these 36 derivations will be built: /nix/store/c23s75i2r6blp4ila88s54rf15cx9ahn-system-path.drv /nix/store/pdld0kvs156k805r7va64bs4qk8ddrmq-dbus-1.drv /nix/store/m1fhf70ls8b5vk9byvylicnwdhg9xy0n-X-Restart-Triggers-dbus-broker.drv /nix/store/zjcgb2gdi3ciz8r9swhw3d2q626d83hj-unit-dbus-broker.service.drv /nix/store/5x58xx1gvxq72yjq2pffcx296kxjj4yb-user-units.drv /nix/store/jwqy31fa17l0gw71gfyhldp6c30jm8mw-unit-dbus-broker.service.drv /nix/store/rxkcl0ny9jq2qv5jsm4229pg2ninqdw8-system-units.drv /nix/store/w594wrwrs36w1bq64dygrzy30gg7mw9r-etc.drv /nix/store/74zxv31zg7wb0g3l196kmw1ff0ivpny9-activate.drv /nix/store/0dnkkirjdgvbw5v8902h021rc4ibc5g4-nixos-system-server-test.drv /nix/store/0m67grrdr4j03fdxrn3kigsaa9inidy0-run-server-nspawn.drv /nix/store/fdjlh1xsr8savvy5h49jibyzfhadvvs4-system-path.drv /nix/store/rsrxgkswq2dr4mf7mdpgavvw87ridj5v-dbus-1.drv /nix/store/hlpa62dmb7skjj0dm9mirnfgplzmsh7a-X-Restart-Triggers-dbus-broker.drv /nix/store/h8yhcp9a2s5yjd6q9891ydlj3c8xvn3a-unit-dbus-broker.service.drv /nix/store/7wakpsvnyhf77axykx2n4ggz4xsnpxfc-user-units.drv /nix/store/yhzgbjnwhg05w7ldns4gczywizi1893z-unit-dbus-broker.service.drv /nix/store/f4x5cav3dm5a444ic701pcjk3dh7a48r-system-units.drv /nix/store/667n5v6ri8jvcpj4vm67y5g6wi3a93rv-etc.drv /nix/store/20bslz0l5rfjdfls7m2bbzdyzkll62xy-activate.drv /nix/store/z1rd8i43chbr30z5pyx2397kybjwnb02-nixos-system-ca-test.drv /nix/store/1szzzv1n68yf4jb6gzhzx6s8fnfavg9v-run-ca-nspawn.drv /nix/store/39ymqyjhx64gqqjaa20ywr2l0gz5qm0i-system-path.drv /nix/store/8d3qca89hzl1whp6klrjnh0k0z5bwm58-dbus-1.drv /nix/store/30s8czg0svbbpgiwdldqa6hsffd0qh62-X-Restart-Triggers-dbus-broker.drv /nix/store/f9zzyb19j401nn7cfkalpdbb6f729kbi-unit-dbus-broker.service.drv /nix/store/8r6lc42nv1c39rrc76wxqrivl6gwcii5-system-units.drv /nix/store/h5xm26dfsgk4ixqr0kkpkm00idbplhxa-unit-dbus-broker.service.drv /nix/store/ckwn0wh44d7km9rapd3m5csqqc992prl-user-units.drv /nix/store/9jl2bdik1njj51r48sw40vjhpiiw52mn-etc.drv /nix/store/1g18wy0ib7g2h1npfl8hq8wqlibbywnv-activate.drv /nix/store/jpid9nzkl4rjw96pz14l4gn5akscg7gf-nixos-system-client-test.drv /nix/store/wk4mgz4r8vfhrf4f1na4pwhjypcnaxn1-run-client-nspawn.drv /nix/store/16mvc8rma1w2b864r3f9gl11zhs3s0x0-driverConfiguration.json.drv /nix/store/pdxlfhakfzin59q265sxgpcg2lbaf5jn-nixos-test-driver-certificates.drv /nix/store/jjvpci6828hk0d193bjgwfrxzfd1qbvc-container-test-run-certificates.drv building '/nix/store/39ymqyjhx64gqqjaa20ywr2l0gz5qm0i-system-path.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/c23s75i2r6blp4ila88s54rf15cx9ahn-system-path.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/fdjlh1xsr8savvy5h49jibyzfhadvvs4-system-path.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/39ymqyjhx64gqqjaa20ywr2l0gz5qm0i-system-path.drv' system-path> structuredAttrs is enabled system-path> created 1718 symlinks in user environment building '/nix/store/c23s75i2r6blp4ila88s54rf15cx9ahn-system-path.drv' system-path> structuredAttrs is enabled system-path> created 1718 symlinks in user environment building '/nix/store/fdjlh1xsr8savvy5h49jibyzfhadvvs4-system-path.drv' system-path> structuredAttrs is enabled system-path> created 1718 symlinks in user environment building '/nix/store/8d3qca89hzl1whp6klrjnh0k0z5bwm58-dbus-1.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/pdld0kvs156k805r7va64bs4qk8ddrmq-dbus-1.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/rsrxgkswq2dr4mf7mdpgavvw87ridj5v-dbus-1.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/8d3qca89hzl1whp6klrjnh0k0z5bwm58-dbus-1.drv' building '/nix/store/pdld0kvs156k805r7va64bs4qk8ddrmq-dbus-1.drv' building '/nix/store/30s8czg0svbbpgiwdldqa6hsffd0qh62-X-Restart-Triggers-dbus-broker.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/m1fhf70ls8b5vk9byvylicnwdhg9xy0n-X-Restart-Triggers-dbus-broker.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/rsrxgkswq2dr4mf7mdpgavvw87ridj5v-dbus-1.drv' building '/nix/store/hlpa62dmb7skjj0dm9mirnfgplzmsh7a-X-Restart-Triggers-dbus-broker.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/30s8czg0svbbpgiwdldqa6hsffd0qh62-X-Restart-Triggers-dbus-broker.drv' X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/f9zzyb19j401nn7cfkalpdbb6f729kbi-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/h5xm26dfsgk4ixqr0kkpkm00idbplhxa-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/m1fhf70ls8b5vk9byvylicnwdhg9xy0n-X-Restart-Triggers-dbus-broker.drv' X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/jwqy31fa17l0gw71gfyhldp6c30jm8mw-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/zjcgb2gdi3ciz8r9swhw3d2q626d83hj-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/hlpa62dmb7skjj0dm9mirnfgplzmsh7a-X-Restart-Triggers-dbus-broker.drv' X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/f9zzyb19j401nn7cfkalpdbb6f729kbi-unit-dbus-broker.service.drv' unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/h5xm26dfsgk4ixqr0kkpkm00idbplhxa-unit-dbus-broker.service.drv' unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/h8yhcp9a2s5yjd6q9891ydlj3c8xvn3a-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/yhzgbjnwhg05w7ldns4gczywizi1893z-unit-dbus-broker.service.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/jwqy31fa17l0gw71gfyhldp6c30jm8mw-unit-dbus-broker.service.drv' unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/zjcgb2gdi3ciz8r9swhw3d2q626d83hj-unit-dbus-broker.service.drv' unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/8r6lc42nv1c39rrc76wxqrivl6gwcii5-system-units.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/ckwn0wh44d7km9rapd3m5csqqc992prl-user-units.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/rxkcl0ny9jq2qv5jsm4229pg2ninqdw8-system-units.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/5x58xx1gvxq72yjq2pffcx296kxjj4yb-user-units.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/h8yhcp9a2s5yjd6q9891ydlj3c8xvn3a-unit-dbus-broker.service.drv' unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/yhzgbjnwhg05w7ldns4gczywizi1893z-unit-dbus-broker.service.drv' unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/7wakpsvnyhf77axykx2n4ggz4xsnpxfc-user-units.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/f4x5cav3dm5a444ic701pcjk3dh7a48r-system-units.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/ckwn0wh44d7km9rapd3m5csqqc992prl-user-units.drv' building '/nix/store/8r6lc42nv1c39rrc76wxqrivl6gwcii5-system-units.drv' building '/nix/store/rxkcl0ny9jq2qv5jsm4229pg2ninqdw8-system-units.drv' building '/nix/store/5x58xx1gvxq72yjq2pffcx296kxjj4yb-user-units.drv' building '/nix/store/7wakpsvnyhf77axykx2n4ggz4xsnpxfc-user-units.drv' building '/nix/store/f4x5cav3dm5a444ic701pcjk3dh7a48r-system-units.drv' building '/nix/store/9jl2bdik1njj51r48sw40vjhpiiw52mn-etc.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/w594wrwrs36w1bq64dygrzy30gg7mw9r-etc.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/667n5v6ri8jvcpj4vm67y5g6wi3a93rv-etc.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/9jl2bdik1njj51r48sw40vjhpiiw52mn-etc.drv' building '/nix/store/w594wrwrs36w1bq64dygrzy30gg7mw9r-etc.drv' building '/nix/store/667n5v6ri8jvcpj4vm67y5g6wi3a93rv-etc.drv' building '/nix/store/74zxv31zg7wb0g3l196kmw1ff0ivpny9-activate.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/1g18wy0ib7g2h1npfl8hq8wqlibbywnv-activate.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/20bslz0l5rfjdfls7m2bbzdyzkll62xy-activate.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/74zxv31zg7wb0g3l196kmw1ff0ivpny9-activate.drv' activate> structuredAttrs is enabled building '/nix/store/0dnkkirjdgvbw5v8902h021rc4ibc5g4-nixos-system-server-test.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/1g18wy0ib7g2h1npfl8hq8wqlibbywnv-activate.drv' activate> structuredAttrs is enabled building '/nix/store/jpid9nzkl4rjw96pz14l4gn5akscg7gf-nixos-system-client-test.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/20bslz0l5rfjdfls7m2bbzdyzkll62xy-activate.drv' activate> structuredAttrs is enabled building '/nix/store/z1rd8i43chbr30z5pyx2397kybjwnb02-nixos-system-ca-test.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/0dnkkirjdgvbw5v8902h021rc4ibc5g4-nixos-system-server-test.drv' nixos-system-server-test> structuredAttrs is enabled building '/nix/store/0m67grrdr4j03fdxrn3kigsaa9inidy0-run-server-nspawn.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/jpid9nzkl4rjw96pz14l4gn5akscg7gf-nixos-system-client-test.drv' nixos-system-client-test> structuredAttrs is enabled building '/nix/store/z1rd8i43chbr30z5pyx2397kybjwnb02-nixos-system-ca-test.drv' nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/wk4mgz4r8vfhrf4f1na4pwhjypcnaxn1-run-client-nspawn.