don't know how to build these paths:
  /nix/store/xyjzmzxkhlzmys2z4hpc0l3cb5z0lyaf-container-test-run-certificates.drv
warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user
building '/nix/store/gpz67jb5vb7zabl1a2xd7b4af8dgg4ac-system-path.drv' on nix-store.geninf.io:50051
system-path> build-x86-01: building gpz67jb5vb7zabl1a2xd7b4af8dgg4ac-system-path.drv
system-path> structuredAttrs is enabled
system-path> created 1723 symlinks in user environment
building '/nix/store/mvacqjj9jv1lvqb4aaw9qaqafp18vv4n-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> build-x86-01: building mvacqjj9jv1lvqb4aaw9qaqafp18vv4n-dbus-1.drv
building '/nix/store/1m3yiap6rz15p89752i3aingf8v1yrsz-system-path.drv' on nix-store.geninf.io:50051
system-path> gi-build-x86-02: building 1m3yiap6rz15p89752i3aingf8v1yrsz-system-path.drv
building '/nix/store/kyfbh3dw4g68qmldhfbx0jwkl89r82ps-system-path.drv' on nix-store.geninf.io:50051
system-path> gi-build-x86-02: building kyfbh3dw4g68qmldhfbx0jwkl89r82ps-system-path.drv
system-path> structuredAttrs is enabled
system-path> created 1723 symlinks in user environment
system-path> structuredAttrs is enabled
system-path> created 1723 symlinks in user environment
building '/nix/store/7dp55s6q6pal073f0n13blb85ps70qbb-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> build-x86-01: building 7dp55s6q6pal073f0n13blb85ps70qbb-X-Restart-Triggers-dbus-broker.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
building '/nix/store/6b1mnc9qd7adkkhnpynyaqfhqiwgvqr0-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building 6b1mnc9qd7adkkhnpynyaqfhqiwgvqr0-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/k9xy0k50dmd0q58bvbbsymjwqlf4vhca-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building k9xy0k50dmd0q58bvbbsymjwqlf4vhca-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/kd6a9sp9l3mwlgw2vrwnjghjbihg8kzy-system-units.drv' on nix-store.geninf.io:50051
system-units> build-x86-01: building kd6a9sp9l3mwlgw2vrwnjghjbihg8kzy-system-units.drv
building '/nix/store/cggjhl5adpwzakxvwhyl2q44h3paflpa-user-units.drv' on nix-store.geninf.io:50051
user-units> build-x86-01: building cggjhl5adpwzakxvwhyl2q44h3paflpa-user-units.drv
building '/nix/store/w2j4xyl4fm5r8jjlmmnkcr2m2gcrkak8-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> gi-build-x86-02: building w2j4xyl4fm5r8jjlmmnkcr2m2gcrkak8-dbus-1.drv
building '/nix/store/k1sbk29gl7wmr697fkvnl98dac9kha9w-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> gi-build-x86-02: building k1sbk29gl7wmr697fkvnl98dac9kha9w-dbus-1.drv
building '/nix/store/7h5a1ma15kxvhav9wn1m0a7qhp44ckm7-etc.drv' on nix-store.geninf.io:50051
etc> build-x86-01: building 7h5a1ma15kxvhav9wn1m0a7qhp44ckm7-etc.drv
building '/nix/store/dh832110zilyhbpi6mrc1iip9wr7hg4j-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> build-x86-01: building dh832110zilyhbpi6mrc1iip9wr7hg4j-X-Restart-Triggers-dbus-broker.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
building '/nix/store/jagnay043252mmqpxijhibn1nl94c1rc-activate.drv' on nix-store.geninf.io:50051
activate> build-x86-01: building jagnay043252mmqpxijhibn1nl94c1rc-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/szrs83pcz4jk2xrvff3483z647hmzxbx-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building szrs83pcz4jk2xrvff3483z647hmzxbx-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/k088gbln3arkd9jymrk95z68ff0mw0hr-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building k088gbln3arkd9jymrk95z68ff0mw0hr-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/iaiynxaidpdcrqdca2c9rfjw8j9pb79n-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> gi-build-x86-02: building iaiynxaidpdcrqdca2c9rfjw8j9pb79n-X-Restart-Triggers-dbus-broker.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
building '/nix/store/s99xvdrbwhrsmgwkpzkkjica13p1mnjc-nixos-system-client-test.drv' on nix-store.geninf.io:50051
nixos-system-client-test> build-x86-01: building s99xvdrbwhrsmgwkpzkkjica13p1mnjc-nixos-system-client-test.drv
nixos-system-client-test> structuredAttrs is enabled
building '/nix/store/fr0x2bi25dbfx21v40y12nf4bnydv7l2-system-units.drv' on nix-store.geninf.io:50051
system-units> build-x86-01: building fr0x2bi25dbfx21v40y12nf4bnydv7l2-system-units.drv
building '/nix/store/q1g8n415zqixhbxkx8zbqgw5yramyiap-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> web01: building q1g8n415zqixhbxkx8zbqgw5yramyiap-unit-dbus-broker.service.drv
building '/nix/store/cjqd4kpgkdqlchdgvsq681fg4593xa16-user-units.drv' on nix-store.geninf.io:50051
user-units> build-x86-01: building cjqd4kpgkdqlchdgvsq681fg4593xa16-user-units.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/b26mc39rfd7i2nmzd9vcpsv5myzjj68f-system-units.drv' on nix-store.geninf.io:50051
system-units> web01: building b26mc39rfd7i2nmzd9vcpsv5myzjj68f-system-units.drv
building '/nix/store/28sj2vbbr7370wvwp99qkgmkrw24pvgp-run-client-nspawn.drv' on nix-store.geninf.io:50051
run-client-nspawn> build-x86-01: building 28sj2vbbr7370wvwp99qkgmkrw24pvgp-run-client-nspawn.drv
building '/nix/store/dc32rd8qfjyjq7riryznzcbv38xajl64-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> gi-build-x86-02: building dc32rd8qfjyjq7riryznzcbv38xajl64-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/r7a7p6ix2z0w74z9r05pwdicdhzc9y7q-etc.drv' on nix-store.geninf.io:50051
etc> build-x86-01: building r7a7p6ix2z0w74z9r05pwdicdhzc9y7q-etc.drv
building '/nix/store/jms04ddb9l7bs5mr91ka26329zcaf83b-activate.drv' on nix-store.geninf.io:50051
activate> build-x86-01: building jms04ddb9l7bs5mr91ka26329zcaf83b-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/69s8hjhw0jpcf7yam37sv9h48p0r9f8x-user-units.drv' on nix-store.geninf.io:50051
user-units> gi-build-x86-02: building 69s8hjhw0jpcf7yam37sv9h48p0r9f8x-user-units.drv
building '/nix/store/r62zcyvjsvkva0bhj1g1dkygjn4xls2p-nixos-system-ca-test.drv' on nix-store.geninf.io:50051
nixos-system-ca-test> build-x86-01: building r62zcyvjsvkva0bhj1g1dkygjn4xls2p-nixos-system-ca-test.drv
nixos-system-ca-test> structuredAttrs is enabled
building '/nix/store/ldbfiqfdhmfnbd5idlwza7nxjjj01hi8-etc.drv' on nix-store.geninf.io:50051
etc> gi-build-x86-02: building ldbfiqfdhmfnbd5idlwza7nxjjj01hi8-etc.drv
building '/nix/store/27n7sr691vms274n7jr7dny7wrg88dfp-run-ca-nspawn.drv' on nix-store.geninf.io:50051
run-ca-nspawn> build-x86-01: building 27n7sr691vms274n7jr7dny7wrg88dfp-run-ca-nspawn.drv
building '/nix/store/y6wjzl156630f0fz7p7a5x9prj1yx958-activate.drv' on nix-store.geninf.io:50051
activate> gi-build-x86-02: building y6wjzl156630f0fz7p7a5x9prj1yx958-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/2wljzfyf2d6gq4dq4fdj1g1b7g19mxym-nixos-system-server-test.drv' on nix-store.geninf.io:50051
nixos-system-server-test> web01: building 2wljzfyf2d6gq4dq4fdj1g1b7g19mxym-nixos-system-server-test.drv
nixos-system-server-test> structuredAttrs is enabled
building '/nix/store/ixiyn80al3la6wa1b3mwxw4mx33kjqkj-run-server-nspawn.drv' on nix-store.geninf.io:50051
run-server-nspawn> web01: building ixiyn80al3la6wa1b3mwxw4mx33kjqkj-run-server-nspawn.drv
building '/nix/store/95xmcaciawsnxgm9f7b856pp1r5rchvd-driverConfiguration.json.drv' on nix-store.geninf.io:50051
driverConfiguration.json> build-x86-01: building 95xmcaciawsnxgm9f7b856pp1r5rchvd-driverConfiguration.json.drv
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/i499c3q0ggdrnh76k4mw4hqh76s050n4-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051
nixos-test-driver-certificates> build-x86-01: building i499c3q0ggdrnh76k4mw4hqh76s050n4-nixos-test-driver-certificates.drv
nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-certificates> All checks passed!
nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-certificates> All checks passed!
building '/nix/store/xyjzmzxkhlzmys2z4hpc0l3cb5z0lyaf-container-test-run-certificates.drv' on nix-store.geninf.io:50051
container-test-run-certificates> build-x86-01: building xyjzmzxkhlzmys2z4hpc0l3cb5z0lyaf-container-test-run-certificates.drv
container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-certificates> start all VLans
container-test-run-certificates> (finished: start all VLans, in 0.00 seconds)
container-test-run-certificates> 
container-test-run-certificates> Test will time out and terminate in 3600.0 seconds
container-test-run-certificates> run the VM test script
container-test-run-certificates> additionally exposed symbols:
container-test-run-certificates>     ca, client, server,
container-test-run-certificates>     vlan1,
container-test-run-certificates>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-certificates> ca: systemd-nspawn running (pid 50)
container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal...
container-test-run-certificates> ca: waiting for unit step-ca.service
container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca.
container-test-run-certificates> ca # [2170092.080471] ca systemd-journald[81]: Journal started
container-test-run-certificates> ca # [2170092.080498] ca systemd-journald[81]: Runtime Journal (/run/log/journal/d1df4d09783346e0a8f96fa92c9b6c2e) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> ca # [2170092.086922] ca systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> ca # [2170092.093975] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> ca # [2170092.102320] ca systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> ca # [2170092.102845] ca systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> ca # [2170092.103273] ca systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> ca # [2170092.107154] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/d1df4d09783346e0a8f96fa92c9b6c2e is 880us for 7 entries.
container-test-run-certificates> ca # [2170092.107154] ca systemd-journald[81]: System Journal (/var/log/journal/d1df4d09783346e0a8f96fa92c9b6c2e) is 8M, max 4G, 3.9G free.
container-test-run-certificates> ca # [2170092.116093] ca systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> ca # [2170092.116276] ca systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> ca # [2170092.116886] ca systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> ca # [2170092.116932] ca systemd[1]: Reached target Local File Systems.
container-test-run-certificates> ca # [2170092.117342] ca systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> ca # [2170092.117369] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [2170092.117699] ca systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> ca # [2170092.118029] ca systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> ca # [2170092.118042] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> ca # [2170092.138678] ca systemd-tmpfiles[141]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> ca # [2170092.138873] ca systemd-tmpfiles[141]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [2170092.138997] ca systemd-tmpfiles[141]: fchmod() of /var/log/journal/d1df4d09783346e0a8f96fa92c9b6c2e failed: Operation not permitted
container-test-run-certificates> ca # [2170092.139174] ca systemd-tmpfiles[141]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [2170092.140158] ca systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> ca # [2170092.140812] ca systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> ca # [2170092.141137] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [2170092.147889] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> ca # [2170092.153917] ca systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> ca # [2170092.154465] ca systemd[1]: Starting Update is Completed...
container-test-run-certificates> ca # [2170092.159403] ca systemd[1]: Finished Update is Completed.
container-test-run-certificates> ca # [2170092.164621] ca systemd[1]: Finished Firewall.
container-test-run-certificates> ca # [2170092.164701] ca systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> ca # [2170092.164821] ca systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> ca # [2170092.165250] ca systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [2170092.632885] ca systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> ca # [2170092.646592] ca systemd-networkd[198]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [2170092.646664] ca systemd-networkd[198]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [2170092.653616] ca systemd-networkd[198]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [2170092.653754] ca systemd-networkd[198]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [2170092.653828] ca systemd-networkd[198]: lo: Link UP
container-test-run-certificates> ca # [2170092.653831] ca systemd-networkd[198]: lo: Gained carrier
container-test-run-certificates> ca # [2170092.653960] ca systemd-networkd[198]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> ca # [2170092.654215] ca systemd[1]: Started Network Management.
container-test-run-certificates> ca # [2170092.654273] ca systemd-networkd[198]: eth1: Link UP
container-test-run-certificates> ca # [2170092.654424] ca systemd-networkd[198]: eth1: Gained carrier
container-test-run-certificates> ca # [2170092.655019] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> ca # [2170092.680861] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> ca # [2170093.009800] ca systemd-resolved[119]: Positive Trust Anchors:
container-test-run-certificates> ca # [2170093.009808] ca systemd-resolved[119]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> ca # [2170093.009811] ca systemd-resolved[119]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> ca # [2170093.009827] ca systemd-resolved[119]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> ca # [2170093.020420] ca systemd-resolved[119]: Using system hostname 'ca'.
container-test-run-certificates> ca # [2170093.021349] ca systemd[1]: Started Network Name Resolution.
container-test-run-certificates> ca # [2170093.021406] ca systemd[1]: Reached target Network.
container-test-run-certificates> ca # [2170093.021437] ca systemd[1]: Reached target Network is Online.
container-test-run-certificates> ca # [2170093.021462] ca systemd[1]: Reached target System Initialization.
container-test-run-certificates> ca # [2170093.021607] ca systemd[1]: Started Renew ACME Certificate for ca.foo.
container-test-run-certificates> ca # [2170093.021627] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [2170093.021641] ca systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> ca # [2170093.021651] ca systemd[1]: Reached target Timer Units.
container-test-run-certificates> ca # [2170093.021723] ca systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> ca # [2170093.021782] ca systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> ca # [2170093.021851] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> ca # [2170093.021860] ca systemd[1]: Reached target Socket Units.
container-test-run-certificates> ca # [2170093.021879] ca systemd[1]: Reached target Basic System.
container-test-run-certificates> ca # [2170093.022621] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> ca # [2170093.022940] ca systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> ca # [2170093.022957] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem
container-test-run-certificates> ca # [2170093.023320] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> ca # [2170093.023714] ca systemd[1]: Starting step-ca service...
container-test-run-certificates> ca # [2170093.024341] ca systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> ca # [2170093.053822] ca systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> ca # [2170093.079887] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> ca # [2170093.137534] ca acme-setup-privileged[204]: + set -euo pipefail
container-test-run-certificates> ca # [2170093.137534] ca acme-setup-privileged[204]: + cd /var/lib/acme
container-test-run-certificates> ca # [2170093.137730] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> ca # [2170093.138655] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts
container-test-run-certificates> ca # [2170093.139668] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [2170093.139679] ca acme-setup-privileged[204]: + '[' -d ca.foo ']'
container-test-run-certificates> ca # [2170093.139694] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [2170093.139694] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']'
container-test-run-certificates> ca # [2170093.160904] ca nsncd[206]: Sep 29 10:05:07.584 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> ca # [2170093.160946] ca systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> ca # [2170093.160990] ca systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> ca # [2170093.161033] ca systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> ca # [2170093.165791] ca systemd[1]: Starting User Login Management...
container-test-run-certificates> ca # [2170093.166128] ca systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> ca # [2170093.172216] ca systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> ca # [2170093.172655] ca systemd[1]: Started Console Getty.
container-test-run-certificates> ca # [2170093.172671] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> ca # [2170093.172683] ca systemd[1]: Reached target Login Prompts.
container-test-run-certificates> ca # [2170093.267248] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> ca # [2170093.267614] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> ca # [2170093.267614] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/33qqp6xfxw4ddibfi8nvkihlq8x99769-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> ca # [2170093.267869] ca systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> ca # [2170093.271236] ca dbus-broker-launch[208]: Ready
container-test-run-certificates> ca # [2170093.731095] ca systemd-logind[234]: New seat seat0.
container-test-run-certificates> ca # [2170093.731200] ca systemd[1]: Started User Login Management.
container-test-run-certificates> ca # [2170093.731813] ca systemd[1]: Starting linger-users.service...
container-test-run-certificates> ca # [2170093.756245] ca systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> ca # [2170093.756369] ca systemd[1]: Finished linger-users.service.
container-test-run-certificates> ca # [2170093.791843] ca acme-setup-start[221]: + set -euo pipefail
container-test-run-certificates> ca # [2170093.791843] ca acme-setup-start[221]: + test -e ca/key.pem
container-test-run-certificates> ca # [2170093.791843] ca acme-setup-start[221]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> ca # [2170093.798660] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> ca # [2170093.799803] ca systemd[1]: Starting Ensure certificate for ca.foo...
