container-test-run-certificates
checks.aarch64-linux.certificates
· build #612
· raw
1Machine state will be reset. To keep it, pass --keep-machine-state2start all VLans3(finished: start all VLans, in 0.00 seconds)45Test will time out and terminate in 3600.0 seconds6run the VM test script7additionally exposed symbols:8 ca, client, server,9 vlan1,10 start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh11start all VMs12ca: systemd-nspawn running (pid 53)13client: systemd-nspawn running (pid 55)14server: systemd-nspawn running (pid 56)15ca: Waiting for journal at /build/vm-state-ca/var/log/journal...16server: Waiting for journal at /build/vm-state-server/var/log/journal...17client: Waiting for journal at /build/vm-state-client/var/log/journal...18(finished: start all VMs, in 0.00 seconds)19nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE20nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.21nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE22nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.23nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE24nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.25Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.26Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.27░ Spawning container server on /build/vm-state-server.28░ Spawning container client on /build/vm-state-client.29Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.30░ Spawning container ca on /build/vm-state-ca.31server # No journal boot entry found for the specified boot (+0).32client # No journal boot entry found for the specified boot (+0).33ca # No journal boot entry found for the specified boot (+0).34server # [423617.432905] server systemd-journald[69]: Journal started35server # [423617.432963] server systemd-journald[69]: Runtime Journal (/run/log/journal/3d9996a2d23b4c8f816d99f757cb7e56) is 8M, max 2.5G, 2.4G free.36server # [423617.440246] server systemd[1]: Starting Flush Journal to Persistent Storage...37server # [423617.441064] server systemd[1]: Starting Network Name Resolution...38server # [423617.441728] server systemd[1]: Starting Create Static Device Nodes in /dev...39server # [423617.449658] server systemd-journald[69]: Time spent on flushing to /var/log/journal/3d9996a2d23b4c8f816d99f757cb7e56 is 1.657ms for 5 entries.40server # [423617.449658] server systemd-journald[69]: System Journal (/var/log/journal/3d9996a2d23b4c8f816d99f757cb7e56) is 8M, max 4G, 3.9G free.41server # [423617.460619] server systemd[1]: Finished Create Static Device Nodes in /dev.42server # [423617.461274] server systemd[1]: Reached target Preparation for Local File Systems.43server # [423617.461401] server systemd[1]: Reached target Local File Systems.44server # [423617.462247] server systemd[1]: Listening on Boot Loader Control Service Socket.45server # [423617.462292] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container46server # [423617.463120] server systemd[1]: Starting Save Transient machine-id to Disk...47server # [423617.463155] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys48server # [423617.515582] server systemd[1]: Finished Flush Journal to Persistent Storage.49server # [423617.516649] server systemd[1]: Starting Create System Files and Directories...50server # [423617.532526] server systemd-tmpfiles[134]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted51server # [423617.532712] server systemd-tmpfiles[134]: fchmod() of /var/log/journal failed: Operation not permitted52server # [423617.532831] server systemd-tmpfiles[134]: fchmod() of /var/log/journal/3d9996a2d23b4c8f816d99f757cb7e56 failed: Operation not permitted53server # [423617.533013] server systemd-tmpfiles[134]: fchmod() of /run/log/journal failed: Operation not permitted54server # [423617.535005] server systemd[1]: Finished Create System Files and Directories.55server # [423617.536241] server systemd[1]: Starting Rebuild Journal Catalog...56server # [423617.537043] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...57server # [423617.551250] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.58server # [423617.556769] server systemd[1]: Finished Rebuild Journal Catalog.59server # [423617.558083] server systemd[1]: Starting Update is Completed...60server # [423617.570023] server systemd[1]: Finished Update is Completed.61server # [423617.601960] server systemd[1]: Finished Firewall.62server # [423617.602113] server systemd[1]: Reached target Preparation for Network.63server # [423617.602341] server systemd[1]: Listening on Network Management Resolve Hook Socket.64server # [423617.603362] server systemd[1]: Starting Network Management...65server # [423617.999324] server systemd[1]: Finished Save Transient machine-id to Disk.66server # [423618.068737] server systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted67server # [423618.068833] server systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted68server # [423618.079753] server systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.69ca # [423617.432036] ca systemd-journald[77]: Journal started70server # [423618.079923] server systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.71ca # [423617.432096] ca systemd-journald[77]: Runtime Journal (/run/log/journal/9c4c675b61f34b578fd7739b315e3598) is 8M, max 2.5G, 2.4G free.72server # [423618.080096] server systemd-networkd[186]: lo: Link UP73ca # [423617.440568] ca systemd[1]: Starting Flush Journal to Persistent Storage...74server # [423618.080099] server systemd-networkd[186]: lo: Gained carrier75ca # [423617.441401] ca systemd[1]: Starting Network Name Resolution...76server # [423618.080292] server systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network.77ca # [423617.442026] ca systemd[1]: Starting Create Static Device Nodes in /dev...78server # [423618.080768] server systemd-networkd[186]: eth1: Link UP79ca # [423617.452324] ca systemd-journald[77]: Time spent on flushing to /var/log/journal/9c4c675b61f34b578fd7739b315e3598 is 1.965ms for 5 entries.80server # [423618.080820] server systemd[1]: Started Network Management.81ca # [423617.452324] ca systemd-journald[77]: System Journal (/var/log/journal/9c4c675b61f34b578fd7739b315e3598) is 8M, max 4G, 3.9G free.82server # [423618.081071] server systemd-networkd[186]: eth1: Gained carrier83ca # [423617.460660] ca systemd[1]: Finished Create Static Device Nodes in /dev.84server # [423618.082695] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...85ca # [423617.461352] ca systemd[1]: Reached target Preparation for Local File Systems.86server # [423618.129890] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.87ca # [423617.461475] ca systemd[1]: Reached target Local File Systems.88server # [423618.226715] server systemd-resolved[89]: Positive Trust Anchors:89ca # [423617.462337] ca systemd[1]: Listening on Boot Loader Control Service Socket.90server # [423618.226727] server systemd-resolved[89]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d91ca # [423617.462390] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container92server # [423618.226730] server systemd-resolved[89]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b1693ca # [423617.463332] ca systemd[1]: Starting Save Transient machine-id to Disk...94server # [423618.226763] server systemd-resolved[89]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test95ca # [423617.463370] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys96server # [423618.248714] server systemd-resolved[89]: Using system hostname 'server'.97ca # [423617.517808] ca systemd[1]: Finished Flush Journal to Persistent Storage.98server # [423618.250078] server systemd[1]: Started Network Name Resolution.99ca # [423617.519399] ca systemd[1]: Starting Create System Files and Directories...100server # [423618.250174] server systemd[1]: Reached target Network.101ca # [423617.534398] ca systemd-tmpfiles[143]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted102server # [423618.250253] server systemd[1]: Reached target Network is Online.103ca # [423617.534589] ca systemd-tmpfiles[143]: fchmod() of /var/log/journal failed: Operation not permitted104server # [423618.250306] server systemd[1]: Reached target System Initialization.105ca # [423617.534709] ca systemd-tmpfiles[143]: fchmod() of /var/log/journal/9c4c675b61f34b578fd7739b315e3598 failed: Operation not permitted106server # [423618.250580] server systemd[1]: Started Renew ACME Certificate for test.foo.107ca # [423617.534894] ca systemd-tmpfiles[143]: fchmod() of /run/log/journal failed: Operation not permitted108server # [423618.250619] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container109ca # [423617.536328] ca systemd[1]: Finished Create System Files and Directories.110server # [423618.250646] server systemd[1]: Started Daily Cleanup of Temporary Directories.111ca # [423617.537421] ca