don't know how to build these paths: /nix/store/12ql45hb5lxkrzlibq0xkfr6lrhrcwfs-container-test-run-certificates.drv warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/7f26vfmmj2jhsx6585mxsw6s118cc2js-system-path.drv' on nix-store.geninf.io:50051 system-path> build-x86-01: building 7f26vfmmj2jhsx6585mxsw6s118cc2js-system-path.drv system-path> structuredAttrs is enabled system-path> created 1817 symlinks in user environment building '/nix/store/h1sz5vzm5al733bqzvblx1s3h5sv45xy-system-path.drv' on nix-store.geninf.io:50051 system-path> build-x86-01: building h1sz5vzm5al733bqzvblx1s3h5sv45xy-system-path.drv system-path> structuredAttrs is enabled system-path> created 1817 symlinks in user environment building '/nix/store/92cif7w2yjf3mcrffm4jz4j5napvw4ar-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build-x86-01: building 92cif7w2yjf3mcrffm4jz4j5napvw4ar-dbus-1.drv building '/nix/store/5gr0rfffnm7fd6saajim3w64axdjhfrj-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build-x86-01: building 5gr0rfffnm7fd6saajim3w64axdjhfrj-dbus-1.drv building '/nix/store/qcbv330qz5xbkhv99iqjvd16jwhvndg5-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build-x86-01: building qcbv330qz5xbkhv99iqjvd16jwhvndg5-X-Restart-Triggers-dbus-broker.drv building '/nix/store/nkc3i31ng55idyyix4bxprbjc1k0f5nn-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build-x86-01: building nkc3i31ng55idyyix4bxprbjc1k0f5nn-X-Restart-Triggers-dbus-broker.drv building '/nix/store/90m8rz1327mgal0ygi41s6wr467r3n7p-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building 90m8rz1327mgal0ygi41s6wr467r3n7p-unit-dbus-broker.service.drv building '/nix/store/4xwwzn35cdqm7p3c0q3r6qynfc6m9xa0-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building 4xwwzn35cdqm7p3c0q3r6qynfc6m9xa0-unit-dbus-broker.service.drv building '/nix/store/adm86hmry1mz503n19g4pyclwhp33qlf-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building adm86hmry1mz503n19g4pyclwhp33qlf-unit-dbus-broker.service.drv building '/nix/store/agl3ajb3v08ca7krg3882vwqvx6gsvwz-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building agl3ajb3v08ca7krg3882vwqvx6gsvwz-unit-dbus-broker.service.drv building '/nix/store/ih9ynhi809f3lkcbgw0i0y1arlqqac7h-user-units.drv' on nix-store.geninf.io:50051 user-units> build-x86-01: building ih9ynhi809f3lkcbgw0i0y1arlqqac7h-user-units.drv building '/nix/store/rd1sbi2c5hbai1jz3d51yyc81wvykapb-system-path.drv' on nix-store.geninf.io:50051 system-path> gi-build-x86-02: building rd1sbi2c5hbai1jz3d51yyc81wvykapb-system-path.drv system-path> structuredAttrs is enabled system-path> created 1817 symlinks in user environment building '/nix/store/wr9g8rw5dm46rv9vbnhak7qxag8z3lmc-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building wr9g8rw5dm46rv9vbnhak7qxag8z3lmc-system-units.drv building '/nix/store/z0w26ml5pcaky1fwsnsnny7xhwy9071g-user-units.drv' on nix-store.geninf.io:50051 user-units> build-x86-01: building z0w26ml5pcaky1fwsnsnny7xhwy9071g-user-units.drv building '/nix/store/z1al3461v3slnzpkyzrnzj6i79pq8n8i-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building z1al3461v3slnzpkyzrnzj6i79pq8n8i-etc.drv building '/nix/store/mdncvvm6xrn7wl93ny0rbwzhm2jgr0mi-system-units.drv' on nix-store.geninf.io:50051 system-units> gi-build-x86-02: building mdncvvm6xrn7wl93ny0rbwzhm2jgr0mi-system-units.drv building '/nix/store/vk3nk7jaikvwjj804fyk4gjlsrmk6nc7-activate.drv' on nix-store.geninf.io:50051 activate> build-x86-01: building vk3nk7jaikvwjj804fyk4gjlsrmk6nc7-activate.drv building '/nix/store/4cypqw8f8ks7kkhr1d33jda8waqfd2ar-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> build-x86-01: building 4cypqw8f8ks7kkhr1d33jda8waqfd2ar-nixos-system-server-test.drv nixos-system-server-test> structuredAttrs is enabled building '/nix/store/pg8nhqsga11pzipxxdsdrrrs82l60623-closure-info.drv' on nix-store.geninf.io:50051 closure-info> build-x86-01: building pg8nhqsga11pzipxxdsdrrrs82l60623-closure-info.drv closure-info> structuredAttrs is enabled building '/nix/store/av5zbaz5x02f9859klxf7mzqlfvj3ysw-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> gi-build-x86-02: building av5zbaz5x02f9859klxf7mzqlfvj3ysw-dbus-1.drv building '/nix/store/hh93n3gkg6l3y7h6biw7v2ni10c9cill-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-02: building hh93n3gkg6l3y7h6biw7v2ni10c9cill-etc.drv building '/nix/store/hszyh6xj6hym56b0fjbsnijnp3hh166r-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> gi-build-x86-02: building hszyh6xj6hym56b0fjbsnijnp3hh166r-X-Restart-Triggers-dbus-broker.drv building '/nix/store/6qdkbk6v2kppj0f7d9dka785gkdh0b45-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building 6qdkbk6v2kppj0f7d9dka785gkdh0b45-activate.drv building '/nix/store/dkc058m6k1djvrf3x03kwlslbh6wm1bf-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building dkc058m6k1djvrf3x03kwlslbh6wm1bf-unit-dbus-broker.service.drv building '/nix/store/bfs5rmvx0c16cpiklq8vn44ml0lkx56b-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> gi-build-x86-02: building bfs5rmvx0c16cpiklq8vn44ml0lkx56b-unit-dbus-broker.service.drv building '/nix/store/bwln3h5mdrk15xi1yxaiym721h18lqzj-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building bwln3h5mdrk15xi1yxaiym721h18lqzj-system-units.drv building '/nix/store/qgf5qnjbjy3hvcjfqdly89z23hf103q2-nixos-system-client-test.drv' on nix-store.geninf.io:50051 nixos-system-client-test> gi-build-x86-02: building qgf5qnjbjy3hvcjfqdly89z23hf103q2-nixos-system-client-test.drv nixos-system-client-test> structuredAttrs is enabled building '/nix/store/2s030pi86r37df8rp7ky2xabwz0d80zk-user-units.drv' on nix-store.geninf.io:50051 user-units> gi-build-x86-02: building 2s030pi86r37df8rp7ky2xabwz0d80zk-user-units.drv building '/nix/store/f1r3c1wvcjszafwhxxsf3gpbky99461m-closure-info.drv' on nix-store.geninf.io:50051 closure-info> gi-build-x86-02: building f1r3c1wvcjszafwhxxsf3gpbky99461m-closure-info.drv closure-info> structuredAttrs is enabled building '/nix/store/2ixcnb8gshh8mfj45wypfkv8imhlhlw3-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-02: building 2ixcnb8gshh8mfj45wypfkv8imhlhlw3-etc.drv building '/nix/store/lykbyy6a8wkvrbv9i4zgi54fgq48b8lf-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building lykbyy6a8wkvrbv9i4zgi54fgq48b8lf-activate.drv building '/nix/store/mxa66rs8wcazvnmq8m7hjm6022bzdq84-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> build-x86-01: building mxa66rs8wcazvnmq8m7hjm6022bzdq84-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/whr67lc8piaizifamyd5zwc8a0arpwvj-closure-info.drv' on nix-store.geninf.io:50051 closure-info> build-x86-01: building whr67lc8piaizifamyd5zwc8a0arpwvj-closure-info.drv closure-info> structuredAttrs is enabled building '/nix/store/8n6wzncdyv85jk06w4pxzfd6qavsvsrg-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> build-x86-01: building 8n6wzncdyv85jk06w4pxzfd6qavsvsrg-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> Success: no issues found in 1 source file building '/nix/store/12ql45hb5lxkrzlibq0xkfr6lrhrcwfs-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build-x86-01: building 12ql45hb5lxkrzlibq0xkfr6lrhrcwfs-container-test-run-certificates.drv container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> start_all, machines, driver, Machine, wait_for_signal container-test-run-certificates> Starting ca container-test-run-certificates> Starting client container-test-run-certificates> Starting server container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> <<< NixOS Stage 2 >>> container-test-run-certificates> container-test-run-certificates> booting system configuration /nix/store/w1jcfmxkwg0a2b07al18j1zyyqc8fzy3-nixos-system-ca-test container-test-run-certificates> running activation script... container-test-run-certificates> setting up /etc... container-test-run-certificates> 2: host0@if3: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 container-test-run-certificates> link/ether 42:06:76:42:a9:8d brd ff:ff:ff:ff:ff:ff link-netnsid 0 container-test-run-certificates> setting up age secrets... container-test-run-certificates> starting systemd... container-test-run-certificates> systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE) container-test-run-certificates> Detected virtualization systemd-nspawn. container-test-run-certificates> Detected architecture x86-64. container-test-run-certificates> Detected first boot. container-test-run-certificates> Initializing machine ID from container UUID. container-test-run-certificates> Applying preset policy. container-test-run-certificates> Populated /etc with preset unit settings. container-test-run-certificates> Queued start job for default target Multi-User System. container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> <<< Welcome to NixOS test (x86_64) - console >>> container-test-run-certificates> + systemd-run /bin/sh -c '/nix/store/833invqvsk7anqnqrki5hqncrcllj825-coreutils-9.11/bin/sleep 999999999 && echo fd2b2942-0fc6-4310-93fd-f59a8929af3d' container-test-run-certificates> Running as unit: run-p446-i19294610.service; invocation ID: 1f44ff36e5ad4eb9909a02277841f1af container-test-run-certificates> To