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/0m67grrdr4j03fdxrn3kigsaa9inidy0-run-server-nspawn.drv' building '/nix/store/1szzzv1n68yf4jb6gzhzx6s8fnfavg9v-run-ca-nspawn.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/wk4mgz4r8vfhrf4f1na4pwhjypcnaxn1-run-client-nspawn.drv' building '/nix/store/1szzzv1n68yf4jb6gzhzx6s8fnfavg9v-run-ca-nspawn.drv' building '/nix/store/16mvc8rma1w2b864r3f9gl11zhs3s0x0-driverConfiguration.json.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/16mvc8rma1w2b864r3f9gl11zhs3s0x0-driverConfiguration.json.drv' driverConfiguration.json> structuredAttrs is enabled building '/nix/store/pdxlfhakfzin59q265sxgpcg2lbaf5jn-nixos-test-driver-certificates.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/pdxlfhakfzin59q265sxgpcg2lbaf5jn-nixos-test-driver-certificates.drv' nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/jjvpci6828hk0d193bjgwfrxzfd1qbvc-container-test-run-certificates.drv' on 'ssh-ng://builder@build01.clan.lol' building '/nix/store/jjvpci6828hk0d193bjgwfrxzfd1qbvc-container-test-run-certificates.drv' container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # No journal files were found. container-test-run-certificates> ca # No journal boot entry found for the specified boot (+0). container-test-run-certificates> ca # [1561954.197986] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [1561954.198044] ca systemd-journald[81]: Runtime Journal (/run/log/journal/3d56f8eaa8094f62ba483d4fa5e93538) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> ca # [1561954.201621] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [1561954.214486] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [1561954.229927] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [1561954.230762] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [1561954.231586] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [1561954.283672] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/3d56f8eaa8094f62ba483d4fa5e93538 is 2.995ms for 7 entries. container-test-run-certificates> ca # [1561954.283672] ca systemd-journald[81]: System Journal (/var/log/journal/3d56f8eaa8094f62ba483d4fa5e93538) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [1561954.304833] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [1561954.305529] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [1561954.305659] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [1561954.306481] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [1561954.306534] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1561954.307415] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [1561954.307453] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [1561954.307985] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [1561954.309411] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [1561954.327258] ca systemd-tmpfiles[162]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [1561954.327439] ca systemd-tmpfiles[162]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1561954.327556] ca systemd-tmpfiles[162]: fchmod() of /var/log/journal/3d56f8eaa8094f62ba483d4fa5e93538 failed: Operation not permitted container-test-run-certificates> ca # [1561954.327733] ca systemd-tmpfiles[162]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1561954.329174] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [1561954.330451] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [1561954.331346] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [1561954.346107] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [1561954.355992] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [1561954.357233] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [1561954.363808] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [1561954.364021] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [1561954.364313] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [1561954.365628] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [1561954.370434] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [1561955.381510] ca systemd-networkd[197]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1561955.381615] ca systemd-networkd[197]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1561955.397082] ca systemd-networkd[197]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1561955.397249] ca systemd-networkd[197]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1561955.397402] ca systemd-networkd[197]: lo: Link UP container-test-run-certificates> ca # [1561955.397408] ca systemd-networkd[197]: lo: Gained carrier container-test-run-certificates> ca # [1561955.397607] ca systemd-networkd[197]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [1561955.398010] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [1561955.398068] ca systemd-networkd[197]: eth1: Link UP container-test-run-certificates> ca # [1561955.398310] ca systemd-networkd[197]: eth1: Gained carrier container-test-run-certificates> ca # [1561955.400561] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [1561955.451751] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [1561956.035517] ca systemd-resolved[117]: Positive Trust Anchors: container-test-run-certificates> ca # [1561956.035529] ca systemd-resolved[117]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [1561956.035532] ca systemd-resolved[117]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [1561956.035568] ca systemd-resolved[117]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [1561956.059213] ca systemd-resolved[117]: Using system hostname 'ca'. container-test-run-certificates> ca # [1561956.060691] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [1561956.060794] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [1561956.060862] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [1561956.060912] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [1561956.061143] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [1561956.061186] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1561956.061209] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [1561956.061230] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [1561956.061355] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [1561956.061465] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [1561956.061574] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [1561956.061596] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [1561956.061633] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [1561956.062943] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [1561956.063720] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [1561956.063759] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [1561956.064604] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [1561956.065683] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [1561956.067118] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [1561956.175995] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [1561956.337006] ca acme-setup-privileged[203]: + set -euo pipefail container-test-run-certificates> ca # [1561956.337006] ca acme-setup-privileged[203]: + cd /var/lib/acme container-test-run-certificates> ca # [1561956.337369] ca acme-setup-privileged[203]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [1561956.339066] ca acme-setup-privileged[203]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [1561956.340767] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1561956.340804] ca acme-setup-privileged[203]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [1561956.340804] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1561956.340804] ca acme-setup-privileged[203]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [1561956.451435] ca nsncd[205]: Sep 22 09:19:36.437 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [1561956.451545] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [1561956.451637] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [1561956.451701] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [1561956.452878] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [1561956.453756] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [1561956.503002] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [1561956.504230] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [1561956.504280] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [1561956.504304] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [1561956.679108] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [1561956.680420] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [1561956.765852] ca dbus-broker-launch[207]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [1561956.767064] ca