container-test-run-certificates> ca # [2170093.975366] ca step-ca[207]: badger 2026/09/29 10:05:08 INFO: All 0 tables opened in 0s
container-test-run-certificates> ca # [2170093.977290] ca step-ca[207]: 2026/09/29 10:05:08 Building new tls configuration using step-ca x509 Signer Interface
container-test-run-certificates> ca # [2170093.979556] ca step-ca[207]: 2026/09/29 10:05:08 Starting Smallstep CA/0.30.2 (linux/amd64)
container-test-run-certificates> ca # [2170093.979556] ca step-ca[207]: 2026/09/29 10:05:08 Documentation: https://u.step.sm/docs/ca
container-test-run-certificates> ca # [2170093.979556] ca step-ca[207]: 2026/09/29 10:05:08 Community Discord: https://u.step.sm/discord
container-test-run-certificates> ca # [2170093.979556] ca step-ca[207]: 2026/09/29 10:05:08 Config file: /etc/smallstep/ca.json
container-test-run-certificates> ca # [2170093.979556] ca step-ca[207]: 2026/09/29 10:05:08 The primary server URL is https://ca.foo:1443
container-test-run-certificates> ca # [2170093.979619] ca step-ca[207]: 2026/09/29 10:05:08 Root certificates are available at https://ca.foo:1443/roots.pem
container-test-run-certificates> ca # [2170093.979619] ca step-ca[207]: 2026/09/29 10:05:08 X.509 Root Fingerprint: 3b6fe722aa62d6797f6d3f30029cf00df6170c2bff17f9e9ee6d98f103f67693
container-test-run-certificates> ca # [2170093.979650] ca systemd[1]: Started step-ca service.
container-test-run-certificates> ca # [2170093.979729] ca step-ca[207]: 2026/09/29 10:05:08 Serving HTTPS on 0.0.0.0:1443 ...
container-test-run-certificates> ca # [2170094.208072] ca systemd-networkd[198]: eth1: Gained IPv6LL
container-test-run-certificates> ca # [2170094.433963] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [2170094.435570] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']'
container-test-run-certificates> ca # [2170094.435620] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=
container-test-run-certificates> ca # [2170094.439944] ca acme-ca.foo-start[284]: + cd ca.foo
container-test-run-certificates> ca # [2170094.440112] ca acme-ca.foo-start[284]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> ca # [2170094.440750] ca acme-ca.foo-start[285]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> ca # [2170094.440900] ca acme-ca.foo-start[284]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> ca # [2170094.441941] ca acme-ca.foo-start[284]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> ca # [2170094.442089] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> ca # [2170094.442981] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> ca # [2170094.443745] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [2170094.444892] ca acme-ca.foo-start[259]: + for fixpath in out certificates
container-test-run-certificates> ca # [2170094.444921] ca acme-ca.foo-start[259]: + '[' -d out ']'
container-test-run-certificates> ca # [2170094.444921] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [2170094.445854] ca acme-ca.foo-start[259]: + chown -R acme:nginx out
container-test-run-certificates> ca # [2170094.447525] ca acme-ca.foo-start[259]: + for fixpath in out certificates
container-test-run-certificates> ca # [2170094.447525] ca acme-ca.foo-start[259]: + '[' -d certificates ']'
container-test-run-certificates> ca # [2170094.449334] ca systemd[1]: Finished Ensure certificate for ca.foo.
container-test-run-certificates> ca # [2170094.450124] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca # [2170095.082798] ca nginx-pre-start[296]: nginx: the configuration file /nix/store/sah979n8myn3yyp4kkgg7fp87i8laxvb-nginx.conf syntax is ok
container-test-run-certificates> ca # [2170095.083121] ca nginx-pre-start[296]: nginx: configuration file /nix/store/sah979n8myn3yyp4kkgg7fp87i8laxvb-nginx.conf test is successful
container-test-run-certificates> ca # [2170095.085969] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> ca # [2170095.086195] ca systemd[1]: Reached target Multi-User System.
container-test-run-certificates> ca # [2170095.086747] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> ca # [2170095.746333] ca acme-order-renew-ca.foo-start[299]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [2170095.747743] ca acme-order-renew-ca.foo-start[299]: + set -euo pipefail
container-test-run-certificates> ca # [2170095.747776] ca acme-order-renew-ca.foo-start[299]: + exec
container-test-run-certificates> ca # [2170095.747799] ca acme-order-renew-ca.foo-start[299]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11
container-test-run-certificates> ca # [2170095.748361] ca acme-order-renew-ca.foo-start[310]: ++ find accounts -path '*/keys/*.key' -print -quit
container-test-run-certificates> ca # [2170095.749615] ca acme-order-renew-ca.foo-start[299]: + '[' -n '' ']'
container-test-run-certificates> ca # [2170095.749653] ca acme-order-renew-ca.foo-start[299]: + exec
container-test-run-certificates> ca # [2170095.749666] ca acme-order-renew-ca.foo-start[299]: + '[' -e certificates/ca.foo.key ']'
container-test-run-certificates> ca # [2170095.749679] ca acme-order-renew-ca.foo-start[299]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains
container-test-run-certificates> ca # [2170095.759034] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.182352829Z INFO  Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key
container-test-run-certificates> ca # [2170095.771427] ca step-ca[207]: time="2026-09-29T10:05:10Z" level=info duration="67.347µs" duration-ns=67347 fields.time="2026-09-29T10:05:10Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=ef42e0c6-6e85-4a79-9f20-4c1c525dcb12 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170095.771663] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.194904491Z INFO  Registering the account. email=none@none.tld
container-test-run-certificates> ca # [2170095.772148] ca step-ca[207]: time="2026-09-29T10:05:10Z" level=info duration="480.615µs" duration-ns=480615 fields.time="2026-09-29T10:05:10Z" method=HEAD name=ca nonce=dXpyQXBjb2VhalNUZ3Vub1lHcTl0eURhQUpmRUMxdnM path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=0c5ba44b-da1b-497e-9a32-2dc00dd1e836 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170095.773246] ca step-ca[207]: time="2026-09-29T10:05:10Z" level=info duration="856.063µs" duration-ns=856063 fields.time="2026-09-29T10:05:10Z" method=POST name=ca nonce=NDl6UEY4UXV0SUh6c3hMTGprZ0N5MjdFc3M4THFua2g path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=20896c53-c919-4b5e-957b-c3a7b739582a response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/Wkr9PBeOxd5jSG2dIzVaGaCVOGVFuf50/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170095.773365] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.196697779Z WARN  !!!! HEADS UP !!!!
container-test-run-certificates> ca # [2170095.773365] ca acme-order-renew-ca.foo-start[311]: Your account credentials have been saved in your
container-test-run-certificates> ca # [2170095.773365] ca acme-order-renew-ca.foo-start[311]: configuration directory at "accounts".