systemd[1]: Starting Rebuild Journal Catalog...112server # [423618.250668] server systemd[1]: Reached target Timer Units.113ca # [423617.538117] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...114server # [423618.250811] server systemd[1]: Listening on D-Bus System Message Bus Socket.115ca # [423617.550434] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.116server # [423618.250942] server systemd[1]: Listening on Nix Daemon Socket.117ca # [423617.556670] ca systemd[1]: Finished Rebuild Journal Catalog.118server # [423618.251085] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.119ca # [423617.558101] ca systemd[1]: Starting Update is Completed...120server # [423618.251111] server systemd[1]: Reached target Socket Units.121ca # [423617.569944] ca systemd[1]: Finished Update is Completed.122server # [423618.251159] server systemd[1]: Reached target Basic System.123ca # [423617.598400] ca systemd[1]: Finished Firewall.124server # [423618.252808] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...125ca # [423617.598630] ca systemd[1]: Reached target Preparation for Network.126client # [423617.423738] client systemd-journald[69]: Journal started127server # [423618.253845] server systemd[1]: Starting Import lastlog data into lastlog2 database...128ca # [423617.598986] ca systemd[1]: Listening on Network Management Resolve Hook Socket.129server # [423618.253888] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem130ca # [423617.600490] ca systemd[1]: Starting Network Management...131client # [423617.423797] client systemd-journald[69]: Runtime Journal (/run/log/journal/ce5034a360474b65ac0261d50422b2ea) is 8M, max 2.5G, 2.4G free.132ca # [423617.999303] ca systemd[1]: Finished Save Transient machine-id to Disk.133client # [423617.427567] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.134server # [423618.254986] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...135ca # [423618.092157] ca systemd-networkd[194]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted136server # [423618.256525] server systemd[1]: Starting D-Bus System Message Bus...137client # [423617.436431] client systemd[1]: Starting Flush Journal to Persistent Storage...138server # [423618.319349] server systemd[1]: Finished Import lastlog data into lastlog2 database.139ca # [423618.092249] ca systemd-networkd[194]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted140server # [423618.419310] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.141client # [423617.437329] client systemd[1]: Starting Network Name Resolution...142server # [423618.426313] server acme-setup-privileged[192]: + set -euo pipefail143ca # [423618.099908] ca systemd-networkd[194]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.144server # [423618.426313] server acme-setup-privileged[192]: + cd /var/lib/acme145client # [423617.438137] client systemd[1]: Starting Create Static Device Nodes in /dev...146server # [423618.426728] server acme-setup-privileged[192]: + chmod -R u=rwX,g=,o= .lego/accounts147ca # [423618.100091] ca systemd-networkd[194]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.148server # [423618.427908] server acme-setup-privileged[192]: + chown -R acme .lego/accounts149client # [423617.448013] client systemd-journald[69]: Time spent on flushing to /var/log/journal/ce5034a360474b65ac0261d50422b2ea is 1.677ms for 6 entries.150server # [423618.429513] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo151ca # [423618.100238] ca systemd-networkd[194]: lo: Link UP152server # [423618.429537] server acme-setup-privileged[192]: + '[' -d test.foo ']'153client # [423617.448013] client systemd-journald[69]: System Journal (/var/log/journal/ce5034a360474b65ac0261d50422b2ea) is 8M, max 4G, 3.9G free.154server # [423618.429537] server acme-setup-privileged[192]: + for fixpath in test.foo .lego/test.foo155ca # [423618.100242] ca systemd-networkd[194]: lo: Gained carrier156server # [423618.429579] server acme-setup-privileged[192]: + '[' -d .lego/test.foo ']'157client # [423617.455622] client systemd[1]: Finished Create Static Device Nodes in /dev.158server # [423618.465714] server nsncd[194]: Sep 09 05:07:18.451 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"159ca # [423618.100409] ca systemd-networkd[194]: eth1: Configuring with /etc/systemd/network/40-eth1.network.160server # [423618.465698] server systemd[1]: Started Name Service Cache Daemon (nsncd).161client # [423617.455880] client systemd[1]: Reached target Preparation for Local File Systems.162server # [423618.465806] server systemd[1]: Reached target Host and Network Name Lookups.163ca # [423618.100830] ca systemd[1]: Started Network Management.164server # [423618.465906] server systemd[1]: Reached target User and Group Name Lookups.165client # [423617.455974] client systemd[1]: Reached target Local File Systems.166server # [423618.469412] server systemd[1]: Starting User Login Management...167ca # [423618.120322] ca systemd-networkd[194]: eth1: Link UP168server # [423618.470845] server systemd[1]: Starting Permit User Sessions...169client # [423617.456742] client systemd[1]: Listening on Boot Loader Control Service Socket.170ca # [423618.120631] ca systemd-networkd[194]: eth1: Gained carrier171client # [423617.456790] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container172ca # [423618.120665] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...173client # [423617.457660] client systemd[1]: Starting Save Transient machine-id to Disk...174ca # [423618.142004] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.175client # [423617.457698] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys176ca # [423618.240170] ca systemd-resolved[96]: Positive Trust Anchors:177client # [423617.517799] client systemd[1]: Finished Flush Journal to Persistent Storage.178ca # [423618.240181] ca systemd-resolved[96]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d179client # [423617.519572] client systemd[1]: Starting Create System Files and Directories...180ca # [423618.240185] ca systemd-resolved[96]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16181client # [423617.535013] client systemd-tmpfiles[137]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted182ca # [423618.240219] ca systemd-resolved[96]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test183client # [423617.535201] client systemd-tmpfiles[137]: fchmod() of /var/log/journal failed: Operation not permitted184ca # [423618.261996] ca systemd-resolved[96]: Using system hostname 'ca'.185client # [423617.535332] client systemd-tmpfiles[137]: fchmod() of /var/log/journal/ce5034a360474b65ac0261d50422b2ea failed: Operation not permitted186ca # [423618.263360] ca systemd[1]: Started Network Name Resolution.187client # [423617.535523] client systemd-tmpfiles[137]: fchmod() of /run/log/journal failed: Operation not permitted188ca # [423618.263460] ca systemd[1]: Reached target Network.189client # [423617.536411] client systemd[1]: Finished Create System Files and Directories.190ca # [423618.263542] ca systemd[1]: Reached target Network is Online.191client # [423617.538038] client systemd[1]: Starting Rebuild Journal Catalog...192ca # [423618.263598] ca systemd[1]: Reached target System Initialization.193client # [423617.538878] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...194ca # [423618.263858] ca systemd[1]: Started Renew ACME Certificate for ca.foo.195client # [423617.554064] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.196ca # [423618.263891] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container197client # [423617.561800] client systemd[1]: Finished Rebuild Journal Catalog.198ca # [423618.263920] ca systemd[1]: Started Daily Cleanup of Temporary Directories.199client # [423617.562863] client systemd[1]: Starting Update is Completed...200ca # [423618.263942] ca systemd[1]: Reached target Timer Units.201client # [423617.573408] client systemd[1]: Finished Update is Completed.202ca # [423618.264123] ca systemd[1]: Listening on D-Bus System Message Bus Socket.203client # [423617.588661] client systemd[1]: Finished Firewall.204ca # [423618.264259] ca systemd[1]: Listening on Nix Daemon Socket.205client # [423617.588826] client systemd[1]: Reached target Preparation for Network.206ca # [423618.264397] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.207client # [423617.589060] client systemd[1]: Listening on Network Management Resolve Hook Socket.208ca # [423618.264422] ca systemd[1]: Reached target Socket Units.209client # [423617.590170] client systemd[1]: Starting Network Management...210ca # [423618.264478] ca systemd[1]: Reached target Basic System.211client # [423617.999293] client systemd[1]: Finished Save Transient machine-id to Disk.212ca # [423618.304689] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...213client # [423618.122474] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted214ca # [423618.306107] ca systemd[1]: Starting Import lastlog data into lastlog2 database...215client # [423618.122573] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted216client # [423618.129765] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.217client # [423618.129932] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.218client # [423618.130081] client systemd-networkd[182]: lo: Link UP219client # [423618.130085] client systemd-networkd[182]: lo: Gained carrier220client # [423618.130256] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network.221client # [423618.130703] client systemd[1]: Started Network Management.222client # [423618.130751] client systemd-networkd[182]: eth1: Link UP223client # [423618.131059] client systemd-networkd[182]: eth1: Gained carrier224client # [423618.132357] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...225client # [423618.162321] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.226client # [423618.229394] client systemd-resolved[90]: Positive Trust Anchors:227client # [423618.229403] client systemd-resolved[90]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d228client # [423618.229407] client systemd-resolved[90]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16229client # [423618.229440] client systemd-resolved[90]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test230client # [423618.251034] client systemd-resolved[90]: Using system hostname 'client'.231client # [423618.252825] client systemd[1]: Started Network Name Resolution.232client # [423618.252916] client systemd[1]: Reached target Network.233client # [423618.252992] client systemd[1]: Reached target System Initialization.234client # [423618.253053] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container235client # [423618.253089] client systemd[1]: Started Daily Cleanup of Temporary Directories.236client # [423618.253112] client systemd[1]: Reached target Timer Units.237client # [423618.253342] client systemd[1]: Listening on D-Bus System Message Bus Socket.238client # [423618.253496] client systemd[1]: Listening on Nix Daemon Socket.239client # [423618.253633] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.240client # [423618.253664] client systemd[1]: Reached target Socket Units.241client # [423618.253712] client systemd[1]: Reached target Basic System.242client # [423618.254892] client systemd[1]: Starting Import lastlog data into lastlog2 database...243client # [423618.255967] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...244client # [423618.257457] client systemd[1]: Starting D-Bus System Message Bus...245client # [423618.321343] client systemd[1]: Finished Import lastlog data into lastlog2 database.246client # [423618.409606] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.247client # [423618.475008] client nsncd[189]: Sep 09 05:07:18.460 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"248client # [423618.475124] client systemd[1]: Started Name Service Cache Daemon (nsncd).249client # [423618.475172] client systemd[1]: Reached target Host and Network Name Lookups.250client # [423618.475230] client systemd[1]: Reached target User and Group Name Lookups.251ca # [423618.306190] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem252ca # [423618.307570] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...253ca # [423618.309299] ca systemd[1]: Starting step-ca service...254ca # [423618.311713] ca systemd[1]: Starting D-Bus System Message Bus...255ca # [423618.326233] ca systemd[1]: Finished Import lastlog data into lastlog2 database.256ca # [423618.423061] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.257ca # [423618.441949] ca acme-setup-privileged[200]: + set -euo pipefail258client # [423618.476797] client systemd[1]: Starting User Login Management...259ca # [423618.441949] ca acme-setup-privileged[200]: + cd /var/lib/acme260ca # [423618.441949] ca acme-setup-privileged[200]: + chmod -R u=rwX,g=,o= .lego/accounts261ca # [423618.443398] ca acme-setup-privileged[200]: + chown -R acme .lego/accounts262ca # [423618.444823] ca acme-setup-privileged[200]: + for fixpath in ca.foo .lego/ca.foo263ca # [423618.444823] ca acme-setup-privileged[200]: + '[' -d ca.foo ']'264ca # [423618.444956] ca acme-setup-privileged[200]: + for fixpath in ca.foo .lego/ca.foo265ca # [423618.444956] ca acme-setup-privileged[200]: + '[' -d .lego/ca.foo ']'266client # [423618.477606] client systemd[1]: Starting Permit User Sessions...267client # [423618.488628] client systemd[1]: Finished Permit User Sessions.268client # [423618.489714] client systemd[1]: Started Console Getty.269client # [423618.489763] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0270client # [423618.489780] client systemd[1]: Reached target Login Prompts.271server # [423618.481240] server systemd[1]: Finished Permit User Sessions.272server # [423618.483313] server systemd[1]: Started Console Getty.273server # [423618.483365] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0274server # [423618.483385] server systemd[1]: Reached target Login Prompts.275ca # [423618.476545] ca nsncd[202]: Sep 09 05:07:18.462 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"276ca # [423618.476318] ca systemd[1]: Started Name Service Cache Daemon (nsncd).277ca # [423618.476378] ca systemd[1]: Reached target Host and Network Name Lookups.278ca # [423618.476444] ca systemd[1]: Reached target User and Group Name Lookups.279ca # [423618.477865] ca systemd[1]: Starting User Login Management...280ca # [423618.478647] ca systemd[1]: Starting Permit User Sessions...281ca # [423618.488416] ca systemd[1]: Finished Permit User Sessions.282ca # [423618.489502] ca systemd[1]: Started Console Getty.283ca # [423618.489545] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0284ca # [423618.489566] ca systemd[1]: Reached target Login Prompts.285server # [423618.566743] server dbus-broker-launch[195]: Looking up NSS user entry for 'systemd-timesync'...286server # [423618.567414] server dbus-broker-launch[195]: NSS returned no entry for 'systemd-timesync'287server # [423618.567414] server dbus-broker-launch[195]: Invalid user-name in /nix/store/fb9fkv4xj60yflm8pgkwj109ysiqv6y9-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"288server # [423618.567808] server systemd[1]: Started D-Bus System Message Bus.289server # [423618.575289] server dbus-broker-launch[195]: Ready290ca # [423618.571071] ca dbus-broker-launch[206]: Looking up NSS user entry for 'systemd-timesync'...291ca # [423618.571679] ca dbus-broker-launch[206]: NSS returned no entry for 'systemd-timesync'292ca # [423618.571679] ca dbus-broker-launch[206]: Invalid user-name in /nix/store/krq5730hygnqgccm0vn905nahz484539-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"293ca # [423618.572035] ca systemd[1]: Started D-Bus System Message Bus.294ca # [423618.579775] ca dbus-broker-launch[206]: Ready295client # [423618.589772] client dbus-broker-launch[190]: Looking up NSS user entry for 'systemd-timesync'...296client # [423618.590702] client dbus-broker-launch[190]: NSS returned no entry for 'systemd-timesync'297client # [423618.590702] client dbus-broker-launch[190]: Invalid user-name in /nix/store/i4syq4zsqasv8ffdwnv5zwlla4nascy0-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"298client # [423618.591130] client systemd[1]: Started D-Bus System Message Bus.299client # [423618.599077] client dbus-broker-launch[190]: Ready300client # [423618.964146] client systemd-logind[205]: New seat seat0.301client # [423618.964351] client systemd[1]: Started User Login Management.302client # [423618.965921] client systemd[1]: Starting linger-users.service...303client # [423619.010670] client systemd[1]: linger-users.service: Deactivated successfully.304client # [423619.010976] client systemd[1]: Finished linger-users.service.305client # [423619.011855] client systemd[1]: Reached target Multi-User System.306client # [423619.012335] client systemd[1]: Startup finished in 2.043s.307server # [423618.989418] server systemd-logind[220]: New seat seat0.308server # [423618.989662] server systemd[1]: Started User Login Management.309server # [423619.001009] server systemd[1]: Starting linger-users.service...310server # [423619.014281] server acme-setup-start[208]: + set -euo pipefail311server # [423619.014281] server acme-setup-start[208]: + test -e ca/key.pem312server # [423619.014733] server acme-setup-start[208]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local313server # [423619.015696] server systemd[1]: linger-users.service: Deactivated successfully.314server # [423619.015773] server systemd[1]: Finished linger-users.service.315server # [423619.036834] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.316server # [423619.038556] server systemd[1]: Starting Ensure