these 96 derivations will be built: /nix/store/027zd470i67kd3cry02h21hzf4xyghwb-firewall-start.drv /nix/store/0cxd5cv5gll0m47xq1g3cc7yr3mlrr8r-users-groups.json.drv /nix/store/94gc3k1fdq1hlrsncdglp0r538gj8adb-string-hosts.drv /nix/store/bin6q8vg2iq44dk2mmrf3p2p6i5cgz5j-extra-hosts.drv /nix/store/0pfgq0982c1lcxmqwwylrnazd04xw0fb-hosts.drv /nix/store/1dvr2dncn0pdn6akg08r488ldvaaakrd-string-hosts.drv /nix/store/11x5w69yns8ss0ib3yg2zmvzmhcknmd1-hosts.drv /nix/store/1akc7zgqww9wls7vd4sx8qxdjfgq9ddl-unit-40-eth1.network.drv /nix/store/1p6g6y731g8f3wpvszznb63nm1xp19jy-acme-postrun.drv /nix/store/9k3yn74rfmdsq82ykyyk959y02klmvi5-acme-setup-privileged.drv /nix/store/1zqg4nps0s028jy4pqcnmq4f513hysv5-unit-acme-setup.service.drv /nix/store/96gpm4p1im1j2ahi1j36x6djhcvvmxnw-unit-40-eth1.network.drv /nix/store/20179ss1gnrz351ga91m2vj29zwl11dq-X-Reload-Triggers-systemd-networkd.drv /nix/store/78afbvzl7q1zibjifd0mk1z09zn2k47d-issue.drv /nix/store/gkfdqka2z7w3nc8rqpdwd68ysfpqzzdy-etc-hostname.drv /nix/store/d55j86y8p4va1gwp6jvsa73jp0cnvgql-string-hosts.drv /nix/store/lb24k162gmqrac5mqgidrfq6zshqjs4h-hosts.drv /nix/store/m67x6lz0vaf4yak7fs0a0bx64a3ns696-etc-sysctl.d-60-nixos.conf.drv /nix/store/nzqnl5s2s3w3dm6v9b8d1sz7s6ak51cs-nix.conf.drv /nix/store/ph75v0sjfxi83biqmv1jl67a6wiqr7c0-etc-systemd-system.conf.drv /nix/store/34ww29ak2s1lzs1mnl9rvd3b4cf62bb8-unit-generate-shutdown-ramfs.service.drv /nix/store/c07mjcqnjc3fc0nhw0lzndjm4fahr8vj-X-Restart-Triggers-systemd-sysctl.drv /nix/store/43261xz3m1bja94zdp2d5rjqcw9jhmm5-unit-systemd-sysctl.service.drv /nix/store/6pwkzxs69pmhr2cch8lzmcsnbkblmj6k-unit-systemd-networkd.service.drv /nix/store/an8ljsidw3cv7x6bdyfkarrgpnqdvgn5-unit-suid-sgid-wrappers.service-disabled.drv /nix/store/v5v444ask0q23c02dk12wymihcl1g1yz-unit-resolvconf.service-disabled.drv /nix/store/jpnkgkwb0xdfb4s627dd2fcm6n06y038-X-Restart-Triggers-nix-daemon.drv /nix/store/y53kbdan9jrmpi9px0am4kqsg0wdn81k-unit-nix-daemon.service.drv /nix/store/qwbhjmmszaxjcb90izc1ryfankqq4299-system-units.drv /nix/store/wv59lsh60j0s6bpgfc59215pryaxphxc-etc-ssh-ssh_config.drv /nix/store/2p239fcicgy8fhazppnpzn5fagw2zkgh-etc.drv /nix/store/gg206ryqzk5nj6y0v9rb660w1zgrr2ls-nixos-tmpfiles.d.drv /nix/store/9663888i3idg8pa0czqxvl7lyk0s0lhh-tmpfiles.d.drv /nix/store/a22sjrp6rrxdsjvkffsxmvpsxyyc5hr1-nginx.conf.drv /nix/store/3ij7nazyxni3jjkgzh6pvzryykdi543q-unit-script-acme-ca.foo-start.drv /nix/store/z8f3zyr16gq4ha8mv560f3d2p3g4z4c8-X-Restart-Triggers-acme-ca.foo.drv /nix/store/5cd9cdbrnwy7x20w7mqyy2snc1ghyj94-unit-acme-ca.foo.service.drv /nix/store/ffi9inm3kdr63qr1cr2alwqj0bqlrngw-firewall-reload.drv /nix/store/723sfplqmz2ala7f6mvz8izwbrc13sif-unit-firewall.service.drv /nix/store/9s1vzis0v0cfc49q95vhjbxckmwlmvi9-unit-acme-renew-ca.foo.timer.drv /nix/store/3w4cw75nsibp1j10p62sfq507vfsp59m-X-Restart-Triggers-systemd-tmpfiles-resetup.drv /nix/store/ccfv870v6nagy9brm49akxcxxlrrv8dc-unit-systemd-tmpfiles-resetup.service.drv /nix/store/fn4g4rwdy65c51c61wh8357mx60w5qdm-unit-acme-account-d22a46d9459bf683a338.target.drv /nix/store/h8gsny059y20z5wkh9fv7rn8l13gv0n6-unit-nginx-config-reload.service.drv /nix/store/fwdhmj5h94jzn3sxkl62daxxwh5awsxi-acme-setup-privileged.drv /nix/store/j43pxqdpsac7bkn7zxca23hwbgbcq8c8-unit-acme-setup.service.drv /nix/store/i9brqhb0lxldkjcmqgh5dy0y01w3sxvb-X-Reload-Triggers-systemd-networkd.drv /nix/store/jwlf0il77fjwpjgzv1b3hjlmmaqz3j2q-unit-systemd-networkd.service.drv /nix/store/81j4m9kqqglam2y00ir2ddv289x3rpw7-acme-postrun.drv /nix/store/bvphg1c0va1h62nmw8c3i7c6yxsp7a22-unit-script-acme-order-renew-ca.foo-start.drv /nix/store/s0kf7zg196h6a2cdx9f8zala950q8bi4-unit-acme-order-renew-ca.foo.service.drv /nix/store/ligmz56hcs575k9vr0hqkz57ah3q0i3w-unit-script-nginx-pre-start.drv /nix/store/wkjnkpq8zh3q5v6rzqn6hx2qldv7vg0s-unit-nginx.service.drv /nix/store/hklkkhqdrkychix15xpqq4pskbbg24f3-system-units.drv /nix/store/vzsbxz2896177cf8sxrpfxsdcwlhaazd-etc-hostname.drv /nix/store/2yy79g7j4v4pk1j51i5rx0wk3zq3s87d-etc.drv /nix/store/309jp4cqaasd131isp36i4nsd74zj23d-etc-hostname.drv /nix/store/4aszwz8vmli882yxbvpvv8sg41pj3yfi-system-path.drv /nix/store/664k9kqspgr3fbsc97adraja6qq1j8zf-unit-40-eth1.network.drv /nix/store/cvhhkkxnzpkk2ks4pqv4wcb2cy1w12p2-users-groups.json.drv /nix/store/68323xbhvpchs1j8aqhcdd7i8vs8mmzi-activate.drv /nix/store/vhyn4qhn19vlkcf5xqi2w6g4pkd9fjwh-unit-script-acme-order-renew-test.foo-start.drv /nix/store/6axyaijgjwz27ak9r7j3sinrx9bj70qy-unit-acme-order-renew-test.foo.service.drv /nix/store/yvg6652nj0yqzln9jdy3x0xrljrq5ibz-dbus-1.drv /nix/store/p9495klw94nva9jbmwlh9716f6wzj89f-X-Restart-Triggers-dbus-broker.drv /nix/store/7ikpgcdxhjnpc512935vv0cxjbfz53zr-unit-dbus-broker.service.drv /nix/store/miflnndqykwrynk21cnflckwacxgm23b-ensure-all-wrappers-paths-exist.drv /nix/store/pa9bcmis44kfxhsz42azksjyhw4hkza8-stage-2-init.sh.drv /nix/store/kp39v362dq7px8xq905zlpsb80irpqxh-nixos-system-ca-test.drv /nix/store/956x3wd8f7b11ya2jcx7d3glrly03mld-run-ca-nspawn.drv /nix/store/9yzv2bryd6cwh0qcgg09gyzd6c1d2a5b-unit-script-acme-test.foo-start.drv /nix/store/gc3c5a3kddxihv6v254iq1ni5d5xpblb-X-Restart-Triggers-acme-test.foo.drv /nix/store/b63fi8cnrijyz4vdvw63lhw0gm8gs3ws-unit-acme-test.foo.service.drv /nix/store/b9yiz2k0gkk8kf2yis6cna4f3q0nd8v3-test-script.drv /nix/store/qxmsra7blqdjf5dk2pm9qadnz33pngf6-users-groups.json.drv /nix/store/p1r2x84hk2y6wrmvy9s0msdq1hm9rh1r-activate.drv /nix/store/rsjmkmvyr0f09c2y9qvjcinb9a2i76xy-nixos-system-client-test.drv /nix/store/gg7pxvs0a97cz50dd43prr9j7k1wysjx-run-client-nspawn.drv /nix/store/kpm8l66f6lrhszihx34irnab7pgczvs7-nginx.conf.drv /nix/store/dqszp0ypiwx03bayl09avwlkjr9awpjh-unit-nginx-config-reload.service.drv /nix/store/phvx77nhxy2z9028gy0inn864jg070h1-unit-script-nginx-pre-start.drv /nix/store/glrn7zyyyfykfnsfyvwryjs5wc79a53w-unit-nginx.service.drv /nix/store/i95v9bl274mgmra8nwddfv89dgy5k21g-unit-acme-account-2c44cb477b4787b2cf13.target.drv /nix/store/q76xn0fvifqzh836kf2p5zv1q92857wn-X-Reload-Triggers-systemd-networkd.drv /nix/store/qsdm6239ijj9b2svmazkcj4by6f4piaq-unit-systemd-networkd.service.drv /nix/store/w1m78zzsg0dlzb1bqr9f9k60wsdzrndm-unit-acme-renew-test.foo.timer.drv /nix/store/s1gn8iqljb8c99mvfv7p59c5nigwvgnz-system-units.drv /nix/store/rqg77p13vj1ri4y9r69vr0hajbhcrdhm-unit-dbus-broker.service.drv /nix/store/scrzc55w56i31asrs4km5vh1173221p5-user-units.drv /nix/store/s72z2hnhrqyfnpjkgx6jzk71zc1mwskk-etc.drv /nix/store/ql8p9f0lagq4f2vdlw9mabbbwm4wkfcp-activate.drv /nix/store/zg16zdbmmrn3l9ya22w9hb294nwy1ljx-nixos-system-server-test.drv /nix/store/rd5wa2f60g5dpns4y8jbm9cm9mm0sl9i-run-server-nspawn.drv /nix/store/z43smkvfp095lx0s9bs5p5f6hj99897w-driverConfiguration.json.drv /nix/store/cn0kh1461zwhv68whj32s7pamy3w46xb-nixos-test-driver-certificates.drv /nix/store/k877wzrwv2pqwsssxa0dxl0rr5pjcfgg-container-test-run-certificates.drv these 18 paths will be fetched (11.5 KiB download, 1.4 MiB unpacked): /nix/store/2vczwa524xjscmgjn6iaikns9qgiwijh-dash-0.5.13.5 /nix/store/8l5c90xyfz72wgl3m2s0439z69ilrr0g-decrypt-age-secrets /nix/store/m6a5am0cn3hipnd09ndkx8v7bk871jkq-decrypt-age-secrets /nix/store/pkjjvxgc433sy61g22v4dxp3fn2dkblh-dry-activate /nix/store/rfzh9mm3gm7dgcw1bpig5dpjmd6931jm-dry-activate /nix/store/v149kab5alyhp6dgalxn02jih5crbpwa-dry-activate /nix/store/b16iiv6af4m3b5rhhr1a592f43y41ngk-nss-cacert-3.126 /nix/store/sq7xl9gsz79sjvimm0zm4gl4c0qzjdc4-nss-cacert-3.126-p11kit /nix/store/nppdzc7w6nvy25m6yr5y4g4rrkhcdck0-pam.d /nix/store/kkg1ircarq8r30hmynpzw6nhahy300lj-run-nspawn-1.0 /nix/store/z34xqp999lyaapidq43k3ix29072jr4n-sudoers /nix/store/fxpjcpkqwv5qihpm0vlh329c4fi7ry8n-system-generators /nix/store/ljfkljzf5gjspr5iis7sijg8b922ann8-system-shutdown /nix/store/rzi014k242gw5l572699l68b3gc9rgrv-user-generators /nix/store/8pmxw038djpr2i8g8v7grwc9lp1mcjfy-users-groups.json /nix/store/cfcinqqgf08bpd1ln2v8846gmacd9r06-users-groups.json /nix/store/y9ahz5mm5nz0cddk6awawmmaab3rwzdn-users-groups.json /nix/store/qnmzvrh9vrqkkj5ar02rbh87psh66465-vars-check-certificates warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/4aszwz8vmli882yxbvpvv8sg41pj3yfi-system-path.drv' on nix-store.geninf.io:50051 system-path> attached to the build already running on this worker building '/nix/store/hklkkhqdrkychix15xpqq4pskbbg24f3-system-units.drv' on nix-store.geninf.io:50051 system-units> attached to the build already running on this worker qwbhjmmszaxjcb90izc1ryfankqq4299-system-units.drv: gi-build-x86-02: not scheduled here: qwbhjmmszaxjcb90izc1ryfankqq4299-system-units.drv, asking the scheduler again building '/nix/store/yvg6652nj0yqzln9jdy3x0xrljrq5ibz-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> attached to the build already running on this worker building '/nix/store/p9495klw94nva9jbmwlh9716f6wzj89f-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> attached to the build already running on this worker building '/nix/store/qwbhjmmszaxjcb90izc1ryfankqq4299-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building qwbhjmmszaxjcb90izc1ryfankqq4299-system-units.drv building '/nix/store/7ikpgcdxhjnpc512935vv0cxjbfz53zr-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> attached to the build already running on this worker building '/nix/store/rqg77p13vj1ri4y9r69vr0hajbhcrdhm-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> attached to the build already running on this worker building '/nix/store/scrzc55w56i31asrs4km5vh1173221p5-user-units.drv' on nix-store.geninf.io:50051 user-units> gi-build-x86-02: building scrzc55w56i31asrs4km5vh1173221p5-user-units.drv building '/nix/store/2p239fcicgy8fhazppnpzn5fagw2zkgh-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building 2p239fcicgy8fhazppnpzn5fagw2zkgh-etc.drv building '/nix/store/s1gn8iqljb8c99mvfv7p59c5nigwvgnz-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building s1gn8iqljb8c99mvfv7p59c5nigwvgnz-system-units.drv building '/nix/store/p1r2x84hk2y6wrmvy9s0msdq1hm9rh1r-activate.drv' on nix-store.geninf.io:50051 activate> attached to the build already running on this worker building '/nix/store/s72z2hnhrqyfnpjkgx6jzk71zc1mwskk-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building s72z2hnhrqyfnpjkgx6jzk71zc1mwskk-etc.drv building '/nix/store/rsjmkmvyr0f09c2y9qvjcinb9a2i76xy-nixos-system-client-test.drv' on nix-store.geninf.io:50051 nixos-system-client-test> attached to the build already running on this worker building '/nix/store/2yy79g7j4v4pk1j51i5rx0wk3zq3s87d-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-02: building 2yy79g7j4v4pk1j51i5rx0wk3zq3s87d-etc.drv building '/nix/store/ql8p9f0lagq4f2vdlw9mabbbwm4wkfcp-activate.drv' on nix-store.geninf.io:50051 activate> build-x86-01: building ql8p9f0lagq4f2vdlw9mabbbwm4wkfcp-activate.drv activate> structuredAttrs is enabled building '/nix/store/gg7pxvs0a97cz50dd43prr9j7k1wysjx-run-client-nspawn.drv' on nix-store.geninf.io:50051 run-client-nspawn> build-x86-01: building gg7pxvs0a97cz50dd43prr9j7k1wysjx-run-client-nspawn.drv building '/nix/store/68323xbhvpchs1j8aqhcdd7i8vs8mmzi-activate.drv' on nix-store.geninf.io:50051 activate> attached to the build already running on this worker building '/nix/store/zg16zdbmmrn3l9ya22w9hb294nwy1ljx-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> attached to the build already running on this worker building '/nix/store/kp39v362dq7px8xq905zlpsb80irpqxh-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> gi-build-x86-02: building kp39v362dq7px8xq905zlpsb80irpqxh-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/956x3wd8f7b11ya2jcx7d3glrly03mld-run-ca-nspawn.drv' on nix-store.geninf.io:50051 run-ca-nspawn> attached to the build already running on this worker building '/nix/store/rd5wa2f60g5dpns4y8jbm9cm9mm0sl9i-run-server-nspawn.drv' on nix-store.geninf.io:50051 run-server-nspawn> gi-build-x86-02: building rd5wa2f60g5dpns4y8jbm9cm9mm0sl9i-run-server-nspawn.drv building '/nix/store/z43smkvfp095lx0s9bs5p5f6hj99897w-driverConfiguration.json.drv' on nix-store.geninf.io:50051 driverConfiguration.json> attached to the build already running on this worker building '/nix/store/cn0kh1461zwhv68whj32s7pamy3w46xb-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> gi-build-x86-02: building cn0kh1461zwhv68whj32s7pamy3w46xb-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/k877wzrwv2pqwsssxa0dxl0rr5pjcfgg-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build-x86-01: building k877wzrwv2pqwsssxa0dxl0rr5pjcfgg-container-test-run-certificates.drv container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [1666744.851297] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [1666744.851322] ca systemd-journald[81]: Runtime Journal (/run/log/journal/7e5f4da8eed449db9fecd5aa9209edd1) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [1666744.857534] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [1666744.864339] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [1666744.872142] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [1666744.872491] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [1666744.872790] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [1666744.893579] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/7e5f4da8eed449db9fecd5aa9209edd1 is 890us for 7 entries. container-test-run-certificates> ca # [1666744.893579] ca systemd-journald[81]: System Journal (/var/log/journal/7e5f4da8eed449db9fecd5aa9209edd1) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [1666744.902581] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [1666744.902769] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [1666744.903578] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [1666744.903628] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [1666744.904044] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [1666744.904072] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1666744.904452] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [1666744.904735] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [1666744.904749] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [1666744.914320] ca systemd-tmpfiles[160]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [1666744.914461] ca systemd-tmpfiles[160]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1666744.914559] ca systemd-tmpfiles[160]: fchmod() of /var/log/journal/7e5f4da8eed449db9fecd5aa9209edd1 failed: Operation not permitted container-test-run-certificates> ca # [1666744.914702] ca systemd-tmpfiles[160]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1666744.915439] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [1666744.915882] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [1666744.916202] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [1666744.922389] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [1666744.928064] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [1666744.928459] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [1666744.931231] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [1666744.931291] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [1666744.931425] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [1666744.931832] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [1666744.933491] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [1666745.062435] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [1666745.390314] ca systemd-networkd[197]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1666745.390395] ca systemd-networkd[197]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1666745.397513] ca systemd-networkd[197]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1666745.397651] ca systemd-networkd[197]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1666745.397711] ca systemd-networkd[197]: lo: Link UP container-test-run-certificates> ca # [1666745.397714] ca systemd-networkd[197]: lo: Gained carrier container-test-run-certificates> ca # [1666745.397838] ca systemd-networkd[197]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [1666745.398107] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [1666745.398122] ca systemd-networkd[197]: eth1: Link UP container-test-run-certificates> ca # [1666745.398249] ca systemd-networkd[197]: eth1: Gained carrier container-test-run-certificates> ca # [1666745.398614] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [1666745.424414] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [1666745.749784] ca systemd-resolved[120]: Positive Trust Anchors: container-test-run-certificates> ca # [1666745.749791] ca systemd-resolved[120]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [1666745.749794] ca systemd-resolved[120]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [1666745.749810] ca systemd-resolved[120]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [1666745.760281] ca systemd-resolved[120]: Using system hostname 'ca'. container-test-run-certificates> ca # [1666745.761077] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [1666745.761115] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [1666745.761141] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [1666745.761163] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [1666745.761286] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [1666745.761303] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1666745.761313] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [1666745.761324] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [1666745.761387] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [1666745.761437] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [1666745.761501] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [1666745.761511] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [1666745.761531] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [1666745.762086] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [1666745.762449] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [1666745.762468] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [1666745.762865] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [1666745.763317] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [1666745.763912] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [1666745.789536] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [1666745.850130] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [1666745.876787] ca acme-setup-privileged[204]: + set -euo pipefail container-test-run-certificates> ca # [1666745.876787] ca acme-setup-privileged[204]: + cd /var/lib/acme container-test-run-certificates> ca # [1666745.877074] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [1666745.877806] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [1666745.878638] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1666745.878649] ca acme-setup-privileged[204]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [1666745.878664] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1666745.878664] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [1666745.900327] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [1666745.900414] ca nsncd[206]: Sep 23 14:16:00.323 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [1666745.900356] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [1666745.900380] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [1666745.901385] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [1666745.901686] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [1666745.906989] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [1666745.907492] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [1666745.907509] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [1666745.907520] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [1666746.007370] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [1666746.007806] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [1666746.007806] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/92dpvnx2izg74p9fxmdw8i2jxdlk0jh6-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [1666746.008169] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [1666746.011954] ca dbus-broker-launch[208]: Ready container-test-run-certificates> ca # [1666746.451508] ca systemd-logind[234]: New seat seat0. container-test-run-certificates> ca # [1666746.451619] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [1666746.452264] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [1666746.476118] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [1666746.476199] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [1666746.519499] ca acme-setup-start[221]: + set -euo pipefail container-test-run-certificates> ca # [1666746.519499] ca acme-setup-start[221]: + test -e ca/key.pem container-test-run-certificates> ca # [1666746.519750] ca acme-setup-start[221]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [1666746.526222] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [1666746.527496] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [1666746.624081] ca systemd-networkd[197]: eth1: Gained IPv6LL container-test-run-certificates> ca # [1666746.752834] ca step-ca[207]: badger 2026/09/23 14:16:01 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [1666746.756759] ca step-ca[207]: 2026/09/23 14:16:01 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [1666746.758867] ca step-ca[207]: 2026/09/23 14:16:01 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [1666746.758867] ca step-ca[207]: 2026/09/23 14:16:01 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [1666746.758867] ca step-ca[207]: 2026/09/23 14:16:01 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [1666746.758867] ca step-ca[207]: 2026/09/23 14:16:01 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [1666746.758913] ca step-ca[207]: 2026/09/23 14:16:01 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [1666746.758913] ca step-ca[207]: 2026/09/23 14:16:01 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [1666746.758913] ca step-ca[207]: 2026/09/23 14:16:01 X.509 Root Fingerprint: 93ee5622205c0002ab022d1391223fc0718ec01927269dd8046e0656e33de92d container-test-run-certificates> ca # [1666746.759018] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [1666746.759071] ca step-ca[207]: 2026/09/23 14:16:01 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [1666747.148485] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1666747.150282] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [1666747.150308] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [1666747.154572] ca acme-ca.foo-start[285]: + cd ca.foo container-test-run-certificates> ca # [1666747.154693] ca acme-ca.foo-start[285]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [1666747.155413] ca acme-ca.foo-start[286]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [1666747.155560] ca acme-ca.foo-start[285]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [1666747.156162] ca acme-ca.foo-start[285]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [1666747.156286] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [1666747.157187] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [1666747.157998] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1666747.158754] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [1666747.158773] ca acme-ca.foo-start[259]: + '[' -d out ']' container-test-run-certificates> ca # [1666747.158773] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1666747.159543] ca acme-ca.foo-start[259]: + chown -R acme:nginx out container-test-run-certificates> ca # [1666747.160916] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [1666747.160916] ca acme-ca.foo-start[259]: + '[' -d certificates ']' container-test-run-certificates> ca # [1666747.162850] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [1666747.163593] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [1666747.784848] ca nginx-pre-start[297]: nginx: the configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf syntax is ok container-test-run-certificates> ca # [1666747.785102] ca nginx-pre-start[297]: nginx: configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf test is successful container-test-run-certificates> ca # [1666747.788120] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [1666747.788330] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [1666747.788884] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [1666748.415085] ca acme-order-renew-ca.foo-start[300]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1666748.416636] ca acme-order-renew-ca.foo-start[300]: + set -euo pipefail container-test-run-certificates> ca # [1666748.416663] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [1666748.416691] ca acme-order-renew-ca.foo-start[300]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [1666748.417555] ca acme-order-renew-ca.foo-start[311]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [1666748.418884] ca acme-order-renew-ca.foo-start[300]: + '[' -n '' ']' container-test-run-certificates> ca # [1666748.418884] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [1666748.418965] ca acme-order-renew-ca.foo-start[300]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [1666748.418993] ca acme-order-renew-ca.foo-start[300]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [1666748.428345] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.851657750Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [1666748.441077] ca step-ca[207]: time="2026-09-23T14:16:02Z" level=info duration="133.301µs" duration-ns=133301 fields.time="2026-09-23T14:16:02Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=182c8de0-6be9-4ef3-8f41-67fa7a4b5939 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666748.441394] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.864545271Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [1666748.456711] ca step-ca[207]: time="2026-09-23T14:16:02Z" level=info duration=15.333337ms duration-ns=15333337 fields.time="2026-09-23T14:16:02Z" method=HEAD name=ca nonce=ZHN0Z013UHREdFJPTWFRVll2T2NnWUE3V1hmMWhNMG0 path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=67887bca-df65-467b-a354-88cb66909a66 