container-test-run-certificates> ca # [2170095.773365] ca acme-order-renew-ca.foo-start[311]: You should make a secure backup of this folder now. This
container-test-run-certificates> ca # [2170095.773365] ca acme-order-renew-ca.foo-start[311]: configuration directory will also contain private keys
container-test-run-certificates> ca # [2170095.773365] ca acme-order-renew-ca.foo-start[311]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> ca # [2170095.773365] ca acme-order-renew-ca.foo-start[311]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> ca # [2170095.773447] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.196757361Z INFO  Obtaining bundled SAN certificate. domains=ca.foo
container-test-run-certificates> ca # [2170095.774986] ca step-ca[207]: time="2026-09-29T10:05:10Z" level=info duration=1.393484ms duration-ns=1393484 fields.time="2026-09-29T10:05:10Z" method=POST name=ca nonce=MmpQc0ppb2ZVTWU5RWpnV2pKTUdtUEZlb3l3aVN6WmY path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=84323049-6c2e-4589-a6dd-3ccf860c9576 response="{\"id\":\"HRZpvyEdt1jTV97ofFpoCIKcA8UHljgy\",\"status\":\"pending\",\"expires\":\"2026-09-30T10:05:10Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-29T10:04:10Z\",\"notAfter\":\"2026-12-28T10:05:10Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/hLNnV9GDOxA32t0FjJ7kDy53RGYtegz3\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/HRZpvyEdt1jTV97ofFpoCIKcA8UHljgy/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170095.831332] ca step-ca[207]: time="2026-09-29T10:05:10Z" level=info duration="442.153µs" duration-ns=442153 fields.time="2026-09-29T10:05:10Z" method=POST name=ca nonce=T0RJQUV0RTEzeU9QaktlZElDQjRyTHVSa005WEV6VG4 path=/acme/acme/authz/hLNnV9GDOxA32t0FjJ7kDy53RGYtegz3 protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=eba04344-1199-47df-b21e-7990194f8afc response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"HX4hu3unXMeZM5H0EekxXdFdUye3wYxu\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/hLNnV9GDOxA32t0FjJ7kDy53RGYtegz3/PYEuMNkLAiVzpZe052AvS4mPz15CQut6\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"HX4hu3unXMeZM5H0EekxXdFdUye3wYxu\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/hLNnV9GDOxA32t0FjJ7kDy53RGYtegz3/1R3PPbDyWSMrP2uMLUDwN1ykP31eKADL\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"HX4hu3unXMeZM5H0EekxXdFdUye3wYxu\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/hLNnV9GDOxA32t0FjJ7kDy53RGYtegz3/6CvhSkGtZME6gEXJpxLGnO5lgF9KaIdh\"}],\"wildcard\":false,\"expires\":\"2026-09-30T10:05:10Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170095.831430] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.254762699Z INFO  Use solver. domain=ca.foo type=http-01
container-test-run-certificates> ca # [2170095.831454] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.254771246Z INFO  http01: Trying to solve HTTP-01. domain=ca.foo
container-test-run-certificates> ca # [2170095.833207] ca step-ca[207]: time="2026-09-29T10:05:10Z" level=info duration=1.604853ms duration-ns=1604853 fields.time="2026-09-29T10:05:10Z" method=POST name=ca nonce=VmVYODl4UnRDbk5QaWFKa1g3a2Z1UDhpZUZCS2ZlTUw path=/acme/acme/challenge/hLNnV9GDOxA32t0FjJ7kDy53RGYtegz3/1R3PPbDyWSMrP2uMLUDwN1ykP31eKADL protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=588ff362-a84a-4c56-bd21-3d2fc73b92ae response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"HX4hu3unXMeZM5H0EekxXdFdUye3wYxu\",\"validated\":\"2026-09-29T10:05:10Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/hLNnV9GDOxA32t0FjJ7kDy53RGYtegz3/1R3PPbDyWSMrP2uMLUDwN1ykP31eKADL\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170095.833298] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.256630548Z INFO  The server validated our request. domain=ca.foo
container-test-run-certificates> ca # [2170095.833357] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.256692013Z INFO  Validations succeeded; requesting certificates. domains=ca.foo
container-test-run-certificates> ca # [2170095.835426] ca step-ca[207]: time="2026-09-29T10:05:10Z" level=info duration=1.81028ms duration-ns=1810280 fields.time="2026-09-29T10:05:10Z" method=POST name=ca nonce=QWRrdFBDR0haNkFEYmkxVjRMNlpNcG13bzZQcVY3aVE path=/acme/acme/order/HRZpvyEdt1jTV97ofFpoCIKcA8UHljgy/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=14ba04e5-68c0-4593-8a6f-2ead92988507 response="{\"id\":\"HRZpvyEdt1jTV97ofFpoCIKcA8UHljgy\",\"status\":\"valid\",\"expires\":\"2026-09-30T10:05:10Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-29T10:04:10Z\",\"notAfter\":\"2026-12-28T10:05:10Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/hLNnV9GDOxA32t0FjJ7kDy53RGYtegz3\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/HRZpvyEdt1jTV97ofFpoCIKcA8UHljgy/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/wDmQSOtSBwB6LcJGoI7NmSbzi8xxIuxR\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170095.836035] ca step-ca[207]: time="2026-09-29T10:05:10Z" level=info certificate=MIIB0zCCAXmgAwIBAgIQAXNfViMgqBrcLh5+tftDrzAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MjkxMDA0MTBaFw0yNjEyMjgxMDA1MTBaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABEPK++WwIFFdaoVeuChn4i+oc2H4T20Ik7IM4tO3f7fMAvKAQUILsO9uVKAqnsNqPuJ1M01uPZXjnq7kMz0LKVyjgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU9uINVhgpBnYJqQrHCVu9kF5X60gwHwYDVR0jBBgwFoAUa6widC/HpLTxoyfmXTEfhACY1CgwEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNIADBFAiEA/k+Xufkh/Tr0lxktRoWw4lAXTtbZB0C83pXCEaIk4HwCIG8yajOvMYKdnrCuaDKLcUEJ9DVc0SigqSWypDbBJiWh duration="439.046µs" duration-ns=439046 fields.time="2026-09-29T10:05:10Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=RHdITFZOZjhyNGxWWGF2anpuU0FuVzZuc3htNXl3bUw path=/acme/acme/certificate/wDmQSOtSBwB6LcJGoI7NmSbzi8xxIuxR protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=9967ebc3-d8ac-4c15-8440-20f41c810471 sans="map[dns:[ca.foo]]" serial=1928275787922199008632987794435425199 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-09-29T10:04:10Z" valid-to="2026-12-28T10:05:10Z"
container-test-run-certificates> ca # [2170095.836127] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.259460408Z INFO  Server responded with a certificate. domains=ca.foo
container-test-run-certificates> ca # [2170095.836142] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.259480115Z INFO  Writing file. filepath=certificates/ca.foo.crt
container-test-run-certificates> ca # [2170095.836179] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.259515011Z INFO  Writing file. filepath=certificates/ca.foo.issuer.crt
container-test-run-certificates> ca # [2170095.836199] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.259535069Z INFO  Writing file. filepath=certificates/ca.foo.key
container-test-run-certificates> ca # [2170095.836231] ca acme-order-renew-ca.foo-start[311]: 2026-09-29T10:05:10.259567169Z INFO  Writing file. filepath=certificates/ca.foo.json
container-test-run-certificates> ca # [2170095.838515] ca acme-order-renew-ca.foo-start[299]: + touch out/acme-success
container-test-run-certificates> ca # [2170095.839481] ca acme-order-renew-ca.foo-start[299]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [2170095.840161] ca acme-order-renew-ca.foo-start[299]: + touch out/renewed
container-test-run-certificates> ca # [2170095.840935] ca acme-order-renew-ca.foo-start[299]: + echo Installing new certificate
container-test-run-certificates> ca # [2170095.840935] ca acme-order-renew-ca.foo-start[299]: Installing new certificate
container-test-run-certificates> ca # [2170095.840959] ca acme-order-renew-ca.foo-start[299]: + cp -vp certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [2170095.841745] ca acme-order-renew-ca.foo-start[332]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> ca # [2170095.841909] ca acme-order-renew-ca.foo-start[299]: + cp -vp certificates/ca.foo.key out/key.pem
container-test-run-certificates> ca # [2170095.842692] ca acme-order-renew-ca.foo-start[333]: 'certificates/ca.foo.key' -> 'out/key.pem'
container-test-run-certificates> ca # [2170095.842816] ca acme-order-renew-ca.foo-start[299]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem
container-test-run-certificates> ca # [2170095.843666] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> ca # [2170095.843794] ca acme-order-renew-ca.foo-start[299]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> ca # [2170095.844587] ca acme-order-renew-ca.foo-start[299]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [2170095.845573] ca acme-order-renew-ca.foo-start[299]: + for fixpath in out certificates
container-test-run-certificates> ca # [2170095.845573] ca acme-order-renew-ca.foo-start[299]: + '[' -d out ']'
container-test-run-certificates> ca # [2170095.845608] ca acme-order-renew-ca.foo-start[299]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [2170095.846547] ca acme-order-renew-ca.foo-start[299]: + chown -R acme:nginx out
container-test-run-certificates> ca # [2170095.847998] ca acme-order-renew-ca.foo-start[299]: + for fixpath in out certificates
container-test-run-certificates> ca # [2170095.847998] ca acme-order-renew-ca.foo-start[299]: + '[' -d certificates ']'
container-test-run-certificates> ca # [2170095.848032] ca acme-order-renew-ca.foo-start[299]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [2170095.848863] ca acme-order-renew-ca.foo-start[299]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [2170095.850278] ca acme-order-renew-ca.foo-start[299]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [2170095.945176] ca systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> ca # [2170095.947297] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [2170095.947420] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> ca # [2170096.622518] ca nginx[350]: nginx: the configuration file /nix/store/sah979n8myn3yyp4kkgg7fp87i8laxvb-nginx.conf syntax is ok
container-test-run-certificates> ca # [2170096.622871] ca nginx[350]: nginx: configuration file /nix/store/sah979n8myn3yyp4kkgg7fp87i8laxvb-nginx.conf test is successful
container-test-run-certificates> ca # [2170097.293907] ca systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> ca # [2170097.294077] ca systemd[1]: Startup finished in 5.465s.
