423627.054360] server acme-test.foo-start[326]: + cd test.foo server # [423627.054642] server acme-test.foo-start[326]: + cp -vp cert.pem ../out/cert.pem server # [423627.056823] server acme-test.foo-start[327]: 'cert.pem' -> '../out/cert.pem' server # [423627.057118] server acme-test.foo-start[326]: + cp -vp key.pem ../out/key.pem server # [423627.058679] server acme-test.foo-start[326]: 'key.pem' -> '../out/key.pem' server # [423627.058964] server acme-test.foo-start[316]: + cat out/cert.pem ca/cert.pem server # [423627.060877] server acme-test.foo-start[316]: + cp ca/cert.pem out/chain.pem server # [423627.062959] server acme-test.foo-start[316]: + cat out/key.pem out/fullchain.pem server # [423627.065527] server acme-test.foo-start[316]: + for fixpath in out certificates server # [423627.065566] server acme-test.foo-start[316]: + '[' -d out ']' server # [423627.065566] server acme-test.foo-start[316]: + chmod -R u=rwX,g=rX,o= out server # [423627.067222] server acme-test.foo-start[316]: + chown -R acme:nginx out server # [423627.071080] server acme-test.foo-start[316]: + for fixpath in out certificates server # [423627.071120] server acme-test.foo-start[316]: + '[' -d certificates ']' server # [423627.075071] server systemd[1]: Finished Ensure certificate for test.foo. server # [423627.079998] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... server # [423627.627102] server acme-order-renew-test.foo-start[334]: Waiting to acquire lock in /run/acme/ server # [423627.630173] server acme-order-renew-test.foo-start[334]: + set -euo pipefail server # [423627.630269] server acme-order-renew-test.foo-start[334]: + echo ad12aa6741ce4bd2c108 server # [423627.630362] server acme-order-renew-test.foo-start[334]: + cmp -s domainhash.txt certificates/domainhash.txt server # [423627.631801] server acme-order-renew-test.foo-start[334]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run server # [423627.689976] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] acme: Registering account for none@none.tld server # [423627.735318] server acme-order-renew-test.foo-start[342]: !!!! HEADS UP !!!! server # [423627.735318] server acme-order-renew-test.foo-start[342]: Your account credentials have been saved in your server # [423627.735318] server acme-order-renew-test.foo-start[342]: configuration directory at "accounts". server # [423627.735318] server acme-order-renew-test.foo-start[342]: You should make a secure backup of this folder now. This server # [423627.735318] server acme-order-renew-test.foo-start[342]: configuration directory will also contain private keys server # [423627.735318] server acme-order-renew-test.foo-start[342]: generated by lego and certificates obtained from the ACME server # [423627.735318] server acme-order-renew-test.foo-start[342]: server. Making regular backups of this folder is ideal. server # [423627.735554] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: Obtaining bundled SAN certificate server # [423627.815070] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B server # [423627.815070] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01 server # [423627.815070] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: use http-01 solver server # [423627.815070] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: Trying to solve HTTP-01 server # [423627.825732] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] The server validated our request server # [423627.840145] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: Validations succeeded; requesting certificates server # [423627.860241] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] Server responded with a certificate. server # [423627.866288] server acme-order-renew-test.foo-start[334]: + mv domainhash.txt certificates/ server # [423627.868212] server acme-order-renew-test.foo-start[334]: + touch out/acme-success server # [423627.869891] server acme-order-renew-test.foo-start[334]: + cmp -s certificates/test.foo.crt out/fullchain.pem server # [423627.870971] server acme-order-renew-test.foo-start[334]: + touch out/renewed server # [423627.873049] server acme-order-renew-test.foo-start[334]: + echo Installing new certificate server # [423627.873049] server acme-order-renew-test.foo-start[334]: