container-test-run-certificates
checks.aarch64-linux.certificates
· build #770
· raw
1build01: building ifkjii7h9dqc28i0dfyznsh906g40k4s-container-test-run-certificates.drv2additionally exposed symbols:3 ca, client, server,4 start_all, machines, driver, Machine, wait_for_signal5Starting ca6Starting client7Starting server89101112<<< NixOS Stage 2 >>>1314booting system configuration /nix/store/sbjs7j4jsr060df416d8fvjz5mcjipxz-nixos-system-ca-test15running activation script...16setting up /etc...172: host0@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100018 link/ether 42:06:76:42:a9:8d brd ff:ff:ff:ff:ff:ff link-netnsid 019setting up age secrets...20starting systemd...21systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)22Detected virtualization systemd-nspawn.23Detected architecture arm64.24Detected first boot.25Initializing machine ID from container UUID.26Applying preset policy.27Populated /etc with preset unit settings.28Queued start job for default target Multi-User System.29303132<<< Welcome to NixOS test (aarch64) - console >>>33+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo ed7bdfd9-b0de-4158-b229-53c0811efd82'34Running as unit: run-p469-i22492459.service; invocation ID: 438eecd8f8674585a82b126cdf72824b35To attach to container ca run on the same machine that runs the test:36 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*ed7bdfd9-b0de-4158-b229-53c0811efd82') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 3738To inject external network and continue test, run:39sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py ed7bdfd9-b0de-4158-b229-53c0811efd824041<<< NixOS Stage 2 >>>4243booting system configuration /nix/store/zi6f7ymcd8y8di36ikqwwq8w8mmypmwk-nixos-system-client-test44running activation script...45setting up /etc...462: host0@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100047 link/ether 2a:42:35:28:b1:2f brd ff:ff:ff:ff:ff:ff link-netnsid 048setting up age secrets...49starting systemd...50systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)51Detected virtualization systemd-nspawn.52Detected architecture arm64.53Detected first boot.54Initializing machine ID from container UUID.55Applying preset policy.56Populated /etc with preset unit settings.57Queued start job for default target Multi-User System.58596061<<< Welcome to NixOS test (aarch64) - console >>>62+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo 00444c2f-da29-4e79-bb2c-734c6df37351'63Running as unit: run-p303-i22492462.service; invocation ID: a868106c69e2437a80a73b5f1f8ea8e564To attach to container client run on the same machine that runs the test:65 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*00444c2f-da29-4e79-bb2c-734c6df37351') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 6667To inject external network and continue test, run:68sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 00444c2f-da29-4e79-bb2c-734c6df373516970<<< NixOS Stage 2 >>>7172booting system configuration /nix/store/brw5ryqm65q4sic9g4z085546ha1bhns-nixos-system-server-test73running activation script...74setting up /etc...752: host0@if5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100076 link/ether be:aa:dd:39:86:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 077setting up age secrets...78starting systemd...79systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)80Detected virtualization systemd-nspawn.81Detected architecture arm64.82Detected first boot.83Initializing machine ID from container UUID.84Applying preset policy.85Populated /etc with preset unit settings.86Queued start job for default target Multi-User System.87888990<<< Welcome to NixOS test (aarch64) - console >>>91+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo f8cf4961-e75c-4b59-bd59-18821a07d85e'92Running as unit: run-p397-i22492465.service; invocation ID: 077d37766b1a4359886959a9dfaaf9c193To attach to container server run on the same machine that runs the test:94 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*f8cf4961-e75c-4b59-bd59-18821a07d85e') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 9596To inject external network and continue test, run:97sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py f8cf4961-e75c-4b59-bd59-18821a07d85e98+ systemctl restart acme-order-renew-ca.foo.service99+ systemctl restart acme-test.foo.service100client: waiting for success: curl -v https://test.foo101+ curl -v https://test.foo102* Host test.foo:443 was resolved.103* IPv6: (none)104* IPv4: 192.168.1.3105* Trying 192.168.1.3:443...106* ALPN: curl offers h2,http/1.1107} [5 bytes data]108* TLSv1.3 (OUT), TLS handshake, Client hello (1):109} [1552 bytes data]110* SSL Trust Anchors:111* OpenSSL default paths (fallback)112{ [5 bytes data]113* TLSv1.3 (IN), TLS handshake, Server hello (2):114{ [1210 bytes data]115* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):116{ [1 bytes data]117* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):118{ [19 bytes data]119* TLSv1.3 (IN), TLS handshake, Certificate (11):120{ [1011 bytes data]121* TLSv1.3 (IN), TLS handshake, CERT verify (15):122{ [110 bytes data]123* TLSv1.3 (IN), TLS handshake, Finished (20):124{ [52 bytes data]125* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):126} [1 bytes data]127* TLSv1.3 (OUT), TLS handshake, Finished (20):128} [52 bytes data]129* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey130* ALPN: server accepted h2131* Server certificate:132* subject: CN=test.foo133* start date: Sep 24 18:32:02 2026 GMT134* expire date: Oct 24 18:32:02 2028 GMT135* issuer: CN=minica root ca 5aab09136* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384137* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384138* subjectAltName: "test.foo" matches cert's "test.foo"139* OpenSSL verify result: 13140* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)141* closing connection #0142curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)143More details here: https://curl.se/docs/sslcerts.html144145curl failed to verify the legitimacy of the server and therefore could not146establish a secure connection to it. To learn more about this situation and147how to fix it, please visit the webpage mentioned above.148+ curl -v https://test.foo149* Host test.foo:443 was resolved.150* IPv6: (none)151* IPv4: 192.168.1.3152* Trying 192.168.1.3:443...153* ALPN: curl offers h2,http/1.1154} [5 bytes data]155* TLSv1.3 (OUT), TLS handshake, Client hello (1):156} [1552 bytes data]157* SSL Trust Anchors:158* OpenSSL default paths (fallback)159{ [5 bytes data]160* TLSv1.3 (IN), TLS handshake, Server hello (2):161{ [1210 bytes data]162* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):163{ [1 bytes data]164* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):165{ [19 bytes data]166* TLSv1.3 (IN), TLS handshake, Certificate (11):167{ [1011 bytes data]168* TLSv1.3 (IN), TLS handshake, CERT verify (15):169{ [111 bytes data]170* TLSv1.3 (IN), TLS handshake, Finished (20):171{ [52 bytes data]172* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):173} [1 bytes data]174* TLSv1.3 (OUT), TLS handshake, Finished (20):175} [52 bytes data]176* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey177* ALPN: server accepted h2178* Server certificate:179* subject: CN=test.foo180* start date: Sep 24 18:32:02 2026 GMT181* expire date: Oct 24 18:32:02 2028 GMT182* issuer: CN=minica root ca 5aab09183* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384184* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384185* subjectAltName: "test.foo" matches cert's "test.foo"186* OpenSSL verify result: 13187* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)188* closing connection #0189curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)190More details here: https://curl.se/docs/sslcerts.html191192curl failed to verify the legitimacy of the server and therefore could not193establish a secure connection to it. To learn more about this situation and194how to fix it, please visit the webpage mentioned above.195+ curl -v https://test.foo196* Host test.foo:443 was resolved.197* IPv6: (none)198* IPv4: 192.168.1.3199* Trying 192.168.1.3:443...200* ALPN: curl offers h2,http/1.1201} [5 bytes data]202* TLSv1.3 (OUT), TLS handshake, Client hello (1):203} [1552 bytes data]204* SSL Trust Anchors:205* OpenSSL default paths (fallback)206{ [5 bytes data]207* TLSv1.3 (IN), TLS handshake, Server hello (2):208{ [1210 bytes data]209* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):210{ [1 bytes data]211* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):212{ [19 bytes data]213* TLSv1.3 (IN), TLS handshake, Certificate (11):214{ [1011 bytes data]215* TLSv1.3 (IN), TLS handshake, CERT verify (15):216{ [111 bytes data]217* TLSv1.3 (IN), TLS handshake, Finished (20):218{ [52 bytes data]219* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):220} [1 bytes data]221* TLSv1.3 (OUT), TLS handshake, Finished (20):222} [52 bytes data]223* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey224* ALPN: server accepted h2225* Server certificate:226* subject: CN=test.foo227* start date: Sep 24 18:32:02 2026 GMT228* expire date: Oct 24 18:32:02 2028 GMT229* issuer: CN=minica