container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 6.14 seconds)
container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem'
container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds)
container-test-run-certificates> ca: must succeed: systemctl restart nginx.service
container-test-run-certificates> ca # [2170097.715821] ca systemd[1]: Stopping Nginx Web Server...
container-test-run-certificates> ca # [2170097.771784] ca systemd[1]: nginx.service: Deactivated successfully.
container-test-run-certificates> ca # [2170097.771903] ca systemd[1]: Stopped Nginx Web Server.
container-test-run-certificates> ca # [2170097.771916] ca systemd[1]: nginx.service: Consumed 2.510s CPU time over 3.321s wall clock time.
container-test-run-certificates> ca # [2170097.773420] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.72 seconds)
container-test-run-certificates> server: systemd-nspawn running (pid 443)
container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal...
container-test-run-certificates> client: systemd-nspawn running (pid 446)
container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal...
container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem'
container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container server on /build/vm-state-server.
container-test-run-certificates> ░ Spawning container client on /build/vm-state-client.
container-test-run-certificates> ca # [2170098.429057] ca nginx-pre-start[374]: nginx: the configuration file /nix/store/sah979n8myn3yyp4kkgg7fp87i8laxvb-nginx.conf syntax is ok
container-test-run-certificates> ca # [2170098.429346] ca nginx-pre-start[374]: nginx: configuration file /nix/store/sah979n8myn3yyp4kkgg7fp87i8laxvb-nginx.conf test is successful
container-test-run-certificates> ca # [2170098.432130] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [2170098.940736] server systemd-journald[72]: Journal started
container-test-run-certificates> server # [2170098.940764] server systemd-journald[72]: Runtime Journal (/run/log/journal/7efa139e1aa44be4b999a32d376b9d99) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> server # [2170098.946634] server systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> server # [2170098.953290] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [2170098.975219] server systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> server # [2170098.975588] server systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> server # [2170098.975877] server systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> server # [2170098.979690] server systemd-journald[72]: Time spent on flushing to /var/log/journal/7efa139e1aa44be4b999a32d376b9d99 is 1.002ms for 7 entries.
container-test-run-certificates> server # [2170098.979690] server systemd-journald[72]: System Journal (/var/log/journal/7efa139e1aa44be4b999a32d376b9d99) is 8M, max 4G, 3.9G free.
container-test-run-certificates> server # [2170098.992190] server systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> server # [2170098.992443] server systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> server # [2170098.993031] server systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> server # [2170098.993082] server systemd[1]: Reached target Local File Systems.
container-test-run-certificates> server # [2170098.993485] server systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> server # [2170098.993510] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [2170098.993860] server systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> server # [2170098.994128] server systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> server # [2170098.994142] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> server # [2170099.005041] server systemd-tmpfiles[147]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> server # [2170099.005194] server systemd-tmpfiles[147]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> server # [2170099.005293] server systemd-tmpfiles[147]: fchmod() of /var/log/journal/7efa139e1aa44be4b999a32d376b9d99 failed: Operation not permitted
container-test-run-certificates> server # [2170099.005438] server systemd-tmpfiles[147]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> server # [2170099.006943] server systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> server # [2170099.007488] server systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> server # [2170099.008087] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> server # [2170099.010120] server systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> server # [2170099.014223] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> server # [2170099.019695] server systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> server # [2170099.020123] server systemd[1]: Starting Update is Completed...
container-test-run-certificates> server # [2170099.026264] server systemd[1]: Finished Update is Completed.
container-test-run-certificates> server # [2170099.029704] server systemd[1]: Finished Firewall.
container-test-run-certificates> server # [2170099.029787] server systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> server # [2170099.029907] server systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> server # [2170099.030313] server systemd[1]: Starting Network Management...
container-test-run-certificates> client # [2170098.935080] client systemd-journald[72]: Journal started
container-test-run-certificates> client # [2170098.935108] client systemd-journald[72]: Runtime Journal (/run/log/journal/b424eb7c87fa42edb6fcbe2156202a5d) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> client # [2170098.941297] client systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> client # [2170098.949030] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> client # [2170098.957327] client systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> client # [2170098.957656] client systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [2170098.957978] client systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> client # [2170098.978055] client systemd-journald[72]: Time spent on flushing to /var/log/journal/b424eb7c87fa42edb6fcbe2156202a5d is 1.011ms for 7 entries.
container-test-run-certificates> client # [2170098.978055] client systemd-journald[72]: System Journal (/var/log/journal/b424eb7c87fa42edb6fcbe2156202a5d) is 8M, max 4G, 3.9G free.
container-test-run-certificates> client # [2170098.990243] client systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> client # [2170098.990460] client systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> client # [2170098.991089] client systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> client # [2170098.991136] client systemd[1]: Reached target Local File Systems.
container-test-run-certificates> client # [2170098.991620] client systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> client # [2170098.991648] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [2170098.992053] client systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> client # [2170098.992373] client systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> client # [2170098.992391] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> client # [2170099.004699] client systemd-tmpfiles[151]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> client # [2170099.004847] client systemd-tmpfiles[151]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> client # [2170099.004953] client systemd-tmpfiles[151]: fchmod() of /var/log/journal/b424eb7c87fa42edb6fcbe2156202a5d failed: Operation not permitted
container-test-run-certificates> client # [2170099.005113] client systemd-tmpfiles[151]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [2170099.006923] client systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> client # [2170099.007374] client systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [2170099.007673] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> client # [2170099.009835] client systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [2170099.014251] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> client # [2170099.017831] client systemd[1]: Finished Firewall.
container-test-run-certificates> client # [2170099.017908] client systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> client # [2170099.018034] client systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> client # [2170099.018428] client systemd[1]: Starting Network Management...
container-test-run-certificates> client # [2170099.019765] client systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> client # [2170099.020266] client systemd[1]: Starting Update is Completed...
container-test-run-certificates> client # [2170099.025654] client systemd[1]: Finished Update is Completed.
container-test-run-certificates> client # [2170099.489650] client systemd-networkd[183]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [2170099.489718] client systemd-networkd[183]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [2170099.497184] client systemd-networkd[183]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [2170099.497329] client systemd-networkd[183]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [2170099.497393] client systemd-networkd[183]: lo: Link UP
container-test-run-certificates> client # [2170099.497396] client systemd-networkd[183]: lo: Gained carrier
container-test-run-certificates> client # [2170099.497539] client systemd-networkd[183]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> client # [2170099.497778] client systemd[1]: Started Network Management.
container-test-run-certificates> client # [2170099.497816] client systemd-networkd[183]: eth1: Link UP
container-test-run-certificates> client # [2170099.497951] client systemd-networkd[183]: eth1: Gained carrier
container-test-run-certificates> client # [2170099.498497] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> client # [2170099.527991] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [2170099.512476] server systemd-networkd[190]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [2170099.512540] server systemd-networkd[190]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [2170099.520328] server systemd-networkd[190]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [2170099.520477] server systemd-networkd[190]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [2170099.520558] server systemd-networkd[190]: lo: Link UP
container-test-run-certificates> server # [2170099.520561] server systemd-networkd[190]: lo: Gained carrier
container-test-run-certificates> server # [2170099.520703] server systemd-networkd[190]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> server # [2170099.520963] server systemd[1]: Started Network Management.
container-test-run-certificates> server # [2170099.523120] server systemd-networkd[190]: eth1: Link UP
container-test-run-certificates> server # [2170099.523144] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> server # [2170099.523282] server systemd-networkd[190]: eth1: Gained carrier
container-test-run-certificates> server # [2170099.535192] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [2170099.877149] server systemd-resolved[123]: Positive Trust Anchors:
container-test-run-certificates> server # [2170099.877155] server systemd-resolved[123]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> server # [2170099.877158] server systemd-resolved[123]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> server # [2170099.877172] server systemd-resolved[123]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> server # [2170099.887422] server systemd-resolved[123]: Using system hostname 'server'.
container-test-run-certificates> server # [2170099.888214] server systemd[1]: Started Network Name Resolution.
container-test-run-certificates> server # [2170099.888259] server systemd[1]: Reached target Network.
container-test-run-certificates> server # [2170099.888289] server systemd[1]: Reached target Network is Online.
container-test-run-certificates> server # [2170099.888314] server systemd[1]: Reached target System Initialization.
container-test-run-certificates> server # [2170099.888430] server systemd[1]: Started Renew ACME Certificate for test.foo.
container-test-run-certificates> server # [2170099.888449] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [2170099.888461] server systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> server # [2170099.888471] server systemd[1]: Reached target Timer Units.
container-test-run-certificates> server # [2170099.888539] server systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> server # [2170099.888588] server systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> server # [2170099.888654] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> server # [2170099.888663] server systemd[1]: Reached target Socket Units.