attach to container ca run on the same machine that runs the test: container-test-run-certificates> sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*fd2b2942-0fc6-4310-93fd-f59a8929af3d') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash container-test-run-certificates> container-test-run-certificates> To inject external network and continue test, run: container-test-run-certificates> sudo /nix/store/9r02ykx9y35lf4gk6gc30gnag1y8ncp7-python3-3.13.15/bin/python3.13 /nix/store/7pcwg3l52sff9p90k03qhavpaqk1zhfi-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py fd2b2942-0fc6-4310-93fd-f59a8929af3d container-test-run-certificates> container-test-run-certificates> <<< NixOS Stage 2 >>> container-test-run-certificates> container-test-run-certificates> booting system configuration /nix/store/cznszcc8y52c3r8gjymwcz2lhllgr3da-nixos-system-client-test container-test-run-certificates> running activation script... container-test-run-certificates> setting up /etc... container-test-run-certificates> 2: host0@if4: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 container-test-run-certificates> link/ether 2a:42:35:28:b1:2f brd ff:ff:ff:ff:ff:ff link-netnsid 0 container-test-run-certificates> setting up age secrets... container-test-run-certificates> starting systemd... container-test-run-certificates> systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE) container-test-run-certificates> Detected virtualization systemd-nspawn. container-test-run-certificates> Detected architecture x86-64. container-test-run-certificates> Detected first boot. container-test-run-certificates> Initializing machine ID from container UUID. container-test-run-certificates> Applying preset policy. container-test-run-certificates> Populated /etc with preset unit settings. container-test-run-certificates> Queued start job for default target Multi-User System. container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> <<< Welcome to NixOS test (x86_64) - console >>> container-test-run-certificates> + systemd-run /bin/sh -c '/nix/store/833invqvsk7anqnqrki5hqncrcllj825-coreutils-9.11/bin/sleep 999999999 && echo a4a6b730-fe13-40ad-b9e1-88597d3d9c99' container-test-run-certificates> Running as unit: run-p304-i19294613.service; invocation ID: 67188a5a95ba405baa7396dc0e573480 container-test-run-certificates> To attach to container client run on the same machine that runs the test: container-test-run-certificates> sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*a4a6b730-fe13-40ad-b9e1-88597d3d9c99') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash container-test-run-certificates> container-test-run-certificates> To inject external network and continue test, run: container-test-run-certificates> sudo /nix/store/9r02ykx9y35lf4gk6gc30gnag1y8ncp7-python3-3.13.15/bin/python3.13 /nix/store/7pcwg3l52sff9p90k03qhavpaqk1zhfi-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py a4a6b730-fe13-40ad-b9e1-88597d3d9c99 container-test-run-certificates> container-test-run-certificates> <<< NixOS Stage 2 >>> container-test-run-certificates> container-test-run-certificates> booting system configuration /nix/store/ad1vva952nz53a4xirclyy2aiymp6lfp-nixos-system-server-test container-test-run-certificates> running activation script... container-test-run-certificates> setting up /etc... container-test-run-certificates> 2: host0@if5: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 container-test-run-certificates> link/ether be:aa:dd:39:86:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 0 container-test-run-certificates> setting up age secrets... container-test-run-certificates> starting systemd... container-test-run-certificates> systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE) container-test-run-certificates> Detected virtualization systemd-nspawn. container-test-run-certificates> Detected architecture x86-64. container-test-run-certificates> Detected first boot. container-test-run-certificates> Initializing machine ID from container UUID. container-test-run-certificates> Applying preset policy. container-test-run-certificates> Populated /etc with preset unit settings. container-test-run-certificates> Queued start job for default target Multi-User System. container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> <<< Welcome to NixOS test (x86_64) - console >>> container-test-run-certificates> + systemd-run /bin/sh -c '/nix/store/833invqvsk7anqnqrki5hqncrcllj825-coreutils-9.11/bin/sleep 999999999 && echo 7ba7a92e-593d-4db4-8252-8ebac3661ccb' container-test-run-certificates> Running