this derivation will be built: /nix/store/7d0s223mdfilqwn4423y6yy4ag45w9ya-container-test-run-certificates.drv these 109 paths will be fetched (0.0 KiB download, 164.0 MiB unpacked): /nix/store/i67rgn32h4p67jyar2x6wa16rfkcd456-10-acme.conf /nix/store/l6md3bck3r0ivi27a2zq1h0lb3sk2h91-X-Reload-Triggers-systemd-networkd /nix/store/2yxq02q85plcmzcx0ryjxmdpzglw7s23-X-Restart-Triggers-acme-ca.foo /nix/store/bbmbvqn119pi9ix7bklyv6jra50abjh8-X-Restart-Triggers-acme-test.foo /nix/store/arsamz0mw2jwhhr7n87lng4as46irigk-X-Restart-Triggers-dbus-broker /nix/store/j8iglcvhcz89l5gd8rp6y3fzjvln0klb-X-Restart-Triggers-dbus-broker /nix/store/wvbq98ly4r3b1k18np5xw3dzlrvcmv4m-X-Restart-Triggers-dbus-broker /nix/store/0i4z6rkfs2264b0if6794djgbgcpzc2k-X-Restart-Triggers-step-ca /nix/store/7kpdr1il6l6d50qabn8bziwg8gr4scgz-X-Restart-Triggers-systemd-sysctl /nix/store/8yrc55wsdpy12b9nhnpsi482xxjmd1ns-X-Restart-Triggers-systemd-tmpfiles-resetup /nix/store/m2cx2qcaglpjm5n0jyh4ppf02q5k33f6-X-Restart-Triggers-systemd-tmpfiles-resetup /nix/store/czvhhicm7ng27l46f95jyp92jdmy4jaz-acme-postrun /nix/store/ydwcng5hw1sghl009ksrscp3xz98f6ny-acme-postrun /nix/store/da8yk95nldhzigx6vj44nclzlx1mvdyk-acme-setup-privileged /nix/store/mi5gf4m1r17lhhnxwspbiqazqypazgb8-acme-setup-privileged /nix/store/4rdrczkqrfypqiw7763v3zb42j78qbsw-ca.json /nix/store/7fja9smvws8jy01gf4y811gjbjr3ip9h-closure-info /nix/store/layfy1462fdv5vipwxvrgk2f6fzdnxhv-closure-info /nix/store/wzfa0jni453q6mm7lp3rjkk1rxhc7b98-closure-info /nix/store/fqj5xa42bdmgll2sl74sbhalkp718d6v-dbus-1 /nix/store/ha1nv1bha9bh803hkl4973kcqxb1lyid-dbus-1 /nix/store/ryv564yxn5c5xgbn363f4dq5h6h1id0p-dbus-1 /nix/store/7jgiaq1v30m1kwyc1cj4n9a4f4lfz8bc-decrypt-age-secrets /nix/store/il4ggc7jw756x152yfd3sgcvrmq4jmvr-decrypt-age-secrets /nix/store/0mzv0mv0li80kf5lig2ck8d51waa92gx-etc /nix/store/ki9v23h1z937jxvz6x4mzl4mgkhx32vp-etc /nix/store/qn9b970g0i399069946650bpkc5nmvaz-etc /nix/store/1g1zxan39vyymy6420646xwdw2izhvjs-etc-hostname /nix/store/57isjw5shssjjrb903cpfxcmni077nxw-etc-hostname /nix/store/71j89ia2vn2kjrskv88a0n8542s4yah1-etc-sysctl.d-60-nixos.conf /nix/store/zxasafkr18yacq95vgcqvf49q7lfd2c9-firewall-reload /nix/store/zaf3pi89cjvk8z81iai0q48nfcdiix5j-firewall-start /nix/store/10r8p4z3azh9jk6ya76x90ngrxd3jnzr-flock-0.4.0 /nix/store/2ia6rpaldysdpp4fbsg1bpr64k4jr2gl-hosts /nix/store/lrj58g86il8zk5skf0inkci6amz4sm6x-hosts /nix/store/qha93llmfqaln2jhhj0lnf7mi1jcpx8g-hosts /nix/store/ypiq4rqsacs1lqr9zc0jv9sir3kikyp8-lego-4.35.2 /nix/store/qfvrvwgd2l9asai7zmgmd7vbqqica74l-minica-1.1.0 /nix/store/l1i1cjqc3hjdfc4f17h3bfsdmgpv7zbi-nginx-1.30.4 /nix/store/z8qhnh2ssnhzc756kq5dgm31n34x769a-nginx-recommended-proxy_set_header-headers.conf /nix/store/8j8hmwpxbvcw8fn1y61ksmw1cpjsva72-nginx.conf /nix/store/kns42hrpdhgbxjbd6bgyp10s2rcmmfhq-nginx.conf /nix/store/fr8qjv1130ks2ldy55rs5p4zs10mxd08-nixos-system-ca-test /nix/store/0m0vvpadd9qsakk0a7z9jwhf315xxcb6-nixos-system-client-test /nix/store/nazgk4c2i78x92n8qya5szjqypjb9w8b-nixos-system-server-test /nix/store/95nsryip31wpdyk09yvd8bzx1rwb9i2x-nixos-test-driver-certificates /nix/store/k0qa6263h5lvnlcynk8j050gmgar4ckb-nixos-tmpfiles.d /nix/store/n0ib10i3gq8spc8di693yfvghbhp8pbk-nss-cacert-3.126 /nix/store/lbwgig1lhkf6i46f2ff54qhngsp5jymx-nss-cacert-3.126-p11kit /nix/store/wmgr6x3sf7k65bx04k27xbx1b1a99krz-openssl-4.0.2 /nix/store/9wykdg97qljhccjwpayqw5y4havbmzvc-step-ca-0.29.0 /nix/store/9wrvp06ixqlqmx4f4djiwqbzsfc8si9m-system-generators /nix/store/q4y6vm2ll1x4i34jx2yddfzkm4b1g99w-system-generators /nix/store/1ngg10x7p6pyv9nk036j9j0ha9dk93i3-system-path /nix/store/j9qyibg9fl1kr7fay71icwkgkk2qhmcp-system-path /nix/store/jmwb46apz9n6jhifyncd1yaqv278ddky-system-path /nix/store/l4qbk9shxnxrl73vprxf107p7n3djn0s-system-shutdown /nix/store/mg374pa9yydrhz143c8qb1wdknqyiwv1-system-shutdown /nix/store/19a532v6ss3vnfg3pnpq6haykiw208zl-system-units /nix/store/85y9dn64wmq2g4ds21j4rd8zl2x3yqzw-system-units /nix/store/f1q74panv6qxywz2yflahv0yf22fcwya-system-units /nix/store/qp5mqx98gd4w18xx0vj47yp2hhxz611n-testScript /nix/store/6fa9csy7gnwjnxyq7pkkqcbr143ifc2p-tmpfiles.d /nix/store/q6ckk524k6ngl9hcbl45c3r0ibinsbqg-tmpfiles.d /nix/store/c89qfgbngmff1x1ld9pcxxlg05kplnpz-unit-40-eth1.network /nix/store/96fli3rdzda9rr4jyd22p5n09sffdm0m-unit-acme-account-2c44cb477b4787b2cf13.target /nix/store/30ibad2vvmip9pj29ydmnrcd62r4binw-unit-acme-account-d22a46d9459bf683a338.target /nix/store/f1vh5dchmzm151gbbywdbidbgaia2imy-unit-acme-ca.foo.service /nix/store/zy6rhqzgvq0hk0vxkdhw407cby30ibnh-unit-acme-order-renew-ca.foo.service /nix/store/q34fflxdf783pws2frag2arpkp52gy9z-unit-acme-order-renew-test.foo.service /nix/store/wyzfp9jpkczdcwaqskycdyz3fshdfvja-unit-acme-renew-ca.foo.timer /nix/store/1fwqw19yq3zd36a4fw928wi4090ckzdx-unit-acme-renew-test.foo.timer /nix/store/s8baapnzv0kzs66wq91i9yncya86j6l7-unit-acme-setup.service /nix/store/zk9p7k54c0wj77ln9m1m6nr5g4xq8qg7-unit-acme-setup.service /nix/store/wlb0cwjni3h9z0qfb7l4x8h66q2bm7jf-unit-acme-test.foo.service /nix/store/2z5i0xaf0gm8yddp94a41rhy9rd9fpy4-unit-dbus-broker.service /nix/store/3d71f5kscrawsaj1pl5xawsgv3i531m4-unit-dbus-broker.service /nix/store/h3wn6iw3nwim0zqxrnwblvycs37hf3rg-unit-dbus-broker.service /nix/store/hs5224wq996140hy3ax53q05sckms67g-unit-dbus-broker.service /nix/store/qffhslkd2sn9zf0wkxql4cpqjcr3734g-unit-dbus-broker.service /nix/store/wx29sy896lh7zpimp0d455ig8jww2454-unit-dbus-broker.service /nix/store/g6hw4bzapv317g2ka0q7adkqhab5fiyk-unit-firewall.service /nix/store/1rxkcvj5h644rw5dc2gpwk6ffd77vvl3-unit-nginx-config-reload.service /nix/store/9rhkvjy66p1p37c6kn4r1jgjk8mkpp03-unit-nginx-config-reload.service /nix/store/0z10a518zwskl78dp7mcy0xjqy0djxc9-unit-nginx.service /nix/store/vkcskgl18xbz6x21azc3mmzbijvzxx85-unit-nginx.service /nix/store/6snhcih0pikzwsv860mcp7pgmxps93fk-unit-nix-daemon.service /nix/store/rl3vvw1avbzjfcnsvfp634dhlmnsg4if-unit-script-acme-ca.foo-start /nix/store/w845vci7njd6pf7z6acfmwpyqzc9lss9-unit-script-acme-order-renew-ca.foo-start /nix/store/xq8lyic9rcdbq1nwhv4cf3sjy45vl31x-unit-script-acme-order-renew-test.foo-start /nix/store/hikqz52pa4kcy5pxdnpjqxjjcdfmjcpi-unit-script-acme-setup-start /nix/store/zq6mmng2hvyirzza94lb291kl5a2qyyb-unit-script-acme-test.foo-start /nix/store/5ccyg7wah49y4dcp4s1a6pf5z0dcvd8g-unit-script-nginx-pre-start /nix/store/qcml6bxc3qyj3dr73wv11x24f95jin3j-unit-script-nginx-pre-start /nix/store/iy91r6s2xi9cyq3dcgb0iaax1banx8c8-unit-step-ca.service /nix/store/x1hmqpang5rznqh1z3fyny8kwwxhf17i-unit-systemd-networkd.service /nix/store/00vp7y3ngfjs71hh1xjqbcr92dliflgh-unit-systemd-sysctl.service /nix/store/clf852az2rrbm9a5dd36imfvnirvvxvb-unit-systemd-tmpfiles-resetup.service /nix/store/kkw9360pvmsd2500x30cjys1s68mjcx7-unit-systemd-tmpfiles-resetup.service /nix/store/7wwa6c4g3w2nblga6f365jcdyjv4gvrf-user-generators /nix/store/zp126qbq3krjbzwis6x5x2cpgpm27v1y-user-generators /nix/store/19apn2hx2qbih37cvd9i3bcxc88q0pww-user-units /nix/store/dcprmc1cxs6gpr6sbmghbakr0bhk2j3d-user-units /nix/store/j8kdpdb8b6xmgs8vny76fc2l9lk9ygck-user-units /nix/store/kffc9xp6gxnr91isdnpkj7kyvg66y8bd-users-groups.json /nix/store/l6dyj3pqbf3cjsc9zndi9p42wsl1ias6-users-groups.json /nix/store/qa0057hjk5pdvqphnziv5jdzq2wvpwwk-users-groups.json /nix/store/4nf8m4alj2j7j6z5kzww76i31a9w2pnr-vars-check-certificates /nix/store/smxlbj0r6pvipvv2xih0l9l0nlh6369a-zlib-ng-2.3.3 building '/nix/store/7d0s223mdfilqwn4423y6yy4ag45w9ya-container-test-run-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' building '/nix/store/7d0s223mdfilqwn4423y6yy4ag45w9ya-container-test-run-certificates.drv' container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> start_all, machines, driver, Machine, wait_for_signal container-test-run-certificates> Starting ca container-test-run-certificates> Starting client container-test-run-certificates> Starting server container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> <<< NixOS Stage 2 >>> container-test-run-certificates> container-test-run-certificates> booting system configuration /nix/store/fr8qjv1130ks2ldy55rs5p4zs10mxd08-nixos-system-ca-test container-test-run-certificates> running activation script... container-test-run-certificates> setting up /etc... container-test-run-certificates> 2: host0@if4: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 container-test-run-certificates> link/ether 42:06:76:42:a9:8d brd ff:ff:ff:ff:ff:ff link-netnsid 0 container-test-run-certificates> setting up age secrets... container-test-run-certificates> starting systemd... container-test-run-certificates> systemd 260.2 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE) container-test-run-certificates> Detected virtualization systemd-nspawn. container-test-run-certificates> Detected architecture x86-64. container-test-run-certificates> Detected first boot. container-test-run-certificates> Initializing machine ID from container UUID. container-test-run-certificates> Applying preset policy. container-test-run-certificates> Populated /etc with preset unit settings. container-test-run-certificates> Queued start job for default target Multi-User System. container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> <<< Welcome to NixOS test (x86_64) - console >>> container-test-run-certificates> + systemd-run /bin/sh -c '/nix/store/61685rbaxmpigwi3z23i33sv3jyfl70q-coreutils-9.11/bin/sleep 999999999 && echo 90545f3b-0814-478a-b384-c3c7a1c78a92' container-test-run-certificates> Running as unit: run-p448-i6529028.service; invocation ID: 85c38f723efc4bdbbf5367dc309b8322 container-test-run-certificates> To attach to container ca run on the same machine that runs the test: container-test-run-certificates> sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*90545f3b-0814-478a-b384-c3c7a1c78a92') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash container-test-run-certificates> container-test-run-certificates> To inject external network and continue test, run: container-test-run-certificates> sudo /nix/store/h3l4z7p6wny3phbckwwhy1i2g52pdnj4-python3-3.13.15/bin/python3.13 /nix/store/f960jm4nawb9zr6cb9d0vfpb7hifp96b-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 90545f3b-0814-478a-b384-c3c7a1c78a92 container-test-run-certificates> container-test-run-certificates> <<< NixOS Stage 2 >>> container-test-run-certificates> container-test-run-certificates> booting system configuration /nix/store/0m0vvpadd9qsakk0a7z9jwhf315xxcb6-nixos-system-client-test container-test-run-certificates> running activation script... container-test-run-certificates> setting up /etc... container-test-run-certificates> 2: host0@if3: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 container-test-run-certificates> link/ether 2a:42:35:28:b1:2f brd ff:ff:ff:ff:ff:ff link-netnsid 0 container-test-run-certificates> setting up age secrets... container-test-run-certificates> starting systemd... container-test-run-certificates> systemd 260.2 