container-test-run-certificates> server # [2170099.888682] server systemd[1]: Reached target Basic System.
container-test-run-certificates> server # [2170099.899454] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> server # [2170099.899856] server systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> server # [2170099.899873] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem
container-test-run-certificates> server # [2170099.900259] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> server # [2170099.900822] server systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> server # [2170099.909207] server systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> server # [2170099.940451] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> server # [2170099.992886] server acme-setup-privileged[195]: + set -euo pipefail
container-test-run-certificates> server # [2170099.992886] server acme-setup-privileged[195]: + cd /var/lib/acme
container-test-run-certificates> server # [2170099.992886] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> server # [2170099.994060] server acme-setup-privileged[195]: + chown -R acme .lego/accounts
container-test-run-certificates> server # [2170099.994921] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [2170099.994939] server acme-setup-privileged[195]: + '[' -d test.foo ']'
container-test-run-certificates> server # [2170099.994939] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [2170099.994939] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']'
container-test-run-certificates> server # [2170100.018873] server nsncd[197]: Sep 29 10:05:14.442 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> server # [2170100.018898] server systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> server # [2170100.018931] server systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> server # [2170100.018960] server systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> server # [2170100.027142] server systemd[1]: Starting User Login Management...
container-test-run-certificates> server # [2170100.027555] server systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> server # [2170100.034237] server systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> server # [2170100.034698] server systemd[1]: Started Console Getty.
container-test-run-certificates> server # [2170100.034715] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> server # [2170100.034727] server systemd[1]: Reached target Login Prompts.
container-test-run-certificates> server # [2170100.135086] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> server # [2170100.135549] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> server # [2170100.135549] server dbus-broker-launch[198]: Invalid user-name in /nix/store/wb0sa994yzj4dxyl9sxkcfjzjnjy3vb5-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> client # [2170099.869267] client systemd-resolved[111]: Positive Trust Anchors:
container-test-run-certificates> client # [2170099.869274] client systemd-resolved[111]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> client # [2170099.869277] client systemd-resolved[111]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> client # [2170099.869292] client systemd-resolved[111]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> client # [2170099.880238] client systemd-resolved[111]: Using system hostname 'client'.
container-test-run-certificates> client # [2170099.881144] client systemd[1]: Started Network Name Resolution.
container-test-run-certificates> client # [2170099.881193] client systemd[1]: Reached target Network.
container-test-run-certificates> client # [2170099.881228] client systemd[1]: Reached target System Initialization.
container-test-run-certificates> client # [2170099.881265] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [2170099.881282] client systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> client # [2170099.881291] client systemd[1]: Reached target Timer Units.
container-test-run-certificates> client # [2170099.881364] client systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> client # [2170099.881418] client systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> client # [2170099.881485] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> client # [2170099.881496] client systemd[1]: Reached target Socket Units.
container-test-run-certificates> client # [2170099.881516] client systemd[1]: Reached target Basic System.
container-test-run-certificates> client # [2170099.882137] client systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> client # [2170099.882515] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> client # [2170099.883077] client systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> client # [2170099.907650] client systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> client # [2170099.933548] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [2170100.017086] client nsncd[192]: Sep 29 10:05:14.440 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> client # [2170100.017131] client systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> client # [2170100.017173] client systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> client # [2170100.017214] client systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> client # [2170100.027156] client systemd[1]: Starting User Login Management...
container-test-run-certificates> client # [2170100.027558] client systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> client # [2170100.032939] client systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> client # [2170100.033502] client systemd[1]: Started Console Getty.
container-test-run-certificates> client # [2170100.033527] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> client # [2170100.033542] client systemd[1]: Reached target Login Prompts.
container-test-run-certificates> client # [2170100.141644] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> client # [2170100.141943] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> client # [2170100.141943] client dbus-broker-launch[193]: Invalid user-name in /nix/store/l2n2mawz12b4z2cv32rvhhh0nm09ndic-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> client # [2170100.142150] client systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> client # [2170100.146025] client dbus-broker-launch[193]: Ready
container-test-run-certificates> server # [2170100.135780] server systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> server # [2170100.139576] server dbus-broker-launch[198]: Ready
container-test-run-certificates> server # [2170100.595247] server systemd-logind[222]: New seat seat0.
container-test-run-certificates> server # [2170100.595366] server systemd[1]: Started User Login Management.
container-test-run-certificates> server # [2170100.596097] server systemd[1]: Starting linger-users.service...
container-test-run-certificates> server # [2170100.615702] server systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> server # [2170100.615752] server systemd[1]: Finished linger-users.service.
container-test-run-certificates> server # [2170100.649146] server acme-setup-start[211]: + set -euo pipefail
container-test-run-certificates> server # [2170100.649146] server acme-setup-start[211]: + test -e ca/key.pem
container-test-run-certificates> server # [2170100.649385] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> server # [2170100.656274] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> server # [2170100.657037] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> client # [2170100.596425] client systemd-logind[208]: New seat seat0.
container-test-run-certificates> client # [2170100.596520] client systemd[1]: Started User Login Management.
container-test-run-certificates> client # [2170100.597224] client systemd[1]: Starting linger-users.service...
container-test-run-certificates> client # [2170100.615361] client systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> client # [2170100.615487] client systemd[1]: Finished linger-users.service.
container-test-run-certificates> client # [2170100.615688] client systemd[1]: Reached target Multi-User System.
container-test-run-certificates> client # [2170100.615773] client systemd[1]: Startup finished in 1.917s.
container-test-run-certificates> server # [2170100.992082] server systemd-networkd[190]: eth1: Gained IPv6LL
container-test-run-certificates> client # [2170101.312046] client systemd-networkd[183]: eth1: Gained IPv6LL
container-test-run-certificates> server # [2170101.280981] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [2170101.282800] server acme-test.foo-start[248]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [2170101.282800] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [2170101.287206] server acme-test.foo-start[258]: + cd test.foo
container-test-run-certificates> server # [2170101.287346] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [2170101.288197] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [2170101.288362] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [2170101.289125] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [2170101.289252] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [2170101.290202] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [2170101.291006] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [2170101.291826] server acme-test.foo-start[248]: + for fixpath in out certificates
container-test-run-certificates> server # [2170101.291837] server acme-test.foo-start[248]: + '[' -d out ']'
container-test-run-certificates> server # [2170101.291837] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [2170101.292641] server acme-test.foo-start[248]: + chown -R acme:nginx out
container-test-run-certificates> server # [2170101.293898] server acme-test.foo-start[248]: + for fixpath in out certificates
container-test-run-certificates> server # [2170101.293898] server acme-test.foo-start[248]: + '[' -d certificates ']'
container-test-run-certificates> server # [2170101.296007] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [2170101.296833] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server # [2170101.936088] server nginx-pre-start[270]: nginx: the configuration file /nix/store/nnd7bs3qz46ahy1nx65iy7h1wddw5m6l-nginx.conf syntax is ok
container-test-run-certificates> server # [2170101.936374] server nginx-pre-start[270]: nginx: configuration file /nix/store/nnd7bs3qz46ahy1nx65iy7h1wddw5m6l-nginx.conf test is successful
container-test-run-certificates> server # [2170101.938694] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [2170101.938877] server systemd[1]: Reached target Multi-User System.
container-test-run-certificates> server # [2170101.939439] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> server # [2170102.566615] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [2170102.568126] server acme-order-renew-test.foo-start[273]: + set -euo pipefail
container-test-run-certificates> server # [2170102.568160] server acme-order-renew-test.foo-start[273]: + exec
container-test-run-certificates> server # [2170102.568184] server acme-order-renew-test.foo-start[273]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11
container-test-run-certificates> server # [2170102.568770] server acme-order-renew-test.foo-start[284]: ++ find accounts -path '*/keys/*.key' -print -quit
container-test-run-certificates> server # [2170102.570024] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']'
container-test-run-certificates> server # [2170102.570059] server acme-order-renew-test.foo-start[273]: + exec
container-test-run-certificates> server # [2170102.570078] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']'
container-test-run-certificates> server # [2170102.570097] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains
container-test-run-certificates> server # [2170102.579268] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.002589989Z INFO  Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key
container-test-run-certificates> server # [2170102.593383] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.016699856Z INFO  Registering the account. email=none@none.tld
container-test-run-certificates> server # [2170102.604960] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.028288995Z WARN  !!!! HEADS UP !!!!
container-test-run-certificates> server # [2170102.604960] server acme-order-renew-test.foo-start[285]: Your account credentials have been saved in your
container-test-run-certificates> server # [2170102.604960] server acme-order-renew-test.foo-start[285]: configuration directory at "accounts".