as unit: run-p385-i19294616.service; invocation ID: b7dc8c815fa94558ae5478b7a07432f5 container-test-run-certificates> To attach to container server run on the same machine that runs the test: container-test-run-certificates> sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*7ba7a92e-593d-4db4-8252-8ebac3661ccb') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash container-test-run-certificates> container-test-run-certificates> To inject external network and continue test, run: container-test-run-certificates> sudo /nix/store/9r02ykx9y35lf4gk6gc30gnag1y8ncp7-python3-3.13.15/bin/python3.13 /nix/store/7pcwg3l52sff9p90k03qhavpaqk1zhfi-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 7ba7a92e-593d-4db4-8252-8ebac3661ccb container-test-run-certificates> + systemctl restart acme-order-renew-ca.foo.service container-test-run-certificates> + systemctl restart acme-test.foo.service container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> + curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: (none) container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [110 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 28 05:06:47 2026 GMT container-test-run-certificates> * expire date: Oct 28 05:06:47 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7bc846 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> + curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: (none) container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [1009 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [110 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 28 05:06:47 2026 GMT container-test-run-certificates> * expire date: Oct 28 05:06:47 2028 GMT container-test-run-certificates> * issuer: CN=minica root ca 7bc846 container-test-run-certificates> * Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 13 container-test-run-certificates> * SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19) container-test-run-certificates> More details here: https://curl.se/docs/sslcerts.html container-test-run-certificates> container-test-run-certificates> curl failed to verify the legitimacy of the server and therefore could not container-test-run-certificates> establish a secure connection to it. To learn more about this situation and container-test-run-certificates> how to fix it, please visit the webpage mentioned above. container-test-run-certificates> + curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: (none) container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [931 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [80 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 28 05:05:58 2026 GMT container-test-run-certificates> * expire date: Dec 27 05:06:58 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (192.168.1.3 port 443) from 192.168.1.2 port 57974 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1892 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> (finished: waiting for success: curl -v https://test.foo, in 2.06 seconds) container-test-run-certificates> + openssl s_client -connect test.foo:443 -servername test.foo container-test-run-certificates> + openssl x509 -text -noout container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> a1:1f:7d:d4:05:a2:e4:4b:4f:7d:07:16:5b:eb:91:e2 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Sep 28 05:05:58 2026 GMT container-test-run-certificates> Not After : Dec 27 05:06:58 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:f4:07:dc:88:9f:a1:41:9c:ed:bc:06:81:0c:d6: container-test-run-certificates> 19:2c:e3:ef:bf:d0:96:d2:9b:ba:d1:75:a9:94:90: container-test-run-certificates> 0f:b9:fa:d6:3a:86:2d:0a:2f:c7:36:02:a2:53:48: container-test-run-certificates> 0c:ca:f1:b1:59:e8:5f:ff:76:06:58:ca:df:47:95: container-test-run-certificates> 21:ee:c7:85:16 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> B7:56:C7:6E:E8:E7:27:BB:0E:A7:F4:CC:9F:08:72:D7:30:5B:9B:2C container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 12:7B:BB:87:0A:DE:A2:A4:61:95:C5:6B:DF:BC:AA:93:FE:C3:16:9F container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:45:02:20:6a:ac:62:02:2b:49:06:de:2d:d2:f7:07:83:29: container-test-run-certificates> ee:98:d3:12:80:a9:0c:72:08:a7:8e:b9:85:13:3f:4d:a4:12: container-test-run-certificates> 02:21:00:9c:e2:2e:97:85:34:da:e7:92:0c:c5:b5:b2:b7:77: container-test-run-certificates> 95:c8:24:c4:b0:8e:2e:91:bc:95:54:7c:38:89:21:d5:0d container-test-run-certificates> container-test-run-certificates> container-test-run-certificates>