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE) container-test-run-certificates> Detected virtualization systemd-nspawn. container-test-run-certificates> Detected architecture x86-64. container-test-run-certificates> Detected first boot. container-test-run-certificates> Initializing machine ID from container UUID. container-test-run-certificates> Applying preset policy. container-test-run-certificates> Populated /etc with preset unit settings. container-test-run-certificates> Queued start job for default target Multi-User System. container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> <<< Welcome to NixOS test (x86_64) - console >>> container-test-run-certificates> + systemd-run /bin/sh -c '/nix/store/61685rbaxmpigwi3z23i33sv3jyfl70q-coreutils-9.11/bin/sleep 999999999 && echo 37abaa74-5323-4a5b-a8b9-5263c7ad5fbb' container-test-run-certificates> Running as unit: run-p304-i6529031.service; invocation ID: ce228582e4be4e0d8b33cf2ae459228c container-test-run-certificates> To attach to container client run on the same machine that runs the test: container-test-run-certificates> sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*37abaa74-5323-4a5b-a8b9-5263c7ad5fbb') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash container-test-run-certificates> container-test-run-certificates> To inject external network and continue test, run: container-test-run-certificates> sudo /nix/store/h3l4z7p6wny3phbckwwhy1i2g52pdnj4-python3-3.13.15/bin/python3.13 /nix/store/f960jm4nawb9zr6cb9d0vfpb7hifp96b-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 37abaa74-5323-4a5b-a8b9-5263c7ad5fbb container-test-run-certificates> container-test-run-certificates> <<< NixOS Stage 2 >>> container-test-run-certificates> container-test-run-certificates> booting system configuration /nix/store/nazgk4c2i78x92n8qya5szjqypjb9w8b-nixos-system-server-test container-test-run-certificates> running activation script... container-test-run-certificates> setting up /etc... container-test-run-certificates> 2: host0@if5: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 container-test-run-certificates> link/ether be:aa:dd:39:86:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 0 container-test-run-certificates> setting up age secrets... container-test-run-certificates> starting systemd... container-test-run-certificates> systemd 260.2 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE) container-test-run-certificates> Detected virtualization systemd-nspawn. container-test-run-certificates> Detected architecture x86-64. container-test-run-certificates> Detected first boot. container-test-run-certificates> Initializing machine ID from container UUID. container-test-run-certificates> Applying preset policy. container-test-run-certificates> Populated /etc with preset unit settings. container-test-run-certificates> Queued start job for default target Multi-User System. container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> <<< Welcome to NixOS test (x86_64) - console >>> container-test-run-certificates> + systemd-run /bin/sh -c '/nix/store/61685rbaxmpigwi3z23i33sv3jyfl70q-coreutils-9.11/bin/sleep 999999999 && echo 63c900cb-1af6-43b7-8f56-c9d9bfbecfbc' container-test-run-certificates> Running as unit: run-p386-i6529034.service; invocation ID: 496fa890c9044aa89560015d10085909 container-test-run-certificates> To attach to container server run on the same machine that runs the test: container-test-run-certificates> sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*63c900cb-1af6-43b7-8f56-c9d9bfbecfbc') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash container-test-run-certificates> container-test-run-certificates> To inject external network and continue test, run: container-test-run-certificates> sudo /nix/store/h3l4z7p6wny3phbckwwhy1i2g52pdnj4-python3-3.13.15/bin/python3.13 /nix/store/f960jm4nawb9zr6cb9d0vfpb7hifp96b-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 63c900cb-1af6-43b7-8f56-c9d9bfbecfbc container-test-run-certificates> + systemctl restart acme-order-renew-ca.foo.service container-test-run-certificates> + systemctl restart acme-test.foo.service container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> + curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: (none) container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1008 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [111 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 12 10:06:25 2026 GMT container-test-run-certificates> * expire date: Oct 12 10:06:25 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 1d8b98 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> + curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: (none) container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1008 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [111 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 12 10:06:25 2026 GMT container-test-run-certificates> * expire date: Oct 12 10:06:25 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 1d8b98 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> + curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: (none) container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [932 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [80 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 12 10:05:36 2026 GMT container-test-run-certificates> * expire date: Dec 11 10:06:36 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (192.168.1.3 port 443) from 192.168.1.2 port 58460 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.21.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1772 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> (finished: waiting for success: curl -v https://test.foo, in 2.06 seconds) container-test-run-certificates> + openssl s_client -connect test.foo:443 -servername test.foo container-test-run-certificates> + openssl x509 -text -noout container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> a2:f1:8b:5e:21:77:1c:de:cf:3c:89:6e:a7:b5:3d:41 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Sep 12 10:05:36 2026 GMT container-test-run-certificates> Not After : Dec 11 10:06:36 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:3b:45:2d:12:4c:18:24:a4:9e:9e:43:86:fa:c7: container-test-run-certificates> 52:4c:41:39:6f:5c:a3:1c:a5:99:0f:f1:1d:5f:d0: container-test-run-certificates> ae:66:7d:fd:d0:42:ad:48:b1:1b:11:7c:e9:5e:3e: container-test-run-certificates> 3b:b1:c7:df:e9:17:77:b7:2c:bb:56:14:14:48:51: container-test-run-certificates> 26:73:19:5b:e5 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> AB:4C:8D:B7:AF:B2:1A:84:B4:39:A7:59:6A:D1:C7:F1:27:81:5C:CA container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> F2:6E:AD:43:4C:57:C5:04:D1:7D:E5:0C:97:88:BA:6F:32:E5:10:82 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:45:02:20:1d:10:ae:1c:1c:c2:e4:8f:b5:b8:45:43:42:70: container-test-run-certificates> c2:59:27:d8:45:f2:65:00:11:46:16:65:81:88:93:2e:25:59: container-test-run-certificates> 02:21:00:f6:5d:c7:f8:47:8c:3b:9f:e5:f7:95:00:d2:30:99: container-test-run-certificates> 48:1d:12:38:87:3d:b6:aa:8c:a5:4f:e5:e8:ed:4c:88:74 container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> upload niks3: ok