dbus-broker-launch[207]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [1561956.767105] ca dbus-broker-launch[207]: Invalid user-name in /nix/store/bh2gmvmbmbp0nqf3m5qaqnfjair6v85q-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [1561956.767520] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [1561956.775428] ca dbus-broker-launch[207]: Ready container-test-run-certificates> ca # [1561957.344768] ca systemd-networkd[197]: eth1: Gained IPv6LL container-test-run-certificates> ca # [1561957.736554] ca systemd-logind[237]: New seat seat0. container-test-run-certificates> ca # [1561957.736752] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [1561957.738017] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [1561957.791543] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [1561957.791749] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [1561957.837611] ca acme-setup-start[221]: + set -euo pipefail container-test-run-certificates> ca # [1561957.837611] ca acme-setup-start[221]: + test -e ca/key.pem container-test-run-certificates> ca # [1561957.838091] ca acme-setup-start[221]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [1561957.865161] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [1561957.866857] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [1561958.445932] ca step-ca[206]: badger 2026/09/22 09:19:38 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [1561958.479282] ca step-ca[206]: 2026/09/22 09:19:38 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [1561958.484325] ca step-ca[206]: 2026/09/22 09:19:38 Starting Smallstep CA/0.30.2 (linux/arm64) container-test-run-certificates> ca # [1561958.484325] ca step-ca[206]: 2026/09/22 09:19:38 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [1561958.484325] ca step-ca[206]: 2026/09/22 09:19:38 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [1561958.484325] ca step-ca[206]: 2026/09/22 09:19:38 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [1561958.484325] ca step-ca[206]: 2026/09/22 09:19:38 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [1561958.484325] ca step-ca[206]: 2026/09/22 09:19:38 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [1561958.484325] ca step-ca[206]: 2026/09/22 09:19:38 X.509 Root Fingerprint: c582c8c53bc53d1ec96f07cacb825a2684d6f20d93b9d08434f91323d8b6de70 container-test-run-certificates> ca # [1561958.484964] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [1561958.485193] ca step-ca[206]: 2026/09/22 09:19:38 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [1561959.291872] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1561959.294699] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [1561959.294743] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [1561959.306965] ca acme-ca.foo-start[297]: + cd ca.foo container-test-run-certificates> ca # [1561959.307258] ca acme-ca.foo-start[297]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [1561959.308387] ca acme-ca.foo-start[298]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [1561959.308577] ca acme-ca.foo-start[297]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [1561959.309705] ca acme-ca.foo-start[297]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [1561959.309913] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [1561959.311953] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [1561959.313479] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1561959.315388] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [1561959.315422] ca acme-ca.foo-start[259]: + '[' -d out ']' container-test-run-certificates> ca # [1561959.315422] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1561959.316856] ca acme-ca.foo-start[259]: + chown -R acme:nginx out container-test-run-certificates> ca # [1561959.319123] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [1561959.319154] ca acme-ca.foo-start[259]: + '[' -d certificates ']' container-test-run-certificates> ca # [1561959.323275] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [1561959.324663] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [1561961.072425] ca nginx-pre-start[309]: nginx: the configuration file /nix/store/a4vwbl3sw1llln3lazibgrd2yckzyqz6-nginx.conf syntax is ok container-test-run-certificates> ca # [1561961.073068] ca nginx-pre-start[309]: nginx: configuration file /nix/store/a4vwbl3sw1llln3lazibgrd2yckzyqz6-nginx.conf test is successful container-test-run-certificates> ca # [1561961.080027] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [1561961.080775] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [1561961.082772] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [1561962.220238] ca acme-order-renew-ca.foo-start[312]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1561962.223122] ca acme-order-renew-ca.foo-start[312]: + set -euo pipefail container-test-run-certificates> ca # [1561962.223200] ca acme-order-renew-ca.foo-start[312]: + exec container-test-run-certificates> ca # [1561962.223247] ca acme-order-renew-ca.foo-start[312]: + /nix/store/fxkh6pl0y4nfbhdqdnhfkvsq7pbxq655-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [1561962.224581] ca acme-order-renew-ca.foo-start[323]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [1561962.226803] ca acme-order-renew-ca.foo-start[312]: + '[' -n '' ']' container-test-run-certificates> ca # [1561962.226839] ca acme-order-renew-ca.foo-start[312]: + exec container-test-run-certificates> ca # [1561962.226913] ca acme-order-renew-ca.foo-start[312]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [1561962.226954] ca acme-order-renew-ca.foo-start[312]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [1561962.313323] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.299076288Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [1561962.342775] ca step-ca[206]: time="2026-09-22T09:19:42Z" level=info duration="94.721µs" duration-ns=94721 fields.time="2026-09-22T09:19:42Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=0a7318e4-5865-4aa2-ba43-181628ea77b6 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561962.343127] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.328892938Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [1561962.364605] ca step-ca[206]: time="2026-09-22T09:19:42Z" level=info duration=21.291013ms duration-ns=21291013 fields.time="2026-09-22T09:19:42Z" method=HEAD name=ca nonce=VjFNT2xRMjNPYWJLN3R1QzZmdWRhV1B4dno3ZE1zd2Q path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=875f128c-f25c-4d90-9775-30be5f3854e8 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561962.367440] ca step-ca[206]: time="2026-09-22T09:19:42Z" level=info duration=2.12995ms duration-ns=2129950 fields.time="2026-09-22T09:19:42Z" method=POST name=ca nonce=OGRsbEtWbkNUY3hyWUYzVlpFM2hUQTVIQ2l6Y0NpQzc path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=7eb3a4ae-4259-40fc-8ef9-436af7732bc0 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/6kF76kUGulLesmDTVpCgs9MDoLzV2oZg/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561962.367819] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.353634798Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [1561962.367819] ca acme-order-renew-ca.foo-start[324]: Your account credentials have been saved in your container-test-run-certificates> ca # [1561962.367819] ca acme-order-renew-ca.foo-start[324]: configuration directory at "accounts". container-test-run-certificates> ca # [1561962.367819] ca acme-order-renew-ca.foo-start[324]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [1561962.367819] ca acme-order-renew-ca.foo-start[324]: configuration directory will also contain private keys container-test-run-certificates> ca # [1561962.367819] ca acme-order-renew-ca.foo-start[324]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [1561962.367819] ca acme-order-renew-ca.foo-start[324]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [1561962.367960] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.353754160Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [1561962.372277] ca step-ca[206]: time="2026-09-22T09:19:42Z" level=info duration=3.828613ms duration-ns=3828613 fields.time="2026-09-22T09:19:42Z" method=POST name=ca nonce=cmtaWll4TzlOa3NWU1FpeFpKT0NpQkN3b1htOHdra0M path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=3668676c-9a01-40b3-ae51-c331eb62efe4 response="{\"id\":\"aEfiDi6Z4zG8hJe5IhA4Ci0edvtqDG7c\",\"status\":\"pending\",\"expires\":\"2026-09-23T09:19:42Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-22T09:18:42Z\",\"notAfter\":\"2026-12-21T09:19:42Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/GHV4jR3f6NdKlcVZoi97k8bgA4aY7lhw\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/aEfiDi6Z4zG8hJe5IhA4Ci0edvtqDG7c/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561962.434808] ca