certificate for test.foo...317ca # [423618.974525] ca systemd-logind[233]: New seat seat0.318ca # [423618.974721] ca systemd[1]: Started User Login Management.319ca # [423619.000756] ca systemd[1]: Starting linger-users.service...320ca # [423619.014727] ca systemd[1]: linger-users.service: Deactivated successfully.321ca # [423619.014851] ca systemd[1]: Finished linger-users.service.322ca # [423619.023279] ca acme-setup-start[218]: + set -euo pipefail323ca # [423619.023279] ca acme-setup-start[218]: + test -e ca/key.pem324ca # [423619.023811] ca acme-setup-start[218]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local325ca # [423619.045144] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.326ca # [423619.047516] ca systemd[1]: Starting Ensure certificate for ca.foo...327ca # [423619.153363] ca step-ca[203]: badger 2026/09/09 05:07:19 INFO: All 0 tables opened in 0s328ca # [423619.160278] ca step-ca[203]: 2026/09/09 05:07:19 Building new tls configuration using step-ca x509 Signer Interface329ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 Starting Smallstep CA/0.30.2 (linux/arm64)330ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 Documentation: https://u.step.sm/docs/ca331ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 Community Discord: https://u.step.sm/discord332ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 Config file: /etc/smallstep/ca.json333ca # [423619.164643] ca step-ca[203]: 2026/09/09 05:07:19 The primary server URL is https://ca.foo:1443334ca # [423619.164805] ca step-ca[203]: 2026/09/09 05:07:19 Root certificates are available at https://ca.foo:1443/roots.pem335ca # [423619.164805] ca step-ca[203]: 2026/09/09 05:07:19 X.509 Root Fingerprint: 032c1fb9b944e1d93c405b4ade61e18b575594ecc2ea3b5ae5824e6cd948d63e336ca # [423619.165314] ca systemd[1]: Started step-ca service.337ca # [423619.165557] ca step-ca[203]: 2026/09/09 05:07:19 Serving HTTPS on 0.0.0.0:1443 ...338ca: must succeed: systemctl restart acme-order-renew-ca.foo.service 339ca # [423619.549412] ca acme-ca.foo-start[255]: Waiting to acquire lock in /run/acme/340ca # [423619.553927] ca acme-ca.foo-start[255]: + '[' -e out/acme-success ']'341ca # [423619.554004] ca acme-ca.foo-start[255]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=342ca # [423619.569333] ca acme-ca.foo-start[293]: + cd ca.foo343ca # [423619.569914] ca acme-ca.foo-start[293]: + cp -vp cert.pem ../out/cert.pem344ca # [423619.571046] ca acme-ca.foo-start[294]: 'cert.pem' -> '../out/cert.pem'345ca # [423619.571379] ca acme-ca.foo-start[293]: + cp -vp key.pem ../out/key.pem346ca # [423619.572643] ca acme-ca.foo-start[293]: 'key.pem' -> '../out/key.pem'347ca # [423619.572924] ca acme-ca.foo-start[255]: + cat out/cert.pem ca/cert.pem348server # [423619.526198] server acme-test.foo-start[245]: Waiting to acquire lock in /run/acme/349ca # [423619.574604] ca acme-ca.foo-start[255]: + cp ca/cert.pem out/chain.pem350server # [423619.528871] server acme-test.foo-start[245]: + '[' -e out/acme-success ']'351ca # [423619.576724] ca acme-ca.foo-start[255]: + cat out/key.pem out/fullchain.pem352server # [423619.528871] server acme-test.foo-start[245]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=353ca # [423619.578601] ca acme-ca.foo-start[255]: + for fixpath in out certificates354server # [423619.543507] server acme-test.foo-start[255]: + cd test.foo355ca # [423619.578601] ca acme-ca.foo-start[255]: + '[' -d out ']'356server # [423619.544171] server acme-test.foo-start[255]: + cp -vp cert.pem ../out/cert.pem357ca # [423619.578708] ca acme-ca.foo-start[255]: + chmod -R u=rwX,g=rX,o= out358server # [423619.545358] server acme-test.foo-start[256]: 'cert.pem' -> '../out/cert.pem'359ca # [423619.580250] ca acme-ca.foo-start[255]: + chown -R acme:nginx out360server # [423619.545798] server acme-test.foo-start[255]: + cp -vp key.pem ../out/key.pem361ca # [423619.583184] ca acme-ca.foo-start[255]: + for fixpath in out certificates362server # [423619.547109] server acme-test.foo-start[255]: 'key.pem' -> '../out/key.pem'363ca # [423619.583184] ca acme-ca.foo-start[255]: + '[' -d certificates ']'364server # [423619.547396] server acme-test.foo-start[245]: + cat out/cert.pem ca/cert.pem365ca # [423619.608467] ca systemd[1]: Finished Ensure certificate for ca.foo.366server # [423619.549673] server acme-test.foo-start[245]: + cp ca/cert.pem out/chain.pem367ca # [423619.610228] ca systemd[1]: Starting Nginx Web Server...368server # [423619.551890] server acme-test.foo-start[245]: + cat out/key.pem out/fullchain.pem369ca # [423619.777660] ca systemd-networkd[194]: eth1: Gained IPv6LL370server # [423619.553873] server acme-test.foo-start[245]: + for fixpath in out certificates371server # [423619.553901] server acme-test.foo-start[245]: + '[' -d out ']'372server # [423619.553901] server acme-test.foo-start[245]: + chmod -R u=rwX,g=rX,o= out373server # [423619.555772] server acme-test.foo-start[245]: + chown -R acme:nginx out374server # [423619.559047] server acme-test.foo-start[245]: + for fixpath in out certificates375server # [423619.559088] server acme-test.foo-start[245]: + '[' -d certificates ']'376server # [423619.562162] server systemd[1]: Finished Ensure certificate for test.foo.377server # [423619.564049] server systemd[1]: Starting Nginx Web Server...378server # [423619.652209] server systemd-networkd[186]: eth1: Gained IPv6LL379client # [423620.096274] client systemd-networkd[182]: eth1: Gained IPv6LL380server # [423620.162815] server nginx-pre-start[267]: nginx: the configuration file /nix/store/vbja0ggj33nc6zf5lkzfrkd8ijv2r819-nginx.conf syntax is ok381server # [423620.163144] server nginx-pre-start[267]: nginx: configuration file /nix/store/vbja0ggj33nc6zf5lkzfrkd8ijv2r819-nginx.conf test is successful382server # [423620.184590] server systemd[1]: Started Nginx Web Server.383server # [423620.185031] server systemd[1]: Reached target Multi-User System.384server # [423620.187097] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...385ca # [423620.164608] ca nginx-pre-start[305]: nginx: the configuration file /nix/store/xhml9fz6gx0h63h36sd1j5ba87wd00y2-nginx.conf syntax is ok386ca # [423620.165038] ca nginx-pre-start[305]: nginx: configuration file /nix/store/xhml9fz6gx0h63h36sd1j5ba87wd00y2-nginx.conf test is successful387ca # [423620.184626] ca systemd[1]: Started Nginx Web Server.388ca # [423620.185160] ca systemd[1]: Reached target Multi-User System.389ca # [423620.187255] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...390ca # [423620.745202] ca acme-order-renew-ca.foo-start[308]: Waiting to acquire lock in /run/acme/391ca # [423620.747963] ca acme-order-renew-ca.foo-start[308]: + set -euo pipefail392ca # [423620.748111] ca acme-order-renew-ca.foo-start[308]: + echo 88dc4fc401a6091a1bd9393ca # [423620.748209] ca acme-order-renew-ca.foo-start[308]: + cmp -s domainhash.txt certificates/domainhash.txt394ca # [423620.749372] ca acme-order-renew-ca.foo-start[308]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo run395ca # [423620.764704] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 No key found for account none@none.tld. Generating a P256 key.396ca # [423620.764987] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 Saved key to accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key397ca # [423620.791068] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration="88.641µs" duration-ns=88641 fields.time="2026-09-09T05:07:20Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a7822826-3018-42a5-9b07-58c65ed87e2b response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=398ca # [423620.791458] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] acme: Registering account for none@none.tld399ca # [423620.796639] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=5.05051ms duration-ns=5050510 fields.time="2026-09-09T05:07:20Z" method=HEAD name=ca nonce=a1NOZTFvV0EwMW1GTVE3QTR3T1VJS0JwQllNaDE5ekc path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f8204dd1-21a9-4c49-a45f-82fa559c4973 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=400ca # [423620.798920] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=1.614983ms duration-ns=1614983 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=UWRiSFpOWUhNRHk0dGgxcFg5d3F5MlhxUnY5NURJYnc path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=60a79045-be90-426d-8dd4-e1ab2d714f53 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/6rCFQjDOYyVMijaE7Z6hHO9kQKSOwAKK/orders\"}" size=143 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=401ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: !!!! HEADS UP !!!!402ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: Your account credentials have been saved in your403ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: configuration directory at "accounts".404ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: You should make a secure backup of this folder now. This405ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: configuration directory will also contain private keys406ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: generated by lego and certificates obtained from the ACME407ca # [423620.799179] ca acme-order-renew-ca.foo-start[320]: server. Making regular backups of this folder is ideal.408ca # [423620.799314] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: Obtaining bundled SAN certificate409ca # [423620.802303] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=2.612396ms duration-ns=2612396 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=UFlsQ0JVcEpjU2ZkZEN3dEJLRnhDOXA1Q1EzZWtQdEo path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=6f15ef3e-8fee-4e7c-adda-a25e92760cc6 response="{\"id\":\"yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj\",\"status\":\"pending\",\"expires\":\"2026-09-10T05:07:20Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-09T05:06:20Z\",\"notAfter\":\"2026-12-08T05:07:20Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj/finalize\"}" size=392 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=410ca # [423620.865255] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=6.126405ms duration-ns=6126405 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=c1pFR2NYRUc1a0IwVWtOUDRmVlpvUWhaYUVhUlhOTUQ path=/acme/acme/authz/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=4f94032e-c03f-482b-882b-68667d1083bd response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"p9Ir8XApySkGvTwU7rIZkBP2HfBmZOqd\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/XUso3R2lIi1l4dTJo7Kr5QwDqW7q4MFT\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"p9Ir8XApySkGvTwU7rIZkBP2HfBmZOqd\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/WkXqgvhP2WIEgbF5GlFoGUfi7EucHRIK\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"p9Ir8XApySkGvTwU7rIZkBP2HfBmZOqd\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/9Nb6nKKtOso9R3UYv6Af60rtHWm8BQ0P\"}],\"wildcard\":false,\"expires\":\"2026-09-10T05:07:20Z\"}" size=719 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=411ca # [423620.865543] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] AuthURL: https://ca.foo:1443/acme/acme/authz/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J412ca # [423620.865543] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: Could not find solver for: tls-alpn-01413ca # [423620.865543] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: use http-01 solver414ca # [423620.865543] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: Trying to solve HTTP-01415ca # [423620.870651] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=4.569423ms duration-ns=4569423 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=ZHZEWUVEaDFDM1FlWlJLTkRxOEJFVTVmTkNFNERCS1Q path=/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/WkXqgvhP2WIEgbF5GlFoGUfi7EucHRIK protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=81e9208e-dddc-4225-b1f7-bcf57d44943b response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"p9Ir8XApySkGvTwU7rIZkBP2HfBmZOqd\",\"validated\":\"2026-09-09T05:07:20Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J/WkXqgvhP2WIEgbF5GlFoGUfi7EucHRIK\"}" size=228 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=416ca # [423620.870990] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] The server validated our request417ca # [423620.871069] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] acme: Validations succeeded; requesting certificates418ca # [423620.881126] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info duration=8.806242ms duration-ns=8806242 fields.time="2026-09-09T05:07:20Z" method=POST name=ca nonce=U3Noek5YS3VBajM1dWJGOXkzWE1WWnJvNkR0OHljMno path=/acme/acme/order/yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=18db613c-a2c5-45e9-b991-50a16befbe73 response="{\"id\":\"yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj\",\"status\":\"valid\",\"expires\":\"2026-09-10T05:07:20Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-09T05:06:20Z\",\"notAfter\":\"2026-12-08T05:07:20Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/sBRa5k4Ls3qpdAyuwu5MeVKpI1nN2Q0J\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/yd7bdTUL4R1RjqJF7PcYJdt44k4VViLj/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/CIAUZ9S5ObswPej5z6HAFPaj3kIPtJJn\"}" size=481 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=419ca # [423620.883725] ca step-ca[203]: time="2026-09-09T05:07:20Z" level=info certificate="MIIB1DCCAXqgAwIBAgIRAJkZQ9YJfffNZx1qy+Kxbz4wCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTA5MDUwNjIwWhcNMjYxMjA4MDUwNzIwWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQuaDY41NjXQXzmsP0mcL6nOvSZ6cgspYf+5Q3GRhwoDXE8hbMQBvgGCHJq9oWDvqmC4GWjbARRUiwcFlhur+avo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFKMtX7HcV76PemyeFC7iWPdvghq/MB8GA1UdIwQYMBaAFIyb39UByLb1OGgcnj4IHZWsJ3yFMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIgEmsZzYmjzdqU+SW3SiDGVWrwn+3DQtJOe0lpoWhXQO0CIQDz56V0XNfRZShfNH64mmL3JG6ajFH06vvSixWHgjvNvw==" duration=1.814106ms duration-ns=1814106 fields.time="2026-09-09T05:07:20Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=clVQNXRWY0lrdDlUMmtodkRqWUlqS0l3eVQwWU90MG8 path=/acme/acme/certificate/CIAUZ9S5ObswPej5z6HAFPaj3kIPtJJn protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=70787dcc-7f8a-451d-8f86-42643cde15ce sans="map[dns:[ca.foo]]" serial=203503066655763372988860342677697294142 size=1344 status=200 subject=ca.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-09-09T05:06:20Z" valid-to="2026-12-08T05:07:20Z"420ca # [423620.884057] ca acme-order-renew-ca.foo-start[320]: 2026/09/09 05:07:20 [INFO] [ca.foo] Server responded with a certificate.421ca # [423620.889349] ca acme-order-renew-ca.foo-start[308]: + mv domainhash.txt certificates/422ca # [423620.891499] ca acme-order-renew-ca.foo-start[308]: + touch out/acme-success423ca # [423620.893491] ca acme-order-renew-ca.foo-start[308]: + cmp -s certificates/ca.foo.crt out/fullchain.pem424ca # [423620.894784] ca acme-order-renew-ca.foo-start[308]: + touch out/renewed425ca # [423620.896411] ca acme-order-renew-ca.foo-start[308]: + echo Installing new certificate426ca # [423620.896411] ca acme-order-renew-ca.foo-start[308]: Installing new certificate427ca # [423620.896458] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.crt out/fullchain.pem428ca # [423620.898041] ca acme-order-renew-ca.foo-start[353]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'429ca # [423620.898317] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.key out/key.pem430ca # [423620.900005] ca acme-order-renew-ca.foo-start[354]: 'certificates/ca.foo.key' -> 'out/key.pem'431ca # [423620.900353] ca acme-order-renew-ca.foo-start[308]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem432ca # [423620.901823] ca acme-order-renew-ca.foo-start[355]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'433ca # [423620.902083] ca acme-order-renew-ca.foo-start[308]: + ln -sf fullchain.pem out/cert.pem434ca # [423620.903712] ca acme-order-renew-ca.foo-start[308]: + cat out/key.pem out/fullchain.pem435ca # [423620.905346] ca acme-order-renew-ca.foo-start[308]: + for fixpath in out certificates436ca # [423620.905372] ca acme-order-renew-ca.foo-start[308]: + '[' -d out ']'437ca # [423620.905372] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=rX,o= out438ca # [423620.907049] ca acme-order-renew-ca.foo-start[308]: + chown -R acme:nginx out439ca # [423620.910060] ca acme-order-renew-ca.foo-start[308]: + for fixpath in out certificates440ca # [423620.910082] ca acme-order-renew-ca.foo-start[308]: + '[' -d certificates ']'441ca # [423620.910110] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=rX,o= certificates442ca # [423620.911800] ca acme-order-renew-ca.foo-start[308]: + chown -R acme:nginx certificates443ca # [423620.914510] ca acme-order-renew-ca.foo-start[308]: + chmod -R u=rwX,g=,o= accounts/.444ca # [423621.068557] ca systemd[1]: Reloading Nginx Web Server...445server # [423620.715872] server acme-order-renew-test.foo-start[270]: Waiting to acquire lock in /run/acme/446server # [423620.718375] server acme-order-renew-test.foo-start[270]: + set -euo pipefail447server # [423620.718452] server acme-order-renew-test.foo-start[270]: + echo ad12aa6741ce4bd2c108448server # [423620.718563] server acme-order-renew-test.foo-start[270]: + cmp -s domainhash.txt certificates/domainhash.txt449server # [423620.719810] server acme-order-renew-test.foo-start[270]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run450server # [423620.750937] server acme-order-renew-test.foo-start[281]: 2026/09/09 05:07:20 No key found for account none@none.tld. Generating a P256 key.451server # [423620.751302] server acme-order-renew-test.foo-start[281]: 