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666748.459693] ca step-ca[207]: time="2026-09-23T14:16:02Z" level=info duration=2.553429ms duration-ns=2553429 fields.time="2026-09-23T14:16:02Z" method=POST name=ca nonce=akdpZlp3alNKWUlnTFkwaWYxZjdzRERYV2t5VEIwRzA path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f10b2ff6-11fd-4cc9-8efd-cdf98409bcdc response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/eXQOByMjXRBH4R8H6QtJGRDM0KW62HiV/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666748.459860] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.883181819Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [1666748.459860] ca acme-order-renew-ca.foo-start[312]: Your account credentials have been saved in your container-test-run-certificates> ca # [1666748.459860] ca acme-order-renew-ca.foo-start[312]: configuration directory at "accounts". container-test-run-certificates> ca # [1666748.459860] ca acme-order-renew-ca.foo-start[312]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [1666748.459860] ca acme-order-renew-ca.foo-start[312]: configuration directory will also contain private keys container-test-run-certificates> ca # [1666748.459860] ca acme-order-renew-ca.foo-start[312]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [1666748.459860] ca acme-order-renew-ca.foo-start[312]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [1666748.459967] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.883261179Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [1666748.461869] ca step-ca[207]: time="2026-09-23T14:16:02Z" level=info duration=1.737743ms duration-ns=1737743 fields.time="2026-09-23T14:16:02Z" method=POST name=ca nonce=dTMwZzY3QUxtcVpLS21IMncyUEUwWm01b2hlaXBLTFA path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=5cc1cb34-ef68-47a0-bac9-c38a0e0859a6 response="{\"id\":\"TfWi95sJcbxjqiNBAuYFcvDMDysUYQq5\",\"status\":\"pending\",\"expires\":\"2026-09-24T14:16:02Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-23T14:15:02Z\",\"notAfter\":\"2026-12-22T14:16:02Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/iC0nKELrYDMF7IJ1d1YYTOwjK3aEBMyE\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/TfWi95sJcbxjqiNBAuYFcvDMDysUYQq5/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666748.523312] ca step-ca[207]: time="2026-09-23T14:16:02Z" level=info duration=4.924695ms duration-ns=4924695 fields.time="2026-09-23T14:16:02Z" method=POST name=ca nonce=b3FyY0Z0M2xQUVBOVDg4OThXYTJTNTc0blQyYXlua3Q path=/acme/acme/authz/iC0nKELrYDMF7IJ1d1YYTOwjK3aEBMyE protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=7f2ced2f-ca9a-44e1-8504-3443202dc73b response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"7jCsI0dFylW5jStrzpZ8re1KFuSe3ZDw\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/iC0nKELrYDMF7IJ1d1YYTOwjK3aEBMyE/EsDo3iVcd93z5fstP2UCmKJdhWcCUjXj\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"7jCsI0dFylW5jStrzpZ8re1KFuSe3ZDw\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/iC0nKELrYDMF7IJ1d1YYTOwjK3aEBMyE/CMPhKCdKHFTtqaUBb0kPyaT00fkgm0hs\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"7jCsI0dFylW5jStrzpZ8re1KFuSe3ZDw\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/iC0nKELrYDMF7IJ1d1YYTOwjK3aEBMyE/esclrm5GdsOlVTwLJ3XU2VuZPH8nKmBc\"}],\"wildcard\":false,\"expires\":\"2026-09-24T14:16:02Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666748.523516] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.946837453Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [1666748.523516] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.946855737Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [1666748.525969] ca step-ca[207]: time="2026-09-23T14:16:02Z" level=info duration=2.127517ms duration-ns=2127517 fields.time="2026-09-23T14:16:02Z" method=POST name=ca nonce=U2RRUEs0cjZxVDdHVkFqaGhYNXp4YlNwRlZwMUVzWm0 path=/acme/acme/challenge/iC0nKELrYDMF7IJ1d1YYTOwjK3aEBMyE/CMPhKCdKHFTtqaUBb0kPyaT00fkgm0hs protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1d091e2f-0f0b-410f-8781-1d5db64fabdf response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"7jCsI0dFylW5jStrzpZ8re1KFuSe3ZDw\",\"validated\":\"2026-09-23T14:16:02Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/iC0nKELrYDMF7IJ1d1YYTOwjK3aEBMyE/CMPhKCdKHFTtqaUBb0kPyaT00fkgm0hs\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666748.526144] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.949473156Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [1666748.526193] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.949527068Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [1666748.529262] ca step-ca[207]: time="2026-09-23T14:16:02Z" level=info duration=2.715675ms duration-ns=2715675 fields.time="2026-09-23T14:16:02Z" method=POST name=ca nonce=MGRJc0U0ZHF5TG00V0E5T1pYTTRXMWx2Q0ZGOWI5UGY path=/acme/acme/order/TfWi95sJcbxjqiNBAuYFcvDMDysUYQq5/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=2ddea2e3-c455-4f75-b659-4c4c8674bbcc response="{\"id\":\"TfWi95sJcbxjqiNBAuYFcvDMDysUYQq5\",\"status\":\"valid\",\"expires\":\"2026-09-24T14:16:02Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-23T14:15:02Z\",\"notAfter\":\"2026-12-22T14:16:02Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/iC0nKELrYDMF7IJ1d1YYTOwjK3aEBMyE\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/TfWi95sJcbxjqiNBAuYFcvDMDysUYQq5/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/oiz3rOB9su0Es6DZp1jKXtwaRM3DeVYg\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666748.530158] ca step-ca[207]: time="2026-09-23T14:16:02Z" level=info certificate="MIIB1DCCAXqgAwIBAgIRAJvMFtm0pXXjsq1x09vhOecwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTIzMTQxNTAyWhcNMjYxMjIyMTQxNjAyWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASfLT1BPp4JnVd4qvisYd/La+7xDhrk3e+17ZjzNYgMXXBUzssIXPL7zaIQGqw2vTPg3bkz5pslmtwuPe3d4IFbo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFJWDn2zXVsf2S3jiMSp2nwbXQ5utMB8GA1UdIwQYMBaAFOgYrQP6nU1xBBFSZeqIo4n4HgKYMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIhAImpYLyXEgBaCzQy/sKkd7B6qspn41rZSUVtwxGlYX45AiBpfEY/DvlM58PbIItCMPLOaUudTHtDBbdBacFyAETbgA==" duration="630.387µs" duration-ns=630387 fields.time="2026-09-23T14:16:02Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=eHpIb29ocnR1UVBpb0RLM01jRm1rZTNqZlMzVVg5R0c path=/acme/acme/certificate/oiz3rOB9su0Es6DZp1jKXtwaRM3DeVYg protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=e1dc131b-3441-4d51-a40d-66939513d126 sans="map[dns:[ca.foo]]" serial=207090031367232942313663898962488277479 size=1344 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-09-23T14:15:02Z" valid-to="2026-12-22T14:16:02Z" container-test-run-certificates> ca # [1666748.530232] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.953565133Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [1666748.530256] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.953591553Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [1666748.530298] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.953633602Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [1666748.530322] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.953658128Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [1666748.530364] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T14:16:02.953699937Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [1666748.532146] ca acme-order-renew-ca.foo-start[300]: + touch out/acme-success container-test-run-certificates> ca # [1666748.532951] ca acme-order-renew-ca.foo-start[300]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1666748.533517] ca acme-order-renew-ca.foo-start[300]: + touch out/renewed container-test-run-certificates> ca # [1666748.534241] ca acme-order-renew-ca.foo-start[300]: + echo Installing new certificate container-test-run-certificates> ca # [1666748.534241] ca acme-order-renew-ca.foo-start[300]: Installing new certificate container-test-run-certificates> ca # [1666748.534267] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1666748.534962] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [1666748.535083] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [1666748.535751] ca acme-order-renew-ca.foo-start[335]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [1666748.535854] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [1666748.536870] ca acme-order-renew-ca.foo-start[336]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [1666748.537061] ca acme-order-renew-ca.foo-start[300]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [1666748.537876] ca acme-order-renew-ca.foo-start[300]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1666748.538663] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [1666748.538678] ca