step-ca[206]: time="2026-09-22T09:19:42Z" level=info duration=5.643838ms duration-ns=5643838 fields.time="2026-09-22T09:19:42Z" method=POST name=ca nonce=Mjl2ZHRpcVVmUmNrVXBjOUFIR2J1T0JnNWRMaWw2Nnk path=/acme/acme/authz/GHV4jR3f6NdKlcVZoi97k8bgA4aY7lhw protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=39fffe57-671c-4f26-85b1-a0e585f8ffce response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"UlOTlvZUqJemZ2RkTm0zWpOhTkqiMRSI\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/GHV4jR3f6NdKlcVZoi97k8bgA4aY7lhw/3lJ5yZpi7UVkX75FzpPGtNqgO18In76r\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"UlOTlvZUqJemZ2RkTm0zWpOhTkqiMRSI\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/GHV4jR3f6NdKlcVZoi97k8bgA4aY7lhw/XNejZMFsj1VqgRfR865tBqptJqbB7ixR\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"UlOTlvZUqJemZ2RkTm0zWpOhTkqiMRSI\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/GHV4jR3f6NdKlcVZoi97k8bgA4aY7lhw/lwJcHW0pXCl4KR5HQD4AjbHvECu6aexi\"}],\"wildcard\":false,\"expires\":\"2026-09-23T09:19:42Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561962.435136] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.420943564Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [1561962.435199] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.420977645Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [1561962.442068] ca step-ca[206]: time="2026-09-22T09:19:42Z" level=info duration=6.206766ms duration-ns=6206766 fields.time="2026-09-22T09:19:42Z" method=POST name=ca nonce=Vlg0SUNvWTV6S3ZpNWFtNXlxQnhBdG0zbzZCWWVPR1I path=/acme/acme/challenge/GHV4jR3f6NdKlcVZoi97k8bgA4aY7lhw/XNejZMFsj1VqgRfR865tBqptJqbB7ixR protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f3b0b676-9235-4f32-9358-4cbf8abe7aa5 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"UlOTlvZUqJemZ2RkTm0zWpOhTkqiMRSI\",\"validated\":\"2026-09-22T09:19:42Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/GHV4jR3f6NdKlcVZoi97k8bgA4aY7lhw/XNejZMFsj1VqgRfR865tBqptJqbB7ixR\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561962.442392] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.428199144Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [1561962.442470] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.428292385Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [1561962.450015] ca step-ca[206]: time="2026-09-22T09:19:42Z" level=info duration=6.733053ms duration-ns=6733053 fields.time="2026-09-22T09:19:42Z" method=POST name=ca nonce=NHlFV2hpWkFBdFo5MVE1Y2tRQUVtWHh2eEZ6UURqS1Y path=/acme/acme/order/aEfiDi6Z4zG8hJe5IhA4Ci0edvtqDG7c/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=341e8f90-5512-4391-bec6-a768a893b96b response="{\"id\":\"aEfiDi6Z4zG8hJe5IhA4Ci0edvtqDG7c\",\"status\":\"valid\",\"expires\":\"2026-09-23T09:19:42Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-22T09:18:42Z\",\"notAfter\":\"2026-12-21T09:19:42Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/GHV4jR3f6NdKlcVZoi97k8bgA4aY7lhw\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/aEfiDi6Z4zG8hJe5IhA4Ci0edvtqDG7c/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/eLeE9jN4aXuXiHbRcADBZ1J19OcTQ5wg\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561962.451583] ca step-ca[206]: time="2026-09-22T09:19:42Z" level=info certificate=MIIB0zCCAXmgAwIBAgIQCVRtdKkm2uHRaUg+CRh4zTAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MjIwOTE4NDJaFw0yNjEyMjEwOTE5NDJaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOKBPHZuI8RqtUfmwsjyLJ3nxWgZgg+wrs+cpK3JzJk8rP3sSgTLnsMyP5tT1/7/WFJVkkwPlJhKNDqZYydAR6+jgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUD58UiTF4rk45pTc/FTcShT3gFD0wHwYDVR0jBBgwFoAURh1Mpe3/y0VKlyCgBzUyFvXbbcAwEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNIADBFAiEA+hkDYMr+FklBmCJDrb4oe9G0Ncl6MHpkQXh0mbjKr/oCIFhSMYBN6tQ55EtIH14sZTOXZtzT3z5FadY7kVtbhOKA duration=1.015534ms duration-ns=1015534 fields.time="2026-09-22T09:19:42Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=MWhuWWlFWlVTNGdiZUVGUmMxM05KcjJPZnlWSGxyN1Q path=/acme/acme/certificate/eLeE9jN4aXuXiHbRcADBZ1J19OcTQ5wg protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=8fcc4ad2-9b02-4612-a2b3-4d8b9e6feb68 sans="map[dns:[ca.foo]]" serial=12401424923644757546123222483857864909 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= valid-from="2026-09-22T09:18:42Z" valid-to="2026-12-21T09:19:42Z" container-test-run-certificates> ca # [1561962.451896] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.437700155Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [1561962.451988] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.437809396Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [1561962.452185] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.438001039Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [1561962.452259] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.438080280Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [1561962.452429] ca acme-order-renew-ca.foo-start[324]: 2026-09-22T09:19:42.438246802Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [1561962.458804] ca acme-order-renew-ca.foo-start[312]: + touch out/acme-success container-test-run-certificates> ca # [1561962.460392] ca acme-order-renew-ca.foo-start[312]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1561962.461494] ca acme-order-renew-ca.foo-start[312]: + touch out/renewed container-test-run-certificates> ca # [1561962.463529] ca acme-order-renew-ca.foo-start[312]: + echo Installing new certificate container-test-run-certificates> ca # [1561962.463529] ca acme-order-renew-ca.foo-start[312]: Installing new certificate container-test-run-certificates> ca # [1561962.463593] ca acme-order-renew-ca.foo-start[312]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1561962.465347] ca acme-order-renew-ca.foo-start[356]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [1561962.465643] ca acme-order-renew-ca.foo-start[312]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [1561962.466994] ca acme-order-renew-ca.foo-start[357]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [1561962.467202] ca acme-order-renew-ca.foo-start[312]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [1561962.468942] ca acme-order-renew-ca.foo-start[358]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [1561962.469225] ca acme-order-renew-ca.foo-start[312]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [1561962.470765] ca acme-order-renew-ca.foo-start[312]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1561962.472643] ca acme-order-renew-ca.foo-start[312]: + for fixpath in out certificates container-test-run-certificates> ca # [1561962.472643] ca acme-order-renew-ca.foo-start[312]: + '[' -d out ']' container-test-run-certificates> ca # [1561962.472643] ca acme-order-renew-ca.foo-start[312]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1561962.474171] ca acme-order-renew-ca.foo-start[312]: + chown -R acme:nginx out container-test-run-certificates> ca # [1561962.476839] ca acme-order-renew-ca.foo-start[312]: + for fixpath in out certificates container-test-run-certificates> ca # [1561962.476839] ca acme-order-renew-ca.foo-start[312]: + '[' -d certificates ']' container-test-run-certificates> ca # [1561962.476897] ca acme-order-renew-ca.foo-start[312]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [1561962.478262] ca acme-order-renew-ca.foo-start[312]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [1561962.480478] ca acme-order-renew-ca.foo-start[312]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [1561962.750549] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [1561962.756559] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [1561962.756793] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [1561962.756989] ca systemd[1]: acme-order-renew-ca.foo.service: Consumed 1.339s CPU time over 1.673s wall clock time. container-test-run-certificates> ca: still waiting for container 'ca' to reach ready state... container-test-run-certificates> ca # [1561964.164206] ca nginx[374]: nginx: the configuration file /nix/store/a4vwbl3sw1llln3lazibgrd2yckzyqz6-nginx.conf syntax is ok container-test-run-certificates> ca # [1561964.164650] ca nginx[374]: nginx: configuration file /nix/store/a4vwbl3sw1llln3lazibgrd2yckzyqz6-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 12.66 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.01 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [1561965.602586] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [1561965.603249] ca systemd[1]: Startup finished in 11.896s. container-test-run-certificates> ca # [1561965.871998] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [1561965.971117] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [1561965.971555] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [1561965.971601] ca systemd[1]: nginx.service: Consumed 4.446s CPU time over 6.646s wall clock time. container-test-run-certificates> ca # [1561965.976236] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 1.37 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 468) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 471) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ca # [1561967.217244] ca nginx-pre-start[398]: nginx: the configuration file /nix/store/a4vwbl3sw1llln3lazibgrd2yckzyqz6-nginx.conf syntax is ok container-test-run-certificates> ca # [1561967.217819] ca nginx-pre-start[398]: nginx: configuration file /nix/store/a4vwbl3sw1llln3lazibgrd2yckzyqz6-nginx.conf test is successful container-test-run-certificates> ca # [1561967.223343] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # No journal files were found. container-test-run-certificates> server # No journal boot entry found for the specified boot (+0). container-test-run-certificates> client # No journal files were found. container-test-run-certificates> client # No journal boot entry found for the specified boot (+0). container-test-run-certificates> client # [1561968.192438] client systemd-journald[72]: Journal started container-test-run-certificates> client # [1561968.192493] client systemd-journald[72]: Runtime Journal (/run/log/journal/d69ded2733c94291b85b0c77e9e67255) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> server # [1561968.199570] server systemd-journald[72]: Journal started container-test-run-certificates> client # [1561968.200520] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [1561968.199623] server systemd-journald[72]: Runtime Journal (/run/log/journal/74cb428bf53f4786b0b36d888e874d06) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> client # [1561968.215920] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [1561968.215908] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [1561968.235131] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [1561968.232794] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [1561968.248501] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [1561968.249319] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [1561968.250176] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [1561968.257730] server systemd-journald[72]: Time spent on flushing to /var/log/journal/74cb428bf53f4786b0b36d888e874d06 is 2.484ms for 7 entries. container-test-run-certificates> server # [1561968.257730] server systemd-journald[72]: System Journal (/var/log/journal/74cb428bf53f4786b0b36d888e874d06) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [1561968.236098] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [1561968.236803] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [1561968.244568] client systemd-journald[72]: Time spent on flushing to /var/log/journal/d69ded2733c94291b85b0c77e9e67255 is 1.731ms for 7 entries. container-test-run-certificates> client # [1561968.244568] client systemd-journald[72]: System Journal (/var/log/journal/d69ded2733c94291b85b0c77e9e67255) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [1561968.278137] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [1561968.280693] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [1561968.282286] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [1561968.282394] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [1561968.283235] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [1561968.283283] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1561968.284192] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [1561968.285104] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [1561968.285135] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [1561968.318165] client systemd-tmpfiles[144]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [1561968.318492] client systemd-tmpfiles[144]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [1561968.318701] client systemd-tmpfiles[144]: fchmod() of /var/log/journal/d69ded2733c94291b85b0c77e9e67255 failed: Operation not permitted container-test-run-certificates> client # [1561968.319014] client systemd-tmpfiles[144]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [1561968.320945] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [1561968.322046] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [1561968.322785] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [1561968.334958] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [1561968.341381] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [1561968.342503] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [1561968.353594] client systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [1561968.355075] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [1561968.355231] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [1561968.355457] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [1561968.356574] client systemd[1]: Starting Network Management... container-test-run-certificates> client # [1561968.415639] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [1561969.204881] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [1561968.316950] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [1561968.317562] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [1561968.319180] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [1561968.319305] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [1561968.320267] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [1561968.320337] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1561968.321513] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [1561968.322486] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [1561968.322525] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [1561968.337688] server systemd-tmpfiles[155]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [1561968.337873] server systemd-tmpfiles[155]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [1561968.338015] server systemd-tmpfiles[155]: fchmod() of /var/log/journal/74cb428bf53f4786b0b36d888e874d06 failed: Operation not permitted container-test-run-certificates> server # [1561968.338210] server systemd-tmpfiles[155]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [1561968.342939] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [1561968.344070] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [1561968.344846] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [1561968.355994] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [1561968.362423] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [1561968.363518] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [1561968.365571] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [1561968.365730] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [1561968.365946] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [1561968.367120] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [1561968.373718] server systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [1561968.413773] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [1561969.216425] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [1561969.460774] client systemd-networkd[185]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1561969.460874] client systemd-networkd[185]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1561969.471079] client systemd-networkd[185]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1561969.471244] client systemd-networkd[185]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1561969.471384] client systemd-networkd[185]: lo: Link UP container-test-run-certificates> client # [1561969.471388] client systemd-networkd[185]: lo: Gained carrier container-test-run-certificates> client # [1561969.471561] client systemd-networkd[185]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [1561969.471997] client systemd[1]: Started Network Management. container-test-run-certificates> client # [1561969.472049] client systemd-networkd[185]: eth1: Link UP container-test-run-certificates> client # [1561969.472260] client systemd-networkd[185]: eth1: Gained carrier container-test-run-certificates> client # [1561969.474263] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [1561969.516277] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [1561969.531923] server