2026/09/09 05:07:20 Saved key to accounts/ca.foo/none@none.tld/keys/none@none.tld.key452server # [423620.795395] server acme-order-renew-test.foo-start[281]: 2026/09/09 05:07:20 Could not create client: get directory at 'https://ca.foo/acme/acme/directory': Get "https://ca.foo/acme/acme/directory": GET https://ca.foo/acme/acme/directory giving up after 1 attempt(s): Get "https://ca.foo/acme/acme/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority453server # [423620.799648] server acme-order-renew-test.foo-start[270]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.454server # [423620.799648] server acme-order-renew-test.foo-start[270]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Self-signed certs are in place and dependant services will still start.455server # [423620.799718] server acme-order-renew-test.foo-start[270]: + exit 10456server # [423620.803007] server systemd[1]: acme-order-renew-test.foo.service: Main process exited, code=exited, status=10/n/a457server # [423620.803211] server systemd[1]: acme-order-renew-test.foo.service: Failed with result 'exit-code'.458server # [423620.808382] server systemd[1]: Failed to start Order (and renew) ACME certificate for test.foo.459server # [423620.808987] server systemd[1]: Startup finished in 3.845s.460ca # [423621.073876] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.461ca # [423621.074178] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.462ca # [423621.737133] ca nginx[371]: nginx: the configuration file /nix/store/xhml9fz6gx0h63h36sd1j5ba87wd00y2-nginx.conf syntax is ok463ca # [423621.737473] ca nginx[371]: nginx: configuration file /nix/store/xhml9fz6gx0h63h36sd1j5ba87wd00y2-nginx.conf test is successful464ca # [423622.282739] ca systemd[1]: Reloaded Nginx Web Server.465ca # [423622.283539] ca systemd[1]: Startup finished in 5.301s.466ca # [423622.635720] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...467ca: (finished: must succeed: systemctl restart acme-order-renew-ca.foo.service , in 3.99 seconds)468ca # [423623.255350] ca acme-order-renew-ca.foo-start[386]: Waiting to acquire lock in /run/acme/469ca # [423623.257857] ca acme-order-renew-ca.foo-start[386]: + set -euo pipefail470ca # [423623.257936] ca acme-order-renew-ca.foo-start[386]: + echo 88dc4fc401a6091a1bd9471ca # [423623.258051] ca acme-order-renew-ca.foo-start[386]: + cmp -s domainhash.txt certificates/domainhash.txt472ca # [423623.259418] ca acme-order-renew-ca.foo-start[386]: + '[' -e certificates/ca.foo.key ']'473ca # [423623.259418] ca acme-order-renew-ca.foo-start[386]: + '[' -e certificates/ca.foo.crt ']'474ca # [423623.259835] ca acme-order-renew-ca.foo-start[394]: ++ find accounts -name none@none.tld.key475ca # [423623.262108] ca acme-order-renew-ca.foo-start[386]: + '[' -n accounts/ca.foo_1443/none@none.tld/keys/none@none.tld.key ']'476ca # [423623.262157] ca acme-order-renew-ca.foo-start[386]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo renew --no-random-sleep --dynamic477ca # [423623.302407] ca step-ca[203]: time="2026-09-09T05:07:23Z" level=info duration="74.682µs" duration-ns=74682 fields.time="2026-09-09T05:07:23Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1f2d0679-31d7-4e85-b916-70baaa7a2c6e response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=478ca # [423623.302880] ca acme-order-renew-ca.foo-start[395]: 2026/09/09 05:07:23 [WARN] [ca.foo] acme: renewalInfo[get/post]: server does not advertise a renewal info endpoint479ca # [423623.302880] ca acme-order-renew-ca.foo-start[395]: 2026/09/09 05:07:23 [INFO] [ca.foo] The certificate expires at 2026-12-08T05:07:20Z, the renewal can be performed in 1439h59m36.711435541s: no renewal.480ca # [423623.303432] ca acme-order-renew-ca.foo-start[386]: + mv domainhash.txt certificates/481ca # [423623.305113] ca acme-order-renew-ca.foo-start[386]: + touch out/acme-success482ca # [423623.306548] ca acme-order-renew-ca.foo-start[386]: + cmp -s certificates/ca.foo.crt out/fullchain.pem483ca # [423623.307633] ca acme-order-renew-ca.foo-start[386]: + for fixpath in out certificates484ca # [423623.307664] ca acme-order-renew-ca.foo-start[386]: + '[' -d out ']'485ca # [423623.307664] ca acme-order-renew-ca.foo-start[386]: + chmod -R u=rwX,g=rX,o= out486ca # [423623.309174] ca acme-order-renew-ca.foo-start[386]: + chown -R acme:nginx out487ca # [423623.311627] ca acme-order-renew-ca.foo-start[386]: + for fixpath in out certificates488ca # [423623.311659] ca acme-order-renew-ca.foo-start[386]: + '[' -d certificates ']'489ca # [423623.311659] ca acme-order-renew-ca.foo-start[386]: + chmod -R u=rwX,g=rX,o= certificates490ca # [423623.313390] ca acme-order-renew-ca.foo-start[386]: + chown -R acme:nginx certificates491ca # [423623.315920] ca acme-order-renew-ca.foo-start[386]: + chmod -R u=rwX,g=,o= accounts/.492ca # [423623.448909] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.493ca # [423623.449286] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.494server: must succeed: systemctl restart acme-test.foo.service495server # [423626.472329] server systemd[1]: acme-test.foo.service: Deactivated successfully.496server # [423626.472701] server systemd[1]: Stopped Ensure certificate for test.foo.497server # [423626.474053] server systemd[1]: Stopping Ensure certificate for test.foo...498server # [423626.476552] server systemd[1]: Starting Ensure certificate for test.foo...499server: (finished: must succeed: systemctl restart acme-test.foo.service, in 0.62 seconds)500client: waiting for success: curl -v https://test.foo501* Host test.foo:443 was resolved.502* IPv6: 2001:db8:1::3503* IPv4: 192.168.1.3504* Trying [2001:db8:1::3]:443...505* ALPN: curl offers h2,http/1.1506} [5 bytes data]507* TLSv1.3 (OUT), TLS handshake, Client hello (1):508} [1552 bytes data]509* SSL Trust Anchors:510* OpenSSL default paths (fallback)511{ [5 bytes data]512* TLSv1.3 (IN), TLS handshake, Server hello (2):513{ [1210 bytes data]514* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):515{ [1 bytes data]516* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):517{ [19 bytes data]518* TLSv1.3 (IN), TLS handshake, Certificate (11):519{ [1010 bytes data]520* TLSv1.3 (IN), TLS handshake, CERT verify (15):521{ [110 bytes data]522* TLSv1.3 (IN), TLS handshake, Finished (20):523{ [52 bytes data]524* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):525} [1 bytes data]526* TLSv1.3 (OUT), TLS handshake, Finished (20):527} [52 bytes data]528* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey529* ALPN: server accepted h2530* Server certificate:531* subject: CN=test.foo532* start date: Sep 9 05:07:19 2026 GMT533* expire date: Oct 9 05:07:19 2028 GMT534* issuer: CN=minica root ca 6fa36f535* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384536* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384537* subjectAltName: "test.foo" matches cert's "test.foo"538* OpenSSL verify result: 13539* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)540* closing connection #0541curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)542More details here: https://curl.se/docs/sslcerts.html543544curl failed to verify the legitimacy of the server and therefore could not545establish a secure connection to it. To learn more about this situation and546how to fix it, please visit the webpage mentioned above.547server # [423627.034730] server acme-test.foo-start[316]: Waiting to acquire lock in /run/acme/548server # [423627.038460] server acme-test.foo-start[316]: + '[' -e out/acme-success ']'549server # [423627.038507] server acme-test.foo-start[316]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=550server # [423627.054360] server acme-test.foo-start[326]: + cd test.foo551server # [423627.054642] server acme-test.foo-start[326]: + cp -vp cert.pem ../out/cert.pem552server # [423627.056823] server acme-test.foo-start[327]: 'cert.pem' -> '../out/cert.pem'553server # [423627.057118] server acme-test.foo-start[326]: + cp -vp key.pem ../out/key.pem554server # [423627.058679] server acme-test.foo-start[326]: 'key.pem' -> '../out/key.pem'555server # [423627.058964] server acme-test.foo-start[316]: + cat out/cert.pem ca/cert.pem556server # [423627.060877] server acme-test.foo-start[316]: + cp ca/cert.pem out/chain.pem557server # [423627.062959] server acme-test.foo-start[316]: + cat out/key.pem out/fullchain.pem558server # [423627.065527] server acme-test.foo-start[316]: + for fixpath in out certificates559server # [423627.065566] server acme-test.foo-start[316]: + '[' -d out ']'560server # [423627.065566] server acme-test.foo-start[316]: + chmod -R u=rwX,g=rX,o= out561server # [423627.067222] server acme-test.foo-start[316]: + chown -R acme:nginx out562server # [423627.071080] server acme-test.foo-start[316]: + for fixpath in out certificates563server # [423627.071120] server acme-test.foo-start[316]: + '[' -d certificates ']'564server # [423627.075071] server systemd[1]: Finished Ensure certificate for test.foo.565server # [423627.079998] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...566server # [423627.627102] server acme-order-renew-test.foo-start[334]: Waiting to acquire lock in /run/acme/567server # [423627.630173] server acme-order-renew-test.foo-start[334]: + set -euo pipefail568server # [423627.630269] server acme-order-renew-test.foo-start[334]: + echo ad12aa6741ce4bd2c108569server # [423627.630362] server acme-order-renew-test.foo-start[334]: + cmp -s domainhash.txt certificates/domainhash.txt570server # [423627.631801] server acme-order-renew-test.foo-start[334]: + lego --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo run571server # [423627.689976] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] acme: Registering account for none@none.tld572server # [423627.735318] server acme-order-renew-test.foo-start[342]: !!!! HEADS UP !!!!573server # [423627.735318] server acme-order-renew-test.foo-start[342]: Your account credentials have been saved in your574server # [423627.735318] server acme-order-renew-test.foo-start[342]: configuration directory at "accounts".575server # [423627.735318] server acme-order-renew-test.foo-start[342]: You should make a secure backup of this folder now. This576server # [423627.735318] server acme-order-renew-test.foo-start[342]: configuration directory will also contain private keys577server # [423627.735318] server acme-order-renew-test.foo-start[342]: generated by lego and certificates obtained from the ACME578server # [423627.735318] server acme-order-renew-test.foo-start[342]: server. Making regular backups of this folder is ideal.579server # [423627.735554] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: Obtaining bundled SAN certificate580server # [423627.815070] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] AuthURL: https://ca.foo/acme/acme/authz/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B581server # [423627.815070] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: Could not find solver for: tls-alpn-01582server # [423627.815070] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: use http-01 solver583server # [423627.815070] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: Trying to solve HTTP-01584server # [423627.825732] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] The server validated our request585server # [423627.840145] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] acme: Validations succeeded; requesting certificates586server # [423627.860241] server acme-order-renew-test.foo-start[342]: 2026/09/09 05:07:27 [INFO] [test.foo] Server responded with a certificate.587server # [423627.866288] server acme-order-renew-test.foo-start[334]: + mv domainhash.txt certificates/588server # [423627.868212] server acme-order-renew-test.foo-start[334]: + touch out/acme-success589server # [423627.869891] server acme-order-renew-test.foo-start[334]: + cmp -s certificates/test.foo.crt out/fullchain.pem590server # [423627.870971] server acme-order-renew-test.foo-start[334]: + touch out/renewed591server # [423627.873049] server acme-order-renew-test.foo-start[334]: + echo Installing new certificate592server # [423627.873049] server acme-order-renew-test.foo-start[334]: Installing new certificate593server # [423627.873111] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.crt out/fullchain.pem594server # [423627.874680] server acme-order-renew-test.foo-start[373]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'595server # [423627.874939] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.key out/key.pem596server # [423627.876538] server acme-order-renew-test.foo-start[374]: 'certificates/test.foo.key' -> 'out/key.pem'597server # [423627.876727] server acme-order-renew-test.foo-start[334]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem598server # [423627.878011] server acme-order-renew-test.foo-start[375]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'599server # [423627.878195] server acme-order-renew-test.foo-start[334]: + ln -sf fullchain.pem out/cert.pem600ca # [423627.689428] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration="69.281µs" duration-ns=69281 fields.time="2026-09-09T05:07:27Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=833dbada-6e5c-46fc-a2ff-9f4a1c649ccf response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=601ca # [423627.726112] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=32.680693ms duration-ns=32680693 fields.time="2026-09-09T05:07:27Z" method=HEAD name=ca nonce=Y0IwYzVIeGZpeU5XbmcxQWZBa0ZGS013S2xiWXZ1VEY path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=01875a49-e3dd-4258-964e-f4062c88e098 size=0 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=602ca # [423627.734753] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=4.927309ms duration-ns=4927309 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=S2dnYjRwVTN2VU1FS3R0d0czdkw3Q2MxMnBkNnVUdVY path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=97fed373-c5fe-4992-aef0-134d39f58542 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/zk5Iq9g6SzZWv5cqS4GHNoq7EskNTewT/orders\"}" size=138 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=603ca # [423627.741155] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=3.310886ms duration-ns=3310886 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=Q3lHZGpsa1ZTVExlTThYcm4ybUFlS29vMzlXeXVXeW8 path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=56590e96-4065-4642-91ec-7deee9f30e0c response="{\"id\":\"DpDXKbzcoEcsk1113H9vGri8xDi74QND\",\"status\":\"pending\",\"expires\":\"2026-09-10T05:07:27Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-09T05:06:27Z\",\"notAfter\":\"2026-12-08T05:07:27Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B\"],\"finalize\":\"https://ca.foo/acme/acme/order/DpDXKbzcoEcsk1113H9vGri8xDi74QND/finalize\"}" size=384 status=201 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=604ca # [423627.814547] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=13.931154ms duration-ns=13931154 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=RlcxYWdiYUdKRlNaVW9MTVhCYUZXekpncGFaM0VOV2c path=/acme/acme/authz/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B protocol=HTTP/1.1 referer= remote-address="::1" request-id=71774919-408b-4bce-b3a4-c16e5180a7b8 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"Uv7y9PBTdGs7QhvJC1uW69WQ2PkoaHrh\",\"url\":\"https://ca.foo/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/DJKbt2KgLYG87RsFbEawU90LCUcRQqUN\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"Uv7y9PBTdGs7QhvJC1uW69WQ2PkoaHrh\",\"url\":\"https://ca.foo/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/wKbIn8PvyeNHJn7Jic5fEDRu00qyLvMG\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"Uv7y9PBTdGs7QhvJC1uW69WQ2PkoaHrh\",\"url\":\"https://ca.foo/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/QaKLmuwiQP5uBixHS6LWVAc9eexGKqRw\"}],\"wildcard\":false,\"expires\":\"2026-09-10T05:07:27Z\"}" size=706 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=605ca # [423627.825167] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=7.516264ms duration-ns=7516264 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=OVV1MDcyV0FtRVZncFZrcG9QN1BTMlBCa2xLZUg2bXY path=/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/wKbIn8PvyeNHJn7Jic5fEDRu00qyLvMG protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=611a40d2-9d07-4e75-a135-f1865ab15224 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"Uv7y9PBTdGs7QhvJC1uW69WQ2PkoaHrh\",\"validated\":\"2026-09-09T05:07:27Z\",\"url\":\"https://ca.foo/acme/acme/challenge/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B/wKbIn8PvyeNHJn7Jic5fEDRu00qyLvMG\"}" size=223 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=606ca # [423627.854195] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info duration=10.268303ms duration-ns=10268303 fields.time="2026-09-09T05:07:27Z" method=POST name=ca nonce=bjdwSmNOeHdCTmhtdHR0SGJZSDJJbmdadDMzcXpKaGs path=/acme/acme/order/DpDXKbzcoEcsk1113H9vGri8xDi74QND/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=c1cce3a1-d4ac-464b-8395-e204a30931c7 response="{\"id\":\"DpDXKbzcoEcsk1113H9vGri8xDi74QND\",\"status\":\"valid\",\"expires\":\"2026-09-10T05:07:27Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-09T05:06:27Z\",\"notAfter\":\"2026-12-08T05:07:27Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/VQ60m5nIAMigp72PvLY1GhFZ0oms4o4B\"],\"finalize\":\"https://ca.foo/acme/acme/order/DpDXKbzcoEcsk1113H9vGri8xDi74QND/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/UKk7OzSSfjsbsEffPK3Mjek5EobZodiz\"}" size=468 status=200 user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id=607ca # [423627.859779] ca step-ca[203]: time="2026-09-09T05:07:27Z" level=info