acme-order-renew-ca.foo-start[300]: + '[' -d out ']' container-test-run-certificates> ca # [1666748.538678] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1666748.539451] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx out container-test-run-certificates> ca # [1666748.540852] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [1666748.540861] ca acme-order-renew-ca.foo-start[300]: + '[' -d certificates ']' container-test-run-certificates> ca # [1666748.540861] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [1666748.541677] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [1666748.543177] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [1666748.655153] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [1666748.657529] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [1666748.657623] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [1666749.287875] ca nginx[352]: nginx: the configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf syntax is ok container-test-run-certificates> ca # [1666749.288218] ca nginx[352]: nginx: configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 5.64 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [1666749.899817] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [1666749.899971] ca systemd[1]: Startup finished in 5.281s. container-test-run-certificates> ca # [1666750.006525] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [1666750.060918] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [1666750.061064] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [1666750.061082] ca systemd[1]: nginx.service: Consumed 2.424s CPU time over 2.897s wall clock time. container-test-run-certificates> ca # [1666750.062462] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.70 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 445) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 448) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ca # [1666750.693759] ca nginx-pre-start[376]: nginx: the configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf syntax is ok container-test-run-certificates> ca # [1666750.694044] ca nginx-pre-start[376]: nginx: configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf test is successful container-test-run-certificates> ca # [1666750.696745] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1666751.239430] server systemd-journald[72]: Journal started container-test-run-certificates> server # [1666751.239454] server systemd-journald[72]: Runtime Journal (/run/log/journal/51f9b57568604ec8bd8c38e72922a1fd) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [1666751.245472] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [1666751.252114] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [1666751.273162] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [1666751.273603] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [1666751.273911] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [1666751.278538] server systemd-journald[72]: Time spent on flushing to /var/log/journal/51f9b57568604ec8bd8c38e72922a1fd is 994us for 7 entries. container-test-run-certificates> server # [1666751.278538] server systemd-journald[72]: System Journal (/var/log/journal/51f9b57568604ec8bd8c38e72922a1fd) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [1666751.293096] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [1666751.293435] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [1666751.294274] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [1666751.294329] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [1666751.294760] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [1666751.294784] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1666751.295198] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [1666751.295515] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [1666751.295529] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [1666751.305598] server systemd-tmpfiles[147]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [1666751.305741] server systemd-tmpfiles[147]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [1666751.305844] server systemd-tmpfiles[147]: fchmod() of /var/log/journal/51f9b57568604ec8bd8c38e72922a1fd failed: Operation not permitted container-test-run-certificates> server # [1666751.305988] server systemd-tmpfiles[147]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [1666751.306910] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [1666751.307398] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [1666751.307719] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [1666751.314732] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [1666751.319654] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [1666751.320156] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [1666751.325034] server systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [1666751.330464] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [1666751.330552] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [1666751.330675] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [1666751.331136] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [1666751.369992] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [1666751.234032] client systemd-journald[72]: Journal started container-test-run-certificates> client # [1666751.234057] client systemd-journald[72]: Runtime Journal (/run/log/journal/24e16f15fdb04c23b017240c64f28513) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [1666751.240421] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [1666751.247280] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [1666751.255171] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [1666751.255495] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [1666751.255781] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [1666751.276104] client systemd-journald[72]: Time spent on flushing to /var/log/journal/24e16f15fdb04c23b017240c64f28513 is 880us for 7 entries. container-test-run-certificates> client # [1666751.276104] client systemd-journald[72]: System Journal (/var/log/journal/24e16f15fdb04c23b017240c64f28513) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [1666751.285866] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [1666751.286082] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [1666751.286692] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [1666751.286735] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [1666751.287158] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [1666751.287185] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1666751.287525] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [1666751.287810] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [1666751.287824] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [1666751.296644] client systemd-tmpfiles[145]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [1666751.296785] client systemd-tmpfiles[145]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [1666751.296882] client systemd-tmpfiles[145]: fchmod() of /var/log/journal/24e16f15fdb04c23b017240c64f28513 failed: Operation not permitted container-test-run-certificates> client # [1666751.297031] client systemd-tmpfiles[145]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [1666751.297769] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [1666751.298221] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [1666751.298529] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [1666751.304627] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [1666751.310463] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [1666751.310965] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [1666751.315922] client systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [1666751.321797] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [1666751.321883] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [1666751.322007] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [1666751.322425] client systemd[1]: Starting Network Management... container-test-run-certificates> client # [1666751.370162] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [1666751.796833] client systemd-networkd[185]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1666751.796904] client systemd-networkd[185]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1666751.804589] client systemd-networkd[185]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1666751.804738] client systemd-networkd[185]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1666751.804810] client