root ca 5aab09230* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384231* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384232* subjectAltName: "test.foo" matches cert's "test.foo"233* OpenSSL verify result: 13234* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)235* closing connection #0236curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)237More details here: https://curl.se/docs/sslcerts.html238239curl failed to verify the legitimacy of the server and therefore could not240establish a secure connection to it. To learn more about this situation and241how to fix it, please visit the webpage mentioned above.242+ curl -v https://test.foo243* Host test.foo:443 was resolved.244* IPv6: (none)245* IPv4: 192.168.1.3246* Trying 192.168.1.3:443...247* ALPN: curl offers h2,http/1.1248} [5 bytes data]249* TLSv1.3 (OUT), TLS handshake, Client hello (1):250} [1552 bytes data]251* SSL Trust Anchors:252* OpenSSL default paths (fallback)253{ [5 bytes data]254* TLSv1.3 (IN), TLS handshake, Server hello (2):255{ [1210 bytes data]256* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):257{ [1 bytes data]258* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):259{ [19 bytes data]260* TLSv1.3 (IN), TLS handshake, Certificate (11):261{ [931 bytes data]262* TLSv1.3 (IN), TLS handshake, CERT verify (15):263{ [80 bytes data]264* TLSv1.3 (IN), TLS handshake, Finished (20):265{ [52 bytes data]266* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):267} [1 bytes data]268* TLSv1.3 (OUT), TLS handshake, Finished (20):269} [52 bytes data]270* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey271* ALPN: server accepted h2272* Server certificate:273* subject: CN=test.foo274* start date: Sep 24 18:31:16 2026 GMT275* expire date: Dec 23 18:32:16 2026 GMT276* issuer: CN=Clan Intermediate CA277* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256278* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256279* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256280* subjectAltName: "test.foo" matches cert's "test.foo"281* OpenSSL verify result: 0282* SSL certificate verified via OpenSSL.283* Established connection to test.foo (192.168.1.3 port 443) from 192.168.1.2 port 40498 284 % Total % Received % Xferd Average Speed Time Time Time Current285 Dload Upload Total Spent Left Speed286 0 0 0 0 0 0 0 0 0* using HTTP/2287* [HTTP/2] [1] OPENED stream for https://test.foo/288* [HTTP/2] [1] [:method: GET]289* [HTTP/2] [1] [:scheme: https]290* [HTTP/2] [1] [:authority: test.foo]291* [HTTP/2] [1] [:path: /]292* [HTTP/2] [1] [user-agent: curl/8.22.0]293* [HTTP/2] [1] [accept: */*]294} [5 bytes data]295296297298299300* Request completely sent off301{ [5 bytes data]302* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):303{ [265 bytes data]304* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):305{ [265 bytes data]306307308309310311312313{ [5 bytes data]314100 20 100 20 0 0 712 0 0315* Connection #0 to host test.foo:443 left intact316(finished: waiting for success: curl -v https://test.foo, in 3.19 seconds)317+ openssl s_client -connect test.foo:443 -servername test.foo318+ openssl x509 -text -noout319Certificate:320 Data:321 Version: 3 (0x2)322 Serial Number:323 af:e3:c8:94:b1:9e:f1:85:24:a5:06:07:ce:a2:3e:38324 Signature Algorithm: ecdsa-with-SHA256325 Issuer: CN=Clan Intermediate CA326 Validity327 Not Before: Sep 24 18:31:16 2026 GMT328 Not After : Dec 23 18:32:16 2026 GMT329 Subject: CN=test.foo330 Subject Public Key Info:331 Public Key Algorithm: id-ecPublicKey332 Public-Key: (256 bit)333 pub:334 04:2a:78:d8:46:89:7a:12:1a:d5:4e:07:cc:38:5e:335 94:20:b3:18:2d:81:d5:f7:98:5a:2f:0f:8b:8c:a1:336 05:3e:24:ca:65:f2:3f:04:4e:5b:bf:66:4a:48:56:337 2c:dd:ad:4f:a3:44:f5:3c:6c:bc:25:6c:fc:19:b5:338 57:c1:07:fd:e7339 ASN1 OID: prime256v1340 NIST CURVE: P-256341 X509v3 extensions:342 X509v3 Key Usage: critical343 Digital Signature344 X509v3 Extended Key Usage: 345 TLS Web Server Authentication, TLS Web Client Authentication346 X509v3 Subject Key Identifier: 347 D7:59:86:64:20:CB:94:94:86:DA:D2:7C:BD:49:58:67:B3:79:8B:DC348 X509v3 Authority Key Identifier: 349 12:7B:BB:87:0A:DE:A2:A4:61:95:C5:6B:DF:BC:AA:93:FE:C3:16:9F350 X509v3 Subject Alternative Name: 351 DNS:test.foo352 1.3.6.1.4.1.37476.9000.64.1: 353 0......acme..354 Signature Algorithm: ecdsa-with-SHA256355 Signature Value:356 30:45:02:20:58:04:d5:32:8f:39:2a:40:58:83:ad:31:7d:f9:357 f0:62:79:b2:7e:c8:5b:d7:91:d1:24:87:4c:96:25:83:7f:8f:358 02:21:00:a1:e5:26:e5:84:8f:a3:4a:b1:94:98:2d:39:d4:23:359 21:7c:43:32:e2:af:31:5c:c5:cf:23:3d:a3:b1:d8:2c:ea360361362