container-test-run-certificates> server # [2170102.604960] server acme-order-renew-test.foo-start[285]: You should make a secure backup of this folder now. This
container-test-run-certificates> server # [2170102.604960] server acme-order-renew-test.foo-start[285]: configuration directory will also contain private keys
container-test-run-certificates> server # [2170102.604960] server acme-order-renew-test.foo-start[285]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> server # [2170102.604960] server acme-order-renew-test.foo-start[285]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> server # [2170102.605071] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.028372893Z INFO  Obtaining bundled SAN certificate. domains=test.foo
container-test-run-certificates> server # [2170102.665346] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.088673995Z INFO  Use solver. domain=test.foo type=http-01
container-test-run-certificates> server # [2170102.665346] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.088683874Z INFO  http01: Trying to solve HTTP-01. domain=test.foo
container-test-run-certificates> server # [2170102.667494] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.090826029Z INFO  The server validated our request. domain=test.foo
container-test-run-certificates> server # [2170102.667522] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.090857097Z INFO  Validations succeeded; requesting certificates. domains=test.foo
container-test-run-certificates> server # [2170102.670978] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.094310152Z INFO  Server responded with a certificate. domains=test.foo
container-test-run-certificates> server # [2170102.671021] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.094336842Z INFO  Writing file. filepath=certificates/test.foo.crt
container-test-run-certificates> server # [2170102.671043] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.094374623Z INFO  Writing file. filepath=certificates/test.foo.issuer.crt
container-test-run-certificates> server # [2170102.671072] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.094406623Z INFO  Writing file. filepath=certificates/test.foo.key
container-test-run-certificates> server # [2170102.671117] server acme-order-renew-test.foo-start[285]: 2026-09-29T10:05:17.094451438Z INFO  Writing file. filepath=certificates/test.foo.json
container-test-run-certificates> server # [2170102.674016] server acme-order-renew-test.foo-start[273]: + touch out/acme-success
container-test-run-certificates> server # [2170102.674817] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [2170102.675371] server acme-order-renew-test.foo-start[273]: + touch out/renewed
container-test-run-certificates> server # [2170102.676188] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate
container-test-run-certificates> server # [2170102.676188] server acme-order-renew-test.foo-start[273]: Installing new certificate
container-test-run-certificates> server # [2170102.676215] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [2170102.676895] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> server # [2170102.677016] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem
container-test-run-certificates> server # [2170102.677630] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.key' -> 'out/key.pem'
container-test-run-certificates> server # [2170102.677732] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem
container-test-run-certificates> server # [2170102.678520] server acme-order-renew-test.foo-start[308]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> server # [2170102.678665] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> server # [2170102.679393] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [2170102.680138] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates
container-test-run-certificates> server # [2170102.680148] server acme-order-renew-test.foo-start[273]: + '[' -d out ']'
container-test-run-certificates> server # [2170102.680148] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [2170102.680865] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out
container-test-run-certificates> server # [2170102.682222] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates
container-test-run-certificates> server # [2170102.682242] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']'
container-test-run-certificates> server # [2170102.682242] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> server # [2170102.682931] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates
container-test-run-certificates> server # [2170102.684010] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> server # [2170102.793955] server systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> server # [2170102.796288] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [2170102.796395] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> ca # [2170102.593143] ca step-ca[207]: time="2026-09-29T10:05:17Z" level=info duration="33.333µs" duration-ns=33333 fields.time="2026-09-29T10:05:17Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=4d639f7f-f91e-43b7-b2fe-622b40eab1a4 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170102.603111] ca step-ca[207]: time="2026-09-29T10:05:17Z" level=info duration=8.805476ms duration-ns=8805476 fields.time="2026-09-29T10:05:17Z" method=HEAD name=ca nonce=Nk80ckVZUGhSNURzNzhRSTJ3bDZVZXZpR0E4RGM2YU0 path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=692ab68a-fb6f-4ec3-9622-30e0cf596f44 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170102.604745] ca step-ca[207]: time="2026-09-29T10:05:17Z" level=info duration="651.637µs" duration-ns=651637 fields.time="2026-09-29T10:05:17Z" method=POST name=ca nonce=UnFWN00xVzU5MjdWV1Y4RVp2eFBDR1UwRGkzR09EUUY path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=2bd94c25-b760-4997-8e0c-e600e6f4d21b response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/9FbbdTMt9ILW0VpJlGXo5D1F2v19UiEx/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170102.606944] ca step-ca[207]: time="2026-09-29T10:05:17Z" level=info duration=1.266776ms duration-ns=1266776 fields.time="2026-09-29T10:05:17Z" method=POST name=ca nonce=cjFDaE5BQkpLQ3QzOG1MRTVNOTJlR1R5NUFpVHhDZWk path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=911d3438-ad37-4709-bdfe-7580f85256d5 response="{\"id\":\"77tKB1iN31gVSbXeVkq966dKIvZEmMOp\",\"status\":\"pending\",\"expires\":\"2026-09-30T10:05:17Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-29T10:04:17Z\",\"notAfter\":\"2026-12-28T10:05:17Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/hKVzephxouNhzn88kILqX0BY1wXxerQ4\"],\"finalize\":\"https://ca.foo/acme/acme/order/77tKB1iN31gVSbXeVkq966dKIvZEmMOp/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170102.665183] ca step-ca[207]: time="2026-09-29T10:05:17Z" level=info duration=1.098298ms duration-ns=1098298 fields.time="2026-09-29T10:05:17Z" method=POST name=ca nonce=VlJBZHVCdWd4Z0JUd0wzd29VaHJjM3pieEVFTU1wMUk path=/acme/acme/authz/hKVzephxouNhzn88kILqX0BY1wXxerQ4 protocol=HTTP/1.1 referer= remote-address="::1" request-id=353f1af2-0d8f-403c-ad22-eed7b02219d6 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"2Am9furNwVoRZieu4RC2Z5oIEvHHm1sh\",\"url\":\"https://ca.foo/acme/acme/challenge/hKVzephxouNhzn88kILqX0BY1wXxerQ4/vi8Gcx45zyx5UVftD086gjNi9KPzCVkL\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"2Am9furNwVoRZieu4RC2Z5oIEvHHm1sh\",\"url\":\"https://ca.foo/acme/acme/challenge/hKVzephxouNhzn88kILqX0BY1wXxerQ4/zTDSA4vWTzX9T9eCHIYOj0ivA0JMd7wl\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"2Am9furNwVoRZieu4RC2Z5oIEvHHm1sh\",\"url\":\"https://ca.foo/acme/acme/challenge/hKVzephxouNhzn88kILqX0BY1wXxerQ4/PEkLBtjyOIcnPetNEuX3rSeJeHoD7saR\"}],\"wildcard\":false,\"expires\":\"2026-09-30T10:05:17Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170102.667341] ca step-ca[207]: time="2026-09-29T10:05:17Z" level=info duration=1.367315ms duration-ns=1367315 fields.time="2026-09-29T10:05:17Z" method=POST name=ca nonce=QkdNaDI0V0lLRTRJYzdjTTNLcnZQSUlFQkdrdktsRzI path=/acme/acme/challenge/hKVzephxouNhzn88kILqX0BY1wXxerQ4/zTDSA4vWTzX9T9eCHIYOj0ivA0JMd7wl protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=0f7ef920-6849-4208-932d-0060e661ec77 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"2Am9furNwVoRZieu4RC2Z5oIEvHHm1sh\",\"validated\":\"2026-09-29T10:05:17Z\",\"url\":\"https://ca.foo/acme/acme/challenge/hKVzephxouNhzn88kILqX0BY1wXxerQ4/zTDSA4vWTzX9T9eCHIYOj0ivA0JMd7wl\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170102.669823] ca step-ca[207]: time="2026-09-29T10:05:17Z" level=info duration=1.58726ms duration-ns=1587260 fields.time="2026-09-29T10:05:17Z" method=POST name=ca nonce=N3RkVFlRZWdPRW0yZ3QzcEN2SW84SmxOUmhFMUFJV1U path=/acme/acme/order/77tKB1iN31gVSbXeVkq966dKIvZEmMOp/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=c131a29a-918c-4010-8161-02e716432c96 response="{\"id\":\"77tKB1iN31gVSbXeVkq966dKIvZEmMOp\",\"status\":\"valid\",\"expires\":\"2026-09-30T10:05:17Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-29T10:04:17Z\",\"notAfter\":\"2026-12-28T10:05:17Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/hKVzephxouNhzn88kILqX0BY1wXxerQ4\"],\"finalize\":\"https://ca.foo/acme/acme/order/77tKB1iN31gVSbXeVkq966dKIvZEmMOp/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/CAY7LpOOwRvuWLQDiVlLoZWBQUEu18sb\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2170102.670854] ca step-ca[207]: time="2026-09-29T10:05:17Z" level=info certificate="MIIB2DCCAX2gAwIBAgIQQojoeu+/JLXq1mj3UAXSbjAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MjkxMDA0MTdaFw0yNjEyMjgxMDA1MTdaMBMxETAPBgNVBAMTCHRlc3QuZm9vMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENSr21JnyzvCx3If4rIiJ4hGoFVF4G8ZIitueh1v7TDBlAhoyHRULjP2iH6ciRkB9uVeKrVangrKX1TQujYd+oKOBpjCBozAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBT803m5zfyzCRDIftngKqYBZBg1VDAfBgNVHSMEGDAWgBRrrCJ0L8ektPGjJ+ZdMR+EAJjUKDATBgNVHREEDDAKggh0ZXN0LmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSQAwRgIhANwxm0SaWnJroWd2wGgdUplBKGjYVwkt4ArVeYSO7m6wAiEAqSJI1vWK29scM7hZeeSztGvByYlnAmKhNsJy8a2SNkY=" duration="363.134µs" duration-ns=363134 fields.time="2026-09-29T10:05:17Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=VHRrMUVacjhXc2JadWtkRjJDVDdSUjJoTXR1VXNRbm4 path=/acme/acme/certificate/CAY7LpOOwRvuWLQDiVlLoZWBQUEu18sb protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=f635f6bc-285d-47f0-9248-6004d78e6954 sans="map[dns:[test.foo]]" serial=88439915353627053636742709961485046382 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-09-29T10:04:17Z" valid-to="2026-12-28T10:05:17Z"
container-test-run-certificates> server # [2170103.418039] server nginx[324]: nginx: the configuration file /nix/store/nnd7bs3qz46ahy1nx65iy7h1wddw5m6l-nginx.conf syntax is ok
container-test-run-certificates> server # [2170103.418293] server nginx[324]: nginx: configuration file /nix/store/nnd7bs3qz46ahy1nx65iy7h1wddw5m6l-nginx.conf test is successful
container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 5.64 seconds)
container-test-run-certificates> server: must succeed: systemctl restart nginx.service
container-test-run-certificates> server # [2170104.028876] server systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> server # [2170104.029073] server systemd[1]: Startup finished in 5.332s.