systemd-networkd[185]: lo: Link UP container-test-run-certificates> client # [1666751.804813] client systemd-networkd[185]: lo: Gained carrier container-test-run-certificates> client # [1666751.804942] client systemd-networkd[185]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [1666751.805237] client systemd[1]: Started Network Management. container-test-run-certificates> client # [1666751.805237] client systemd-networkd[185]: eth1: Link UP container-test-run-certificates> client # [1666751.805372] client systemd-networkd[185]: eth1: Gained carrier container-test-run-certificates> client # [1666751.805980] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [1666751.833283] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [1666751.801257] server systemd-networkd[189]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1666751.801333] server systemd-networkd[189]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1666751.808709] server systemd-networkd[189]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1666751.808853] server systemd-networkd[189]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1666751.808905] server systemd-networkd[189]: lo: Link UP container-test-run-certificates> server # [1666751.808908] server systemd-networkd[189]: lo: Gained carrier container-test-run-certificates> server # [1666751.809027] server systemd-networkd[189]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [1666751.809283] server systemd[1]: Started Network Management. container-test-run-certificates> server # [1666751.829116] server systemd-networkd[189]: eth1: Link UP container-test-run-certificates> server # [1666751.829209] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [1666751.829309] server systemd-networkd[189]: eth1: Gained carrier container-test-run-certificates> server # [1666751.841844] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [1666752.152363] server systemd-resolved[121]: Positive Trust Anchors: container-test-run-certificates> server # [1666752.152371] server systemd-resolved[121]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [1666752.152374] server systemd-resolved[121]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [1666752.152390] server systemd-resolved[121]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [1666752.162701] server systemd-resolved[121]: Using system hostname 'server'. container-test-run-certificates> server # [1666752.163499] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [1666752.163539] server systemd[1]: Reached target Network. container-test-run-certificates> server # [1666752.163568] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [1666752.163592] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [1666752.163715] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [1666752.163730] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1666752.163744] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [1666752.163754] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [1666752.163826] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [1666752.163897] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [1666752.163989] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [1666752.163999] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [1666752.164027] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [1666752.164627] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [1666752.164946] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [1666752.164963] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [1666752.165336] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [1666752.165923] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [1666752.191600] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [1666752.238064] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [1666752.272535] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [1666752.272535] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [1666752.272535] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [1666752.273714] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [1666752.274605] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1666752.274605] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [1666752.274660] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1666752.274660] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [1666752.297613] server nsncd[197]: Sep 23 14:16:06.720 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [1666752.297620] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [1666752.297648] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [1666752.297673] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [1666752.303131] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [1666752.303506] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [1666752.308490] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [1666752.308884] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [1666752.308900] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [1666752.308909] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [1666752.409272] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [1666752.409916] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [1666752.409916] server dbus-broker-launch[198]: Invalid user-name in /nix/store/c02lr3b0bgpmd8c0jfrflwkam4h2k3z7-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [1666752.153040] client systemd-resolved[108]: Positive Trust Anchors: container-test-run-certificates> client # [1666752.153047] client systemd-resolved[108]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [1666752.153050] client systemd-resolved[108]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [1666752.153064] client systemd-resolved[108]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [1666752.163441] client systemd-resolved[108]: Using system hostname 'client'. container-test-run-certificates> client # [1666752.164291] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [1666752.164334] client systemd[1]: Reached target Network. container-test-run-certificates> client # [1666752.164367] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [1666752.164397] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1666752.164413] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [1666752.164423] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [1666752.164500] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [1666752.164564] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [1666752.164634] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [1666752.164644] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [1666752.164664] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [1666752.165269] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [1666752.165681] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [1666752.166241] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [1666752.191924] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [1666752.233051] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [1666752.295810] client nsncd[192]: Sep 23 14:16:06.719 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [1666752.295854] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [1666752.295899] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [1666752.295938] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [1666752.303140] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [1666752.303520] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [1666752.308752] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [1666752.309215] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [1666752.309232] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [1666752.309241] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [1666752.412874] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [1666752.413251] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [1666752.413251] client dbus-broker-launch[193]: Invalid user-name in /nix/store/k1wkxjg7rqm8aki2ngjxfj3lf1b0qmmn-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [1666752.410292] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [1666752.414075] server dbus-broker-launch[198]: Ready container-test-run-certificates> client # [1666752.413527] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [1666752.416983] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [1666752.846704] server systemd-logind[222]: New seat seat0. container-test-run-certificates> server # [1666752.846829] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [1666752.847644] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [1666752.869170] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [1666752.869245] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [1666752.911284] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [1666752.911284] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [1666752.911510] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [1666752.918640] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [1666752.919438] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> client # [1666752.850060] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [1666752.850138] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [1666752.865185] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [1666752.871828] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [1666752.871870] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [1666752.872419] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [1666752.872551] client systemd[1]: Startup finished in 1.915s. container-test-run-certificates> server # [1666753.535575] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1666753.536087] server systemd-networkd[189]: eth1: Gained IPv6LL container-test-run-certificates> server # [1666753.537304] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [1666753.537304] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [1666753.541511] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [1666753.541655] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [1666753.542482] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [1666753.542621] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [1666753.543484] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [1666753.543524] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [1666753.544327] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [1666753.545087] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1666753.545855] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1666753.545855] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [1666753.545855] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1666753.546615] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [1666753.547954] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1666753.547954] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [1666753.549835] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [1666753.550548] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> client # [1666753.344099] client systemd-networkd[185]: eth1: Gained IPv6LL container-test-run-certificates> server # [1666754.154289] server nginx-pre-start[270]: nginx: the configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf syntax is ok container-test-run-certificates> server # [1666754.154549] server nginx-pre-start[270]: nginx: configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf test is successful container-test-run-certificates> server # [1666754.157273] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1666754.157451] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [1666754.158010] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [1666754.761005] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1666754.762611] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [1666754.762656] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1666754.762656] server acme-order-renew-test.foo-start[273]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [1666754.763388] server acme-order-renew-test.foo-start[284]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [1666754.764717] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [1666754.764744] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1666754.764769] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [1666754.764787] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [1666754.773922] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.197231747Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [1666754.787320] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.210645039Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [1666754.791988] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.215320163Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [1666754.791988] server acme-order-renew-test.foo-start[285]: Your account credentials have been saved in your container-test-run-certificates> server # [1666754.791988] server acme-order-renew-test.foo-start[285]: configuration directory at "accounts". container-test-run-certificates> server # [1666754.791988] server acme-order-renew-test.foo-start[285]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [1666754.791988] server acme-order-renew-test.foo-start[285]: configuration directory will also contain private keys container-test-run-certificates> server # [1666754.791988] server acme-order-renew-test.foo-start[285]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [1666754.791988] server acme-order-renew-test.foo-start[285]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [1666754.792108] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.215381859Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [1666754.851448] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.274774304Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [1666754.851448] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.274785685Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [1666754.853608] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.276938820Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [1666754.853631] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.276965350Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [1666754.857132] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.280463739Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [1666754.857159] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.280486361Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [1666754.857179] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.280517159Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [1666754.857204] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.280535584Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [1666754.857233] server acme-order-renew-test.foo-start[285]: 2026-09-23T14:16:09.280568376Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [1666754.858842] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [1666754.859900] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1666754.860513] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [1666754.861287] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [1666754.861287] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [1666754.861309] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1666754.862046] server acme-order-renew-test.foo-start[305]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [1666754.862181] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [1666754.862908] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [1666754.863040] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [1666754.863776] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [1666754.863894] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [1666754.864720] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1666754.865812] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1666754.865812] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [1666754.865843] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1666754.866690] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [1666754.868107] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1666754.868107] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [1666754.868141] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [1666754.868998] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [1666754.870304] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [1666754.969624] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [1666754.972205] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [1666754.972311] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> ca # [1666754.787079] ca step-ca[207]: time="2026-09-23T14:16:09Z" level=info duration="54.082µs" duration-ns=54082 fields.time="2026-09-23T14:16:09Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=2d2cca4d-12a0-4654-9391-b95204f3859d response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666754.790067] ca step-ca[207]: time="2026-09-23T14:16:09Z" level=info duration=1.975371ms duration-ns=1975371 fields.time="2026-09-23T14:16:09Z" method=HEAD name=ca nonce=aFI0ZHpLUThDV1llMlpKYk90Q3FFWlY2YVY1RkF2Sjc path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=74b92897-89e2-44a1-acd4-bc559d73c403 