systemd-networkd[188]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1561969.532130] server systemd-networkd[188]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1561969.548689] server systemd-networkd[188]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1561969.548885] server systemd-networkd[188]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1561969.549054] server systemd-networkd[188]: lo: Link UP container-test-run-certificates> server # [1561969.549058] server systemd-networkd[188]: lo: Gained carrier container-test-run-certificates> server # [1561969.549282] server systemd-networkd[188]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [1561969.549723] server systemd[1]: Started Network Management. container-test-run-certificates> server # [1561969.549806] server systemd-networkd[188]: eth1: Link UP container-test-run-certificates> server # [1561969.550154] server systemd-networkd[188]: eth1: Gained carrier container-test-run-certificates> server # [1561969.552129] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [1561969.598411] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [1561970.653727] client systemd-resolved[114]: Positive Trust Anchors: container-test-run-certificates> client # [1561970.653745] client systemd-resolved[114]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [1561970.653754] client systemd-resolved[114]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [1561970.653824] client systemd-resolved[114]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [1561970.688077] client systemd-resolved[114]: Using system hostname 'client'. container-test-run-certificates> client # [1561970.689502] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [1561970.689608] client systemd[1]: Reached target Network. container-test-run-certificates> client # [1561970.689685] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [1561970.689751] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1561970.689785] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [1561970.689809] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [1561970.689956] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [1561970.690120] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [1561970.690259] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [1561970.690291] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [1561970.690335] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [1561970.691572] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [1561970.692532] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [1561970.694085] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [1561970.745776] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [1561970.820164] client systemd-networkd[185]: eth1: Gained IPv6LL container-test-run-certificates> server # [1561970.729195] server systemd-resolved[116]: Positive Trust Anchors: container-test-run-certificates> server # [1561970.729209] server systemd-resolved[116]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [1561970.729214] server systemd-resolved[116]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [1561970.729261] server systemd-resolved[116]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [1561970.758031] server systemd-resolved[116]: Using system hostname 'server'. container-test-run-certificates> server # [1561970.759466] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [1561970.759561] server systemd[1]: Reached target Network. container-test-run-certificates> server # [1561970.759633] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [1561970.759681] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [1561970.759920] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [1561970.759962] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1561970.760008] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [1561970.760043] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [1561970.760190] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [1561970.760314] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [1561970.760446] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [1561970.760472] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [1561970.760524] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [1561970.761929] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [1561970.762825] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [1561970.762868] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [1561970.763740] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [1561970.765077] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [1561970.785154] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [1561971.195566] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [1561971.195715] client nsncd[192]: Sep 22 09:19:51.181 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [1561971.195628] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [1561971.195680] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [1561971.196957] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [1561971.197844] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [1561971.239047] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [1561971.240359] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [1561971.240402] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [1561971.240420] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [1561971.101016] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [1561971.101016] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [1561971.101016] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [1561971.102954] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [1561971.104663] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1561971.104725] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [1561971.104764] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1561971.104764] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [1561971.194432] server nsncd[197]: Sep 22 09:19:51.180 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [1561971.194554] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [1561971.194665] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [1561971.194783] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [1561971.196733] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [1561971.198187] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [1561971.237057] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [1561971.238454] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [1561971.238517] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [1561971.238545] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [1561971.328194] server systemd-networkd[188]: eth1: Gained IPv6LL container-test-run-certificates> client # [1561971.583583] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [1561971.584354] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [1561971.584354] client dbus-broker-launch[193]: Invalid user-name in /nix/store/g0a3fan1ykqwgcwicjzjgnwxr95dlfi7-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [1561971.584716] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [1561971.592017] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [1561971.704769] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [1561971.705533] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [1561971.705533] server dbus-broker-launch[198]: Invalid user-name in /nix/store/zzss1678mb50nlwag2hiw11lg128jpl3-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [1561971.705947] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [1561971.714166] server dbus-broker-launch[198]: Ready container-test-run-certificates> server # [1561972.826162] server systemd-logind[227]: New seat seat0. container-test-run-certificates> server # [1561972.826460] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [1561972.828312] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [1561972.888986] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [1561972.889177] server systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [1561972.924684] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [1561972.925375] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [1561972.926660] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [1561972.975941] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [1561972.976166] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [1561972.976582] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [1561972.976743] client systemd[1]: Startup finished in 5.244s. container-test-run-certificates> server # [1561973.202057] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [1561973.202057] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [1561973.202057] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [1561973.222973] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [1561973.224984] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> server # [1561974.700826] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1561974.703352] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [1561974.703442] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [1561974.713884] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [1561974.714452] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [1561974.715367] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [1561974.715616] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [1561974.716695] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [1561974.716904] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [1561974.719015] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [1561974.720938] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1561974.722514] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1561974.722514] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [1561974.722630] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1561974.724330] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [1561974.726951] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1561974.726951] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [1561974.731350] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [1561974.732756] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [1561975.993815] server nginx-pre-start[270]: nginx: the configuration file /nix/store/c5sy3a3rn41k7ykx229snncrivc8g1fx-nginx.conf syntax is ok container-test-run-certificates> server # [1561975.994385] server nginx-pre-start[270]: nginx: configuration file /nix/store/c5sy3a3rn41k7ykx229snncrivc8g1fx-nginx.conf test is successful container-test-run-certificates> server # [1561975.999478] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1561975.999839] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [1561976.001024] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server: still waiting for container 'server' to reach ready state... container-test-run-certificates> server # [1561977.103383] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1561977.105954] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [1561977.106040] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1561977.106094] server acme-order-renew-test.foo-start[273]: + /nix/store/fxkh6pl0y4nfbhdqdnhfkvsq7pbxq655-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [1561977.107264] server acme-order-renew-test.foo-start[285]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [1561977.109463] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [1561977.109538] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1561977.109589] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [1561977.109652] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [1561977.127719] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.113514020Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [1561977.156543] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.142336296Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [1561977.182838] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.168639338Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [1561977.182838] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your container-test-run-certificates> server # [1561977.182838] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts". container-test-run-certificates> server # [1561977.182838] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [1561977.182838] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys container-test-run-certificates> server # [1561977.182838] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [1561977.182838] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [1561977.183056] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.168758940Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [1561977.250379] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.236181867Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [1561977.250379] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.236218948Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [1561977.257933] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.243724291Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [1561977.258039] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.243805292Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [1561977.267778] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.253588627Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [1561977.267833] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.253659828Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [1561977.267932] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.253758029Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [1561977.267967] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.253793269Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [1561977.268069] server acme-order-renew-test.foo-start[286]: 2026-09-22T09:19:57.253874871Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [1561977.271557] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [1561977.273274] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1561977.274432] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [1561977.275798] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [1561977.275798] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [1561977.275840] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1561977.277256] server acme-order-renew-test.foo-start[317]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [1561977.277505] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [1561977.278905] server acme-order-renew-test.foo-start[318]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [1561977.279153] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [1561977.281787] server acme-order-renew-test.foo-start[319]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [1561977.282199] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [1561977.283855] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1561977.285624] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1561977.285647] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [1561977.285647] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1561977.287499] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [1561977.289863] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1561977.289897] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [1561977.289897] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [1561977.291193] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [1561977.293669] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [1561977.156102] ca step-ca[206]: time="2026-09-22T09:19:57Z" level=info duration="41.6µs" duration-ns=41600 fields.time="2026-09-22T09:19:57Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=448eab92-074f-4a37-baab-78e6e87bf66d response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561977.176585] ca step-ca[206]: time="2026-09-22T09:19:57Z" level=info duration=18.026488ms duration-ns=18026488 fields.time="2026-09-22T09:19:57Z" method=HEAD name=ca nonce=VURweGp6RXVSZzJUR0pkRmNaUE5ESzNoQ3M0RTRlVDU path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=d4c6aebf-fd0e-4271-b3ce-29b0ad2a60b4 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561977.182255] ca step-ca[206]: time="2026-09-22T09:19:57Z" level=info duration=3.186764ms duration-ns=3186764 fields.time="2026-09-22T09:19:57Z" method=POST name=ca nonce=eEYzTGMwV1pmaDF3RkZrOWZOamxLazQzb2FHZGxOUVk path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=19558a38-3cd2-4ac5-897f-e0e218775262 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/zXWog6XYfbrEdHk07Pg3AgkS8tKTsU7r/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561977.187616] ca step-ca[206]: time="2026-09-22T09:19:57Z" level=info duration=2.722677ms duration-ns=2722677 fields.time="2026-09-22T09:19:57Z" method=POST name=ca nonce=UEFoRXNMNkJZUnBXVWZla1lXOEVUQUVlRWYxaWZySkM path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=6ffed097-0dbe-4901-ada4-8a689a813147 response="{\"id\":\"Hh4SsK2QPeKMcz20VipCvnyylzYiFsdA\",\"status\":\"pending\",\"expires\":\"2026-09-23T09:19:57Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-22T09:18:57Z\",\"notAfter\":\"2026-12-21T09:19:57Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/kLL2JO0O1Ik63iRtKDekouV5OCzN5ZRL\"],\"finalize\":\"https://ca.foo/acme/acme/order/Hh4SsK2QPeKMcz20VipCvnyylzYiFsdA/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561977.249909] ca