Installing new certificate server # [423627.873111] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.crt out/fullchain.pem server # [423627.874680] server acme-order-renew-test.foo-start[373]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' server # [423627.874939] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.key out/key.pem server # [423627.876538] server acme-order-renew-test.foo-start[374]: 'certificates/test.foo.key' -> 'out/key.pem' server # [423627.876727] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem server # [423627.878011] server acme-order-renew-test.foo-start[375]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' server # [423627.878195] server acme-order-renew-test.foo-start[334]: + ln -sf fullchain.pem out/cert.pem ca # [423627.689428] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration="69.281µs" duration-ns=69281 fields.time="2026-09-09T05:07:27Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=833dbada-6e5c-46fc-a2ff-9f4a1c649ccf response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423627.726112] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=32.680693ms duration-ns=32680693 fields.time="2026-09-09T05:07:27Z" method=HEAD name=ca nonce=Y0IwYzVIeGZpeU5XbmcxQWZBa0ZGS013S2xiWXZ1VEY path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=01875a49-e3dd-4258-964e-f4062c88e098 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423627.734753] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=4.927309ms duration-ns=4927309 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=S2dnYjRwVTN2VU1FS3R0d0czdkw3Q2MxMnBkNnVUdVY path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=97fed373-c5fe-4992-aef0-134d39f58542 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/zk5Iq9g6SzZWv5cqS4GHNoq7EskNTewT/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423627.741155] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=3.310886ms duration-ns=3310886 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=Q3lHZGpsa1ZTVExlTThYcm4ybUFlS29vMzlXeXVXeW8 path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=56590e96-4065-4642-91ec-7deee9f30e0c response="{\"id\":\"DpDXKbzcoEcsk1113H9vGri8xDi74QND\",\"status\":\"pending\",\"expires\":\"2026-09-10T05:07:27Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-09T05:06:27Z\",\"notAfter\":\"2026-12-08T05:07:27Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B\"],\"finalize\":\"https://ca.foo/acme/acme/order/DpDXKbzcoEcsk1113H9vGri8xDi74QND/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423627.814547] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=13.931154ms duration-ns=13931154 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=RlcxYWdiYUdKRlNaVW9MTVhCYUZXekpncGFaM0VOV2c path=/acme/acme/authz/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B protocol=HTTP/1.1 referer= remote-address="::1" request-id=71774919-408b-4bce-b3a4-c16e5180a7b8 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"Uv7y9PBTdGs7QhvJC1uW69WQ2PkoaHrh\",\"url\":\"https://ca.foo/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/DJKbt2KgLYG87RsFbEawU90LCUcRQqUN\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"Uv7y9PBTdGs7QhvJC1uW69WQ2PkoaHrh\",\"url\":\"https://ca.foo/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/wKbIn8PvyeNHJn7Jic5fEDRu00qyLvMG\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"Uv7y9PBTdGs7QhvJC1uW69WQ2PkoaHrh\",\"url\":\"https://ca.foo/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/QaKLmuwiQP5uBixHS6LWVAc9eexGKqRw\"}],\"wildcard\":false,\"expires\":\"2026-09-10T05:07:27Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423627.825167] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=7.516264ms duration-ns=7516264 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=OVV1MDcyV0FtRVZncFZrcG9QN1BTMlBCa2xLZUg2bXY path=/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/wKbIn8PvyeNHJn7Jic5fEDRu00qyLvMG protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=611a40d2-9d07-4e75-a135-f1865ab15224 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"Uv7y9PBTdGs7QhvJC1uW69WQ2PkoaHrh\",\"validated\":\"2026-09-09T05:07:27Z\",\"url\":\"https://ca.foo/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/wKbIn8PvyeNHJn7Jic5fEDRu00qyLvMG\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423627.854195] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=10.268303ms