certificate="MIIB2DCCAX6gAwIBAgIRAKG8wJ6D4qM3hXl5ClU0dZ8wCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTA5MDUwNjI3WhcNMjYxMjA4MDUwNzI3WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE+7omsDhv2gYKZL9aUlfKW9IDN6mri0Yw+SqVu9g08JmAp8gh6dmeBSIRfw60Upf/cYpZ81lEegApiiypt3qhijgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUpgwA6mYKxe+S8bzEGRELJpWiRcgwHwYDVR0jBBgwFoAUjJvf1QHItvU4aByePggdlawnfIUwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0gAMEUCICCfBRpYiethHP9ysSJiIjJkJiKTJ5yUWo7msm/WQLJpAiEA+qsZurlC8T5m94eg9irnvTSNRjWKQaHEBM+nRQMDMBo=" duration=2.584676ms duration-ns=2584676 fields.time="2026-09-09T05:07:27Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=TExRMFhkaWdNZzEwbFppU0hoYjBueDVVdU1UQnI2M3I path=/acme/acme/certificate/UKk7OzSSfjsbsEffPK3Mjek5EobZodiz protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=1f59d668-bf70-4330-a2a5-ef626e63f44f sans="map[dns:[test.foo]]" serial=214985765912286105797918001234357548447 size=1348 status=200 subject=test.foo user-agent="lego-cli/4.35.2 xenolf-acme/4.35.2 (release; linux; arm64)" user-id= valid-from="2026-09-09T05:06:27Z" valid-to="2026-12-08T05:07:27Z"608* Trying [2001:db8:1::3]:443...609* Host test.foo:443 was resolved.610* IPv6: 2001:db8:1::3611* IPv4: 192.168.1.3612* ALPN: curl offers h2,http/1.1613} [5 bytes data]614* TLSv1.3 (OUT), TLS handshake, Client hello (1):615} [1552 bytes data]616* SSL Trust Anchors:617* OpenSSL default paths (fallback)618{ [5 bytes data]619* TLSv1.3 (IN), TLS handshake, Server hello (2):620{ [1210 bytes data]621* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):622{ [1 bytes data]623* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):624{ [19 bytes data]625* TLSv1.3 (IN), TLS handshake, Certificate (11):626{ [1010 bytes data]627* TLSv1.3 (IN), TLS handshake, CERT verify (15):628{ [112 bytes data]629* TLSv1.3 (IN), TLS handshake, Finished (20):630{ [52 bytes data]631* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):632} [1 bytes data]633* TLSv1.3 (OUT), TLS handshake, Finished (20):634} [52 bytes data]635* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey636* ALPN: server accepted h2637* Server certificate:638* subject: CN=test.foo639* start date: Sep 9 05:07:19 2026 GMT640* expire date: Oct 9 05:07:19 2028 GMT641* issuer: CN=minica root ca 6fa36f642* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384643* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384644* subjectAltName: "test.foo" matches cert's "test.foo"645* OpenSSL verify result: 13646* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)647* closing connection #0648curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)649More details here: https://curl.se/docs/sslcerts.html650651curl failed to verify the legitimacy of the server and therefore could not652establish a secure connection to it. To learn more about this situation and653how to fix it, please visit the webpage mentioned above.654server # [423627.879684] server acme-order-renew-test.foo-start[334]: + cat out/key.pem out/fullchain.pem655server # [423627.881528] server acme-order-renew-test.foo-start[334]: + for fixpath in out certificates656server # [423627.881558] server acme-order-renew-test.foo-start[334]: + '[' -d out ']'657server # [423627.881558] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=rX,o= out658server # [423627.882949] server acme-order-renew-test.foo-start[334]: + chown -R acme:nginx out659server # [423627.886126] server acme-order-renew-test.foo-start[334]: + for fixpath in out certificates660server # [423627.886157] server acme-order-renew-test.foo-start[334]: + '[' -d certificates ']'661server # [423627.886157] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=rX,o= certificates662server # [423627.887895] server acme-order-renew-test.foo-start[334]: + chown -R acme:nginx certificates663server # [423627.890252] server acme-order-renew-test.foo-start[334]: + chmod -R u=rwX,g=,o= accounts/.664server # [423627.984327] server systemd[1]: Reloading Nginx Web Server...665server # [423627.988796] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.666server # [423627.988995] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.667server # [423628.559202] server nginx[391]: nginx: the configuration file /nix/store/vbja0ggj33nc6zf5lkzfrkd8ijv2r819-nginx.conf syntax is ok668server # [423628.559775] server nginx[391]: nginx: configuration file /nix/store/vbja0ggj33nc6zf5lkzfrkd8ijv2r819-nginx.conf test is successful669* Host test.foo:443 was resolved.670* IPv6: 2001:db8:1::3671* IPv4: 192.168.1.3672* Trying [2001:db8:1::3]:443...673* ALPN: curl offers h2,http/1.1674} [5 bytes data]675* TLSv1.3 (OUT), TLS handshake, Client hello (1):676} [1552 bytes data]677* SSL Trust Anchors:678* OpenSSL default paths (fallback)679{ [5 bytes data]680* TLSv1.3 (IN), TLS handshake, Server hello (2):681{ [1210 bytes data]682* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):683{ [1 bytes data]684* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):685{ [19 bytes data]686* TLSv1.3 (IN), TLS handshake, Certificate (11):687{ [930 bytes data]688* TLSv1.3 (IN), TLS handshake, CERT verify (15):689{ [80 bytes data]690* TLSv1.3 (IN), TLS handshake, Finished (20):691{ [52 bytes data]692* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):693} [1 bytes data]694* TLSv1.3 (OUT), TLS handshake, Finished (20):695} [52 bytes data]696* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey697* ALPN: server accepted h2698* Server certificate:699* subject: CN=test.foo700* start date: Sep 9 05:06:27 2026 GMT701* expire date: Dec 8 05:07:27 2026 GMT702* issuer: CN=Clan Intermediate CA703* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256704* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256705* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256706* subjectAltName: "test.foo" matches cert's "test.foo"707* OpenSSL verify result: 0708* SSL certificate verified via OpenSSL.709* Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 55782 710 % Total % Received % Xferd Average Speed Time Time Time Current711 Dload Upload Total Spent Left Speed712 0 0 0 0 0 0 0 0 0* using HTTP/2713* [HTTP/2] [1] OPENED stream for https://test.foo/714* [HTTP/2] [1] [:method: GET]715* [HTTP/2] [1] [:scheme: https]716* [HTTP/2] [1] [:authority: test.foo]717* [HTTP/2] [1] [:path: /]718* [HTTP/2] [1] [user-agent: curl/8.21.0]719* [HTTP/2] [1] [accept: */*]720} [5 bytes data]721722723724725726* Request completely sent off727{ [5 bytes data]728* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):729{ [265 bytes data]730* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):731{ [265 bytes data]732733734735736737738739{ [5 bytes data]740100 20 100 20 0 0 820 0 0741* Connection #0 to host test.foo:443 left intact742client: (finished: waiting for success: curl -v https://test.foo, in 2.15 seconds)743client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2744Certificate:745 Data:746 Version: 3 (0x2)747 Serial Number:748 a1:bc:c0:9e:83:e2:a3:37:85:79:79:0a:55:34:75:9f749 Signature Algorithm: ecdsa-with-SHA256750 Issuer: CN=Clan Intermediate CA751 Validity752 Not Before: Sep 9 05:06:27 2026 GMT753 Not After : Dec 8 05:07:27 2026 GMT754 Subject: CN=test.foo755 Subject Public Key Info:756 Public Key Algorithm: id-ecPublicKey757 Public-Key: (256 bit)758 pub:759 04:4f:bb:a2:6b:03:86:fd:a0:60:a6:4b:f5:a5:25:760 7c:a5:bd:20:33:7a:9a:b8:b4:63:0f:92:a9:5b:bd:761 83:4f:09:98:0a:7c:82:1e:9d:99:e0:52:21:17:f0:762 eb:45:29:7f:f7:18:a5:9f:35:94:47:a0:02:98:a2:763 ca:9b:77:aa:18764 ASN1 OID: prime256v1765 NIST CURVE: P-256766 X509v3 extensions:767 X509v3 Key Usage: critical768 Digital Signature769 X509v3 Extended Key Usage: 770 TLS Web Server Authentication, TLS Web Client Authentication771 X509v3 Subject Key Identifier: 772 A6:0C:00:EA:66:0A:C5:EF:92:F1:BC:C4:19:11:0B:26:95:A2:45:C8773 X509v3 Authority Key Identifier: 774 8C:9B:DF:D5:01:C8:B6:F5:38:68:1C:9E:3E:08:1D:95:AC:27:7C:85775 X509v3 Subject Alternative Name: 776 DNS:test.foo777 1.3.6.1.4.1.37476.9000.64.1: 778 0......acme..779 Signature Algorithm: ecdsa-with-SHA256780 Signature Value:781 30:45:02:20:20:9f:05:1a:58:89:eb:61:1c:ff:72:b1:22:62:782 22:32:64:26:22:93:27:9c:94:5a:8e:e6:b2:6f:d6:40:b2:69:783 02:21:00:fa:ab:19:ba:b9:42:f1:3e:66:f7:87:a0:f6:2a:e7:784 bd:34:8d:46:35:8a:41:a1:c4:04:cf:a7:45:03:03:30:1a785client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.04 seconds)786(finished: run the VM test script, in 12.80 seconds)787test script finished in 12.84s788cleanup789kill NspawnMachine (pid 53)790kill NspawnMachine (pid 55)791kill NspawnMachine (pid 56)792server # [423629.128397] server systemd[1]: Reloaded Nginx Web Server.793Container ca terminated by signal KILL.794Container client terminated by signal KILL.795Container server terminated by signal KILL.796(finished: cleanup, in 0.54 seconds)