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666754.791806] ca step-ca[207]: time="2026-09-23T14:16:09Z" level=info duration="839.201µs" duration-ns=839201 fields.time="2026-09-23T14:16:09Z" method=POST name=ca nonce=RFhoOHVHOXJlenhQNmcwS2FDRG9DV0FwVDFQMXdrRTc path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=83ac03bc-444b-4dc7-a4be-3caa2bf65d59 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/wVFa5Wn23An2nKumpAH9Sgr2WJOTKHbD/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666754.793884] ca step-ca[207]: time="2026-09-23T14:16:09Z" level=info duration=1.228954ms duration-ns=1228954 fields.time="2026-09-23T14:16:09Z" method=POST name=ca nonce=eUE3MEpKdHdSbzRXN0VRV0pXeWdmMm9XemdwWTZ1NTQ path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=f461bf76-e458-45cc-9b7c-b5a5b4a49499 response="{\"id\":\"KGSXRT23nMgBKfshWv6IFDIFzlotiPtk\",\"status\":\"pending\",\"expires\":\"2026-09-24T14:16:09Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-23T14:15:09Z\",\"notAfter\":\"2026-12-22T14:16:09Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/tEiXqC4yLaR2tV6cMioZzRPEQDM98iRf\"],\"finalize\":\"https://ca.foo/acme/acme/order/KGSXRT23nMgBKfshWv6IFDIFzlotiPtk/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666754.851294] ca step-ca[207]: time="2026-09-23T14:16:09Z" level=info duration="495.453µs" duration-ns=495453 fields.time="2026-09-23T14:16:09Z" method=POST name=ca nonce=R3V6bDBtT0dYajVSd08weVkyRWFVOFlnNHQ0ZGVPSnk path=/acme/acme/authz/tEiXqC4yLaR2tV6cMioZzRPEQDM98iRf protocol=HTTP/1.1 referer= remote-address="::1" request-id=14e854db-f185-4051-b9bf-7a040aba8082 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"ZM5M0NkGiBTKb99kkAZMlrSMSNXs2uES\",\"url\":\"https://ca.foo/acme/acme/challenge/tEiXqC4yLaR2tV6cMioZzRPEQDM98iRf/iICduSv5SKk192JYIjSewGwiUQUYqA2P\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"ZM5M0NkGiBTKb99kkAZMlrSMSNXs2uES\",\"url\":\"https://ca.foo/acme/acme/challenge/tEiXqC4yLaR2tV6cMioZzRPEQDM98iRf/BHoqj4ENOF8n3tuSfoD0z9oxLNVm3NSZ\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"ZM5M0NkGiBTKb99kkAZMlrSMSNXs2uES\",\"url\":\"https://ca.foo/acme/acme/challenge/tEiXqC4yLaR2tV6cMioZzRPEQDM98iRf/aUuNEjU6x7CKI9V7c63QAQKnP5jaBbLO\"}],\"wildcard\":false,\"expires\":\"2026-09-24T14:16:09Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666754.853459] ca step-ca[207]: time="2026-09-23T14:16:09Z" level=info duration=1.337789ms duration-ns=1337789 fields.time="2026-09-23T14:16:09Z" method=POST name=ca nonce=aExMbmhSbW94WlJycEdZbjR3U1U2SU1HYXRvbDlySTQ path=/acme/acme/challenge/tEiXqC4yLaR2tV6cMioZzRPEQDM98iRf/BHoqj4ENOF8n3tuSfoD0z9oxLNVm3NSZ protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=4a2d8230-d6cb-47b5-b76b-57053708631c response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"ZM5M0NkGiBTKb99kkAZMlrSMSNXs2uES\",\"validated\":\"2026-09-23T14:16:09Z\",\"url\":\"https://ca.foo/acme/acme/challenge/tEiXqC4yLaR2tV6cMioZzRPEQDM98iRf/BHoqj4ENOF8n3tuSfoD0z9oxLNVm3NSZ\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666754.855992] ca step-ca[207]: time="2026-09-23T14:16:09Z" level=info duration=1.647462ms duration-ns=1647462 fields.time="2026-09-23T14:16:09Z" method=POST name=ca nonce=Z1pIbTJTekpJbDYybW1EOWVBeXlrQ1kzN0NJR1BteVM path=/acme/acme/order/KGSXRT23nMgBKfshWv6IFDIFzlotiPtk/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=04d4986d-730c-458b-924e-ddfa5ed1d7de response="{\"id\":\"KGSXRT23nMgBKfshWv6IFDIFzlotiPtk\",\"status\":\"valid\",\"expires\":\"2026-09-24T14:16:09Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-23T14:15:09Z\",\"notAfter\":\"2026-12-22T14:16:09Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/tEiXqC4yLaR2tV6cMioZzRPEQDM98iRf\"],\"finalize\":\"https://ca.foo/acme/acme/order/KGSXRT23nMgBKfshWv6IFDIFzlotiPtk/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/Asgte6qXZ6OUBFxzTrH4PzkAJcz4O2EL\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1666754.857021] ca step-ca[207]: time="2026-09-23T14:16:09Z" level=info certificate="MIIB2DCCAX6gAwIBAgIRAMHzHkFoFNf4obrIS49q8I0wCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTIzMTQxNTA5WhcNMjYxMjIyMTQxNjA5WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNV+NoYtuEEBpooxq2QjJSLtZwKwaW6UVAfkMFPMLULNA9ow/FhTLf7HePL51ZYMJN6e5x5mew0zjhWAN+mK1jSjgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUywapDsa+mTtgjxIkO1LXirmMDKMwHwYDVR0jBBgwFoAU6BitA/qdTXEEEVJl6oijifgeApgwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0gAMEUCIGOggDdvVR8140k6CgLdlI8yst0gRONOk8VxSMS+8UWBAiEAkMgho5DgdEnREgGXNGk8oiFl5i0t4nD3yHkxPdOUiY4=" duration="367.132µs" duration-ns=367132 fields.time="2026-09-23T14:16:09Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=b09XbFJpNzBFdTloaTBXdVFRMXJqUHR0Z0RMZ2pJWG0 path=/acme/acme/certificate/Asgte6qXZ6OUBFxzTrH4PzkAJcz4O2EL protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=6b7661a0-603b-494c-bf84-15509da0b032 sans="map[dns:[test.foo]]" serial=257803344977443038994514709437192269965 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-09-23T14:15:09Z" valid-to="2026-12-22T14:16:09Z" container-test-run-certificates> server # [1666755.579626] server nginx[323]: nginx: the configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf syntax is ok container-test-run-certificates> server # [1666755.579851] server nginx[323]: nginx: configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf test is successful container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 5.64 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [1666756.175617] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [1666756.179055] server systemd[1]: Startup finished in 5.220s. container-test-run-certificates> server # [1666756.342353] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [1666756.375958] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [1666756.376117] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [1666756.376144] server systemd[1]: nginx.service: Consumed 3.611s CPU time over 2.825s wall clock time. container-test-run-certificates> server # [1666756.377659] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.66 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 33416 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 57926 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> server # [1666756.988868] server nginx-pre-start[346]: nginx: the configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf syntax is ok container-test-run-certificates> server # [1666756.989124] server nginx-pre-start[346]: nginx: configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf test is successful container-test-run-certificates> server # [1666756.991539] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [931 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [80 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 23 14:15:09 2026 GMT container-test-run-certificates> * expire date: Dec 22 14:16:09 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 33432 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1880 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> c1:f3:1e:41:68:14:d7:f8:a1:ba:c8:4b:8f:6a:f0:8d container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Sep 23 14:15:09 2026 GMT container-test-run-certificates> Not After : Dec 22 14:16:09 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:d5:7e:36:86:2d:b8:41:01:a6:8a:31:ab:64:23: container-test-run-certificates> 25:22:ed:67:02:b0:69:6e:94:54:07:e4:30:53:cc: container-test-run-certificates> 2d:42:cd:03:da:30:fc:58:53:2d:fe:c7:78:f2:f9: container-test-run-certificates> d5:96:0c:24:de:9e:e7:1e:66:7b:0d:33:8e:15:80: container-test-run-certificates> 37:e9:8a:d6:34 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> CB:06:A9:0E:C6:BE:99:3B:60:8F:12:24:3B:52:D7:8A:B9:8C:0C:A3 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> E8:18:AD:03:FA:9D:4D:71:04:11:52:65:EA:88:A3:89:F8:1E:02:98 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:45:02:20:63:a0:80:37:6f:55:1f:35:e3:49:3a:0a:02:dd: container-test-run-certificates> 94:8f:32:b2:dd:20:44:e3:4e:93:c5:71:48:c4:be:f1:45:81: container-test-run-certificates> 02:21:00:90:c8:21:a3:90:e0:74:49:d1:12:01:97:34:69:3c: container-test-run-certificates> a2:21:65:e6:2d:2d:e2:70:f7:c8:79:31:3d:d3:94:89:8e container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 13.68 seconds) container-test-run-certificates> test script finished in 13.77s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 448) container-test-run-certificates> kill NspawnMachine (pid 445) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.21 seconds) container-test-run-certificates> Container server terminated by signal KILL.