duration-ns=10268303 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=bjdwSmNOeHdCTmhtdHR0SGJZSDJJbmdadDMzcXpKaGs path=/acme/acme/order/DpDXKbzcoEcsk1113H9vGri8xDi74QND/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=c1cce3a1-d4ac-464b-8395-e204a30931c7 response="{\"id\":\"DpDXKbzcoEcsk1113H9vGri8xDi74QND\",\"status\":\"valid\",\"expires\":\"2026-09-10T05:07:27Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-09T05:06:27Z\",\"notAfter\":\"2026-12-08T05:07:27Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B\"],\"finalize\":\"https://ca.foo/acme/acme/order/DpDXKbzcoEcsk1113H9vGri8xDi74QND/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/UKk7OzSSfjsbsEffPK3Mjek5EobZodiz\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= ca # [423627.859779] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info certificate="MIIB2DCCAX6gAwIBAgIRAKG8wJ6D4qM3hXl5ClU0dZ8wCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTA5MDUwNjI3WhcNMjYxMjA4MDUwNzI3WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE+7omsDhv2gYKZL9aUlfKW9IDN6mri0Yw+SqVu9g08JmAp8gh6dmeBSIRfw60Upf/cYpZ81lEegApiiypt3qhijgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUpgwA6mYKxe+S8bzEGRELJpWiRcgwHwYDVR0jBBgwFoAUjJvf1QHItvU4aByePggdlawnfIUwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0gAMEUCICCfBRpYiethHP9ysSJiIjJkJiKTJ5yUWo7msm/WQLJpAiEA+qsZurlC8T5m94eg9irnvTSNRjWKQaHEBM+nRQMDMBo=" duration=2.584676ms duration-ns=2584676 fields.time="2026-09-09T05:07:27Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=TExRMFhkaWdNZzEwbFppU0hoYjBueDVVdU1UQnI2M3I path=/acme/acme/certificate/UKk7OzSSfjsbsEffPK3Mjek5EobZodiz protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=1f59d668-bf70-4330-a2a5-ef626e63f44f sans="map[dns:[test.foo]]" serial=214985765912286105797918001234357548447 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-09-09T05:06:27Z" valid-to="2026-12-08T05:07:27Z" * Trying [2001:db8:1::3]:443... * Host test.foo:443 was resolved. * IPv6: 2001:db8:1::3 * IPv4: 192.168.1.3 * ALPN: curl offers h2,http/1.1 } [5 bytes data] * TLSv1.3 (OUT), TLS handshake, Client hello (1): } [1552 bytes data] * SSL Trust Anchors: * OpenSSL default paths (fallback) { [5 bytes data] * TLSv1.3 (IN), TLS handshake, Server hello (2): { [1210 bytes data] * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): { [19 bytes data] * TLSv1.3 (IN), TLS handshake, Certificate (11): { [1010 bytes data] * TLSv1.3 (IN), TLS handshake, CERT verify (15): { [112 bytes data] * TLSv1.3 (IN), TLS handshake, Finished (20): { [52 bytes data] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.3 (OUT), TLS handshake, Finished (20): } [52 bytes data] * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey * ALPN: server accepted h2 * Server certificate: * subject: CN=test.foo * start date: Sep 9 05:07:19 2026 GMT * expire date: Oct 9 05:07:19 2028 GMT * issuer: CN=minica root ca 6fa36f * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 * subjectAltName: "test.foo" matches cert's "test.foo" * OpenSSL verify result: 13 * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) * closing connection #0 curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above. server # [423627.879684] server acme-order-renew-test.foo-start[334]: + cat out/key.pem out/fullchain.pem server # [423627.881528] server acme-order-renew-test.foo-start[334]: + for fixpath in out certificates server # [423627.881558] server acme-order-renew-test.foo-start[334]: + '[' -d out ']' server # [423627.881558] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=rX,o= out server # [423627.882949] server acme-order-renew-test.foo-start[334]: + chown -R acme:nginx out server # [423627.886126] server acme-order-renew-test.foo-start[334]: + for fixpath in out certificates server # [423627.886157] server acme-order-renew-test.foo-start[334]: + '[' -d certificates ']' server # [423627.886157] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=rX,o= certificates server # [423627.887895] server acme-order-renew-test.foo-start[334]: + chown -R acme:nginx certificates server # [423627.890252] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=,o= accounts/. server # [423627.984327] server systemd[1]: Reloading Nginx Web Server... server # [423627.988796] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. server # [423627.988995] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. server # [423628.559202] server nginx[391]: nginx: the configuration file /nix/store/vbja0ggj33nc6zf5lkzfrkd8ijv2r819-nginx.conf syntax is ok server # [423628.559775] server nginx[391]: nginx: configuration file /nix/store/vbja0ggj33nc6zf5lkzfrkd8ijv2r819-nginx.conf test is successful * Host test.foo:443 was resolved. * IPv6: 2001:db8:1::3 * IPv4: 192.168.1.3 * Trying [2001:db8:1::3]:443... * ALPN: curl offers h2,http/1.1 } [5 bytes data] * TLSv1.3 (OUT), TLS handshake, Client hello (1): } [1552 bytes data] * SSL Trust Anchors: * OpenSSL default paths (fallback) { [5 bytes data] * TLSv1.3 (IN), TLS handshake, Server hello (2): { [1210 bytes data] * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): { [19 bytes data] * TLSv1.3 (IN), TLS handshake, Certificate (11): { [930 bytes data] * TLSv1.3 (IN), TLS handshake, CERT verify (15): { [80 bytes data] * TLSv1.3 (IN), TLS handshake, Finished (20): { [52 bytes data] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.3 (OUT), TLS handshake, Finished (20): } [52 bytes data] * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey * ALPN: server accepted h2 * Server certificate: * subject: CN=test.foo * start date: Sep 9 05:06:27 2026 GMT * expire date: Dec 8 05:07:27 2026 GMT * issuer: CN=Clan Intermediate CA * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 * subjectAltName: "test.foo" matches cert's "test.foo" * OpenSSL verify result: 0 * SSL certificate verified via OpenSSL. * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 55782 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 0* using HTTP/2 * [HTTP/2] [1] OPENED stream for https://test.foo/ * [HTTP/2] [1] [:method: GET] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: test.foo] * [HTTP/2] [1] [:path: /] * [HTTP/2] [1] [user-agent: curl/8.21.0] * [HTTP/2] [1] [accept: */*] } [5 bytes data] * Request completely sent off { [5 bytes data] * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): { [265 bytes data] * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): { [265 bytes data] { [5 bytes data] 100 20 100 20 0 0 820 0 0 * Connection #0 to host test.foo:443 left intact client: (finished: waiting for success: curl -v https://test.foo, in 2.15 seconds) client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 Certificate: Data: Version: 3 (0x2) Serial Number: a1:bc:c0:9e:83:e2:a3:37:85:79:79:0a:55:34:75:9f Signature Algorithm: ecdsa-with-SHA256 Issuer: CN=Clan Intermediate CA Validity Not Before: Sep 9 05:06:27 2026 GMT Not After : Dec 8 05:07:27 2026 GMT Subject: CN=test.foo Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (256 bit) pub: 04:4f:bb:a2:6b:03:86:fd:a0:60:a6:4b:f5:a5:25: 7c:a5:bd:20:33:7a:9a:b8:b4:63:0f:92:a9:5b:bd: 83:4f:09:98:0a:7c:82:1e:9d:99:e0:52:21:17:f0: eb:45:29:7f:f7:18:a5:9f:35:94:47:a0:02:98:a2: ca:9b:77:aa:18 ASN1 OID: prime256v1 NIST CURVE: P-256 X509v3 extensions: X509v3 Key Usage: critical Digital Signature X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Subject Key Identifier: A6:0C:00:EA:66:0A:C5:EF:92:F1:BC:C4:19:11:0B:26:95:A2:45:C8 X509v3 Authority Key Identifier: 8C:9B:DF:D5:01:C8:B6:F5:38:68:1C:9E:3E:08:1D:95:AC:27:7C:85 X509v3 Subject Alternative Name: DNS:test.foo 1.3.6.1.4.1.37476.9000.64.1: 0......acme.. Signature Algorithm: ecdsa-with-SHA256 Signature Value: 30:45:02:20:20:9f:05:1a:58:89:eb:61:1c:ff:72:b1:22:62: 22:32:64:26:22:93:27:9c:94:5a:8e:e6:b2:6f:d6:40:b2:69: 02:21:00:fa:ab:19:ba:b9:42:f1:3e:66:f7:87:a0:f6:2a:e7: bd:34:8d:46:35:8a:41:a1:c4:04:cf:a7:45:03:03:30:1a client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.04 seconds) (finished: run the VM test script, in 12.80 seconds) test script finished in 12.84s cleanup kill NspawnMachine (pid 53) kill NspawnMachine (pid 55) kill NspawnMachine (pid 56) server # [423629.128397] server systemd[1]: Reloaded Nginx Web Server. Container ca terminated by signal KILL. Container client terminated by signal KILL. Container server terminated by signal KILL. (finished: cleanup, in 0.54 seconds)