container-test-run-certificates> server # [2170104.077400] server systemd[1]: Stopping Nginx Web Server...
container-test-run-certificates> server # [2170104.136065] server systemd[1]: nginx.service: Deactivated successfully.
container-test-run-certificates> server # [2170104.136166] server systemd[1]: Stopped Nginx Web Server.
container-test-run-certificates> server # [2170104.136192] server systemd[1]: nginx.service: Consumed 3.687s CPU time over 2.839s wall clock time.
container-test-run-certificates> server # [2170104.137571] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.71 seconds)
container-test-run-certificates> client: waiting for success: curl -v https://test.foo
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 56688 failed: Connection refused
container-test-run-certificates> *   Trying 192.168.1.3:443...
container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 36106 failed: Connection refused
container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server
container-test-run-certificates> server # [2170104.777932] server nginx-pre-start[347]: nginx: the configuration file /nix/store/nnd7bs3qz46ahy1nx65iy7h1wddw5m6l-nginx.conf syntax is ok
container-test-run-certificates> server # [2170104.778187] server nginx-pre-start[347]: nginx: configuration file /nix/store/nnd7bs3qz46ahy1nx65iy7h1wddw5m6l-nginx.conf test is successful
container-test-run-certificates> server # [2170104.780439] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [930 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [79 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Sep 29 10:04:17 2026 GMT
container-test-run-certificates> *   expire date: Dec 28 10:05:17 2026 GMT
container-test-run-certificates> *   issuer: CN=Clan Intermediate CA
container-test-run-certificates> *   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 0
container-test-run-certificates> * SSL certificate verified via OpenSSL.
container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 56702 
container-test-run-certificates>   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
container-test-run-certificates>                                  Dload  Upload  Total   Spent   Left   Speed
container-test-run-certificates>   0      0   0      0   0      0      0      0                              0* using HTTP/2
container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/
container-test-run-certificates> * [HTTP/2] [1] [:method: GET]
container-test-run-certificates> * [HTTP/2] [1] [:scheme: https]
container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo]
container-test-run-certificates> * [HTTP/2] [1] [:path: /]
container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0]
container-test-run-certificates> * [HTTP/2] [1] [accept: */*]
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> * Request completely sent off
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> 100     20 100     20   0      0   1885      0                              0
container-test-run-certificates> * Connection #0 to host test.foo:443 left intact
container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds)
container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2
container-test-run-certificates> Certificate:
container-test-run-certificates>     Data:
container-test-run-certificates>         Version: 3 (0x2)
container-test-run-certificates>         Serial Number:
container-test-run-certificates>             42:88:e8:7a:ef:bf:24:b5:ea:d6:68:f7:50:05:d2:6e
container-test-run-certificates>         Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>         Issuer: CN=Clan Intermediate CA
container-test-run-certificates>         Validity
container-test-run-certificates>             Not Before: Sep 29 10:04:17 2026 GMT
container-test-run-certificates>             Not After : Dec 28 10:05:17 2026 GMT
container-test-run-certificates>         Subject: CN=test.foo
container-test-run-certificates>         Subject Public Key Info:
container-test-run-certificates>             Public Key Algorithm: id-ecPublicKey
container-test-run-certificates>                 Public-Key: (256 bit)
container-test-run-certificates>                 pub:
container-test-run-certificates>                     04:35:2a:f6:d4:99:f2:ce:f0:b1:dc:87:f8:ac:88:
container-test-run-certificates>                     89:e2:11:a8:15:51:78:1b:c6:48:8a:db:9e:87:5b:
container-test-run-certificates>                     fb:4c:30:65:02:1a:32:1d:15:0b:8c:fd:a2:1f:a7:
container-test-run-certificates>                     22:46:40:7d:b9:57:8a:ad:56:a7:82:b2:97:d5:34:
container-test-run-certificates>                     2e:8d:87:7e:a0
container-test-run-certificates>                 ASN1 OID: prime256v1
container-test-run-certificates>                 NIST CURVE: P-256
container-test-run-certificates>         X509v3 extensions:
container-test-run-certificates>             X509v3 Key Usage: critical
container-test-run-certificates>                 Digital Signature
container-test-run-certificates>             X509v3 Extended Key Usage: 
container-test-run-certificates>                 TLS Web Server Authentication, TLS Web Client Authentication
container-test-run-certificates>             X509v3 Subject Key Identifier: 
container-test-run-certificates>                 FC:D3:79:B9:CD:FC:B3:09:10:C8:7E:D9:E0:2A:A6:01:64:18:35:54
container-test-run-certificates>             X509v3 Authority Key Identifier: 
container-test-run-certificates>                 6B:AC:22:74:2F:C7:A4:B4:F1:A3:27:E6:5D:31:1F:84:00:98:D4:28
container-test-run-certificates>             X509v3 Subject Alternative Name: 
container-test-run-certificates>                 DNS:test.foo
container-test-run-certificates>             1.3.6.1.4.1.37476.9000.64.1: 
container-test-run-certificates>                 0......acme..
container-test-run-certificates>     Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>     Signature Value:
container-test-run-certificates>         30:46:02:21:00:dc:31:9b:44:9a:5a:72:6b:a1:67:76:c0:68:
container-test-run-certificates>         1d:52:99:41:28:68:d8:57:09:2d:e0:0a:d5:79:84:8e:ee:6e:
container-test-run-certificates>         b0:02:21:00:a9:22:48:d6:f5:8a:db:db:1c:33:b8:59:79:e4:
container-test-run-certificates>         b3:b4:6b:c1:c9:89:67:02:62:a1:36:c2:72:f1:ad:92:36:46
container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds)
container-test-run-certificates> (finished: run the VM test script, in 14.26 seconds)
container-test-run-certificates> test script finished in 14.31s
container-test-run-certificates> cleanup
container-test-run-certificates> kill NspawnMachine (pid 50)
container-test-run-certificates> kill NspawnMachine (pid 446)
container-test-run-certificates> kill NspawnMachine (pid 443)
container-test-run-certificates> Container ca terminated by signal KILL.
container-test-run-certificates> Container client terminated by signal KILL.
container-test-run-certificates> (finished: cleanup, in 0.21 seconds)
container-test-run-certificates> Container server terminated by signal KILL.