step-ca[206]: time="2026-09-22T09:19:57Z" level=info duration=3.506848ms duration-ns=3506848 fields.time="2026-09-22T09:19:57Z" method=POST name=ca nonce=aUx1VTh1anI3MXVTa3J1T0N5SGFEOUYyU0hoWno0bHg path=/acme/acme/authz/kLL2JO0O1Ik63iRtKDekouV5OCzN5ZRL protocol=HTTP/1.1 referer= remote-address="::1" request-id=de5d8342-99ef-4268-b352-1575edffc3de response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"Ql0lM18DhRDVM1a1shdDqcIRjHe6Az81\",\"url\":\"https://ca.foo/acme/acme/challenge/kLL2JO0O1Ik63iRtKDekouV5OCzN5ZRL/jucT9SURsJlMH2LaVjhXolwm1iJCYRet\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"Ql0lM18DhRDVM1a1shdDqcIRjHe6Az81\",\"url\":\"https://ca.foo/acme/acme/challenge/kLL2JO0O1Ik63iRtKDekouV5OCzN5ZRL/0x7Tz07UVLxPOOyGF461Vh4nklPFhnZk\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"Ql0lM18DhRDVM1a1shdDqcIRjHe6Az81\",\"url\":\"https://ca.foo/acme/acme/challenge/kLL2JO0O1Ik63iRtKDekouV5OCzN5ZRL/fgnMi2YB57aoxE9YN3fmhCZ3JWZc0SxP\"}],\"wildcard\":false,\"expires\":\"2026-09-23T09:19:57Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561977.257585] ca step-ca[206]: time="2026-09-22T09:19:57Z" level=info duration=4.249939ms duration-ns=4249939 fields.time="2026-09-22T09:19:57Z" method=POST name=ca nonce=bmM0RmM3bElka093bzd3Tkh3S0NuNzRKOEw2dkFWTjU path=/acme/acme/challenge/kLL2JO0O1Ik63iRtKDekouV5OCzN5ZRL/0x7Tz07UVLxPOOyGF461Vh4nklPFhnZk protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=7983d5e0-faac-4172-a850-e194dab8219b response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"Ql0lM18DhRDVM1a1shdDqcIRjHe6Az81\",\"validated\":\"2026-09-22T09:19:57Z\",\"url\":\"https://ca.foo/acme/acme/challenge/kLL2JO0O1Ik63iRtKDekouV5OCzN5ZRL/0x7Tz07UVLxPOOyGF461Vh4nklPFhnZk\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561977.264356] ca step-ca[206]: time="2026-09-22T09:19:57Z" level=info duration=4.229458ms duration-ns=4229458 fields.time="2026-09-22T09:19:57Z" method=POST name=ca nonce=Z3pTWXEzUWNTUWkxMjNNZ2hkbFVtNGNhUXZSemNzZ3M path=/acme/acme/order/Hh4SsK2QPeKMcz20VipCvnyylzYiFsdA/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=53fcb59e-4d68-4567-905f-df157c228feb response="{\"id\":\"Hh4SsK2QPeKMcz20VipCvnyylzYiFsdA\",\"status\":\"valid\",\"expires\":\"2026-09-23T09:19:57Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-22T09:18:57Z\",\"notAfter\":\"2026-12-21T09:19:57Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/kLL2JO0O1Ik63iRtKDekouV5OCzN5ZRL\"],\"finalize\":\"https://ca.foo/acme/acme/order/Hh4SsK2QPeKMcz20VipCvnyylzYiFsdA/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/wHDnraFxAGS2WmuHvY7gUATjuK3Oi8t3\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [1561977.267353] ca step-ca[206]: time="2026-09-22T09:19:57Z" level=info certificate="MIIB1zCCAX6gAwIBAgIRAMz6c/dTfAzRYGLkvOzZMkAwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTIyMDkxODU3WhcNMjYxMjIxMDkxOTU3WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPMlQ6GQAFrS7n8PZ+f2t2URBymJlAptZA0kqftz0I7VI5u4um+f5aQ8RIwdY5qo5GJeLg1Xg5JsUxIT44T1uuCjgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUOqU0kiYLNsPo4InEm0TfYo+ouwIwHwYDVR0jBBgwFoAURh1Mpe3/y0VKlyCgBzUyFvXbbcAwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0cAMEQCICdxHiGHB7I3h76YXgmz8ZvRuTXwi5GYEW2c3WQmRA0qAiBl8itZrhlEMczyCUW4Wk1PkpmF7+4rVItuNeeuV8+9CQ==" duration="958.773µs" duration-ns=958773 fields.time="2026-09-22T09:19:57Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=V09Ec0JSdkhta0hkaDhiUmxsbWRINkdrM0xFeXFLbXQ path=/acme/acme/certificate/wHDnraFxAGS2WmuHvY7gUATjuK3Oi8t3 protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=560f7bf0-85a3-42e7-bff2-345f391dd774 sans="map[dns:[test.foo]]" serial=272462937427054329092415929557045555776 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; arm64)" user-id= valid-from="2026-09-22T09:18:57Z" valid-to="2026-12-21T09:19:57Z" container-test-run-certificates> server # [1561977.534820] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [1561977.544643] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [1561977.568269] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> server # [1561977.568525] server systemd[1]: acme-order-renew-test.foo.service: Consumed 1.279s CPU time over 1.543s wall clock time. container-test-run-certificates> server # [1561978.604974] server nginx[335]: nginx: the configuration file /nix/store/c5sy3a3rn41k7ykx229snncrivc8g1fx-nginx.conf syntax is ok container-test-run-certificates> server # [1561978.605528] server nginx[335]: nginx: configuration file /nix/store/c5sy3a3rn41k7ykx229snncrivc8g1fx-nginx.conf test is successful container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 12.65 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [1561979.837780] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [1561979.838470] server systemd[1]: Startup finished in 12.106s. container-test-run-certificates> server # [1561979.893446] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [1561979.953853] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [1561979.954097] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [1561979.954147] server systemd[1]: nginx.service: Consumed 6.288s CPU time over 5.221s wall clock time. container-test-run-certificates> server # [1561979.956949] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 1.34 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 39522 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 59598 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 2 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 2 ms: Could not connect to server container-test-run-certificates> server # [1561981.209403] server nginx-pre-start[358]: nginx: the configuration file /nix/store/c5sy3a3rn41k7ykx229snncrivc8g1fx-nginx.conf syntax is ok container-test-run-certificates> server # [1561981.209912] server nginx-pre-start[358]: nginx: configuration file /nix/store/c5sy3a3rn41k7ykx229snncrivc8g1fx-nginx.conf test is successful container-test-run-certificates> server # [1561981.216348] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 39534 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 59602 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [931 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [79 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 22 09:18:57 2026 GMT container-test-run-certificates> * expire date: Dec 21 09:19:57 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 39546 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 655 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 2.08 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> cc:fa:73:f7:53:7c:0c:d1:60:62:e4:bc:ec:d9:32:40 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Sep 22 09:18:57 2026 GMT container-test-run-certificates> Not After : Dec 21 09:19:57 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:f3:25:43:a1:90:00:5a:d2:ee:7f:0f:67:e7:f6: container-test-run-certificates> b7:65:11:07:29:89:94:0a:6d:64:0d:24:a9:fb:73: container-test-run-certificates> d0:8e:d5:23:9b:b8:ba:6f:9f:e5:a4:3c:44:8c:1d: container-test-run-certificates> 63:9a:a8:e4:62:5e:2e:0d:57:83:92:6c:53:12:13: container-test-run-certificates> e3:84:f5:ba:e0 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> 3A:A5:34:92:26:0B:36:C3:E8:E0:89:C4:9B:44:DF:62:8F:A8:BB:02 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 46:1D:4C:A5:ED:FF:CB:45:4A:97:20:A0:07:35:32:16:F5:DB:6D:C0 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:44:02:20:27:71:1e:21:87:07:b2:37:87:be:98:5e:09:b3: container-test-run-certificates> f1:9b:d1:b9:35:f0:8b:91:98:11:6d:9c:dd:64:26:44:0d:2a: container-test-run-certificates> 02:20:65:f2:2b:59:ae:19:44:31:cc:f2:09:45:b8:5a:4d:4f: container-test-run-certificates> 92:99:85:ef:ee:2b:54:8b:6e:35:e7:ae:57:cf:bd:09 container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.05 seconds) container-test-run-certificates> (finished: run the VM test script, in 30.17 seconds) container-test-run-certificates> test script finished in 30.29s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 471) container-test-run-certificates> kill NspawnMachine (pid 468) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.39 seconds) container-test-run-certificates> Container server terminated by signal KILL. post-build step Upload to niks3: ok time=2026-09-22T09:20:04.332Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)" time=2026-09-22T09:20:05.220Z level=INFO msg="Uploading 1 narinfos" time=2026-09-22T09:20:05.323Z level=INFO msg="Upload complete. (1.044s)"