container-test-run-certificates
checks.aarch64-linux.certificates
· build #807
· raw
1build01: building fjwdmf81v88xg395zmxi2fcpk2bfwfaw-container-test-run-certificates.drv2additionally exposed symbols:3 ca, client, server,4 start_all, machines, driver, Machine, wait_for_signal5Starting ca6Starting client7Starting server89101112<<< NixOS Stage 2 >>>1314booting system configuration /nix/store/naq0q8xla8l9xyz5lk7sdaaiwb7jp0hd-nixos-system-ca-test15running activation script...16setting up /etc...172: host0@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100018 link/ether 42:06:76:42:a9:8d brd ff:ff:ff:ff:ff:ff link-netnsid 019setting up age secrets...20starting systemd...21systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)22Detected virtualization systemd-nspawn.23Detected architecture arm64.24Detected first boot.25Initializing machine ID from container UUID.26Applying preset policy.27Populated /etc with preset unit settings.28Queued start job for default target Multi-User System.29303132<<< Welcome to NixOS test (aarch64) - console >>>33+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo c3588b53-dd80-4767-a3f1-ab2db810e11b'34Running as unit: run-p469-i27340970.service; invocation ID: 96a43489e691470196b24a41a13207cf35To attach to container ca run on the same machine that runs the test:36 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*c3588b53-dd80-4767-a3f1-ab2db810e11b') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 3738To inject external network and continue test, run:39sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py c3588b53-dd80-4767-a3f1-ab2db810e11b4041<<< NixOS Stage 2 >>>4243booting system configuration /nix/store/ngrcnqdwjgimsk0lqz65dxyklj0gqh6k-nixos-system-client-test44running activation script...45setting up /etc...462: host0@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100047 link/ether 2a:42:35:28:b1:2f brd ff:ff:ff:ff:ff:ff link-netnsid 048setting up age secrets...49starting systemd...50systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)51Detected virtualization systemd-nspawn.52Detected architecture arm64.53Detected first boot.54Initializing machine ID from container UUID.55Applying preset policy.56Populated /etc with preset unit settings.57Queued start job for default target Multi-User System.58596061<<< Welcome to NixOS test (aarch64) - console >>>62+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo c69b3ace-d06a-4575-bcd0-8c7c632c7d85'63Running as unit: run-p304-i27340973.service; invocation ID: 1710646b2a744863ad1a9b2f811fa84b64To attach to container client run on the same machine that runs the test:65 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*c69b3ace-d06a-4575-bcd0-8c7c632c7d85') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 6667To inject external network and continue test, run:68sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py c69b3ace-d06a-4575-bcd0-8c7c632c7d856970<<< NixOS Stage 2 >>>7172booting system configuration /nix/store/s04wbpsgbkrjv8xz5ky0807npnw5ph5x-nixos-system-server-test73running activation script...74setting up /etc...752: host0@if5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100076 link/ether be:aa:dd:39:86:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 077setting up age secrets...78starting systemd...79systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)80Detected virtualization systemd-nspawn.81Detected architecture arm64.82Detected first boot.83Initializing machine ID from container UUID.84Applying preset policy.85Populated /etc with preset unit settings.86Queued start job for default target Multi-User System.87888990<<< Welcome to NixOS test (aarch64) - console >>>91+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo e981deb3-baed-4b21-a704-fc1cfb93b1ca'92Running as unit: run-p397-i27340976.service; invocation ID: 460008351bb54c6396af8c6ca8db0aae93To attach to container server run on the same machine that runs the test:94 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*e981deb3-baed-4b21-a704-fc1cfb93b1ca') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 9596To inject external network and continue test, run:97sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py e981deb3-baed-4b21-a704-fc1cfb93b1ca98+ systemctl restart acme-order-renew-ca.foo.service99+ systemctl restart acme-test.foo.service100client: waiting for success: curl -v https://test.foo101+ curl -v https://test.foo102* Host test.foo:443 was resolved.103* IPv6: (none)104* IPv4: 192.168.1.3105* Trying 192.168.1.3:443...106* ALPN: curl offers h2,http/1.1107} [5 bytes data]108* TLSv1.3 (OUT), TLS handshake, Client hello (1):109} [1552 bytes data]110* SSL Trust Anchors:111* OpenSSL default paths (fallback)112{ [5 bytes data]113* TLSv1.3 (IN), TLS handshake, Server hello (2):114{ [1210 bytes data]115* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):116{ [1 bytes data]117* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):118{ [19 bytes data]119* TLSv1.3 (IN), TLS handshake, Certificate (11):120{ [1009 bytes data]121* TLSv1.3 (IN), TLS handshake, CERT verify (15):122{ [110 bytes data]123* TLSv1.3 (IN), TLS handshake, Finished (20):124{ [52 bytes data]125* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):126} [1 bytes data]127* TLSv1.3 (OUT), TLS handshake, Finished (20):128} [52 bytes data]129* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey130* ALPN: server accepted h2131* Server certificate:132* subject: CN=test.foo133* start date: Sep 29 15:24:23 2026 GMT134* expire date: Oct 29 15:24:23 2028 GMT135* issuer: CN=minica root ca 07f009136* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384137* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384138* subjectAltName: "test.foo" matches cert's "test.foo"139* OpenSSL verify result: 13140* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)141* closing connection #0142curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)143More details here: https://curl.se/docs/sslcerts.html144145curl failed to verify the legitimacy of the server and therefore could not146establish a secure connection to it. To learn more about this situation and147how to fix it, please visit the webpage mentioned above.148+ curl -v https://test.foo149* Host test.foo:443 was resolved.150* IPv6: (none)151* IPv4: 192.168.1.3152* Trying 192.168.1.3:443...153* ALPN: curl offers h2,http/1.1154} [5 bytes data]155* TLSv1.3 (OUT), TLS handshake, Client hello (1):156} [1552 bytes data]157* SSL Trust Anchors:158* OpenSSL default paths (fallback)159{ [5 bytes data]160* TLSv1.3 (IN), TLS handshake, Server hello (2):161{ [1210 bytes data]162* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):163{ [1 bytes data]164* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):165{ [19 bytes data]166* TLSv1.3 (IN), TLS handshake, Certificate (11):167{ [1009 bytes data]168* TLSv1.3 (IN), TLS handshake, CERT verify (15):169{ [112 bytes data]170* TLSv1.3 (IN), TLS handshake, Finished (20):171{ [52 bytes data]172* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):173} [1 bytes data]174* TLSv1.3 (OUT), TLS handshake, Finished (20):175} [52 bytes data]176* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey177* ALPN: server accepted h2178* Server certificate:179* subject: CN=test.foo180* start date: Sep 29 15:24:23 2026 GMT181* expire date: Oct 29 15:24:23 2028 GMT182* issuer: CN=minica root ca 07f009183* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384184* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384185* subjectAltName: "test.foo" matches cert's "test.foo"186* OpenSSL verify result: 13187* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)188* closing connection #0189curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)190More details here: https://curl.se/docs/sslcerts.html191192curl failed to verify the legitimacy of the server and therefore could not193establish a secure connection to it. To learn more about this situation and194how to fix it, please visit the webpage mentioned above.195+ curl -v https://test.foo196* Host test.foo:443 was resolved.197* IPv6: (none)198* IPv4: 192.168.1.3199* Trying 192.168.1.3:443...200* ALPN: curl offers h2,http/1.1201} [5 bytes data]202* TLSv1.3 (OUT), TLS handshake, Client hello (1):203} [1552 bytes data]204* SSL Trust Anchors:205* OpenSSL default paths (fallback)206{ [5 bytes data]207* TLSv1.3 (IN), TLS handshake, Server hello (2):208{ [1210 bytes data]209* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):210{ [1 bytes data]211* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):212{ [19 bytes data]213* TLSv1.3 (IN), TLS handshake, Certificate (11):214{ [1009 bytes data]215* TLSv1.3 (IN), TLS handshake, CERT verify (15):216{ [110 bytes data]217* TLSv1.3 (IN), TLS handshake, Finished (20):218{ [52 bytes data]219* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):220} [1 bytes data]221* TLSv1.3 (OUT), TLS handshake, Finished (20):222} [52 bytes data]223* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey224* ALPN: server accepted h2225* Server certificate:226* subject: CN=test.foo227* start date: Sep 29 15:24:23 2026 GMT228* expire date: Oct 29 15:24:23 2028 GMT229* issuer: CN=minica root ca 07f009230* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384231* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384232* subjectAltName: "test.foo" matches cert's "test.foo"233* OpenSSL verify result: 13234* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)235* closing connection #0236curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)237More details here: https://curl.se/docs/sslcerts.html238239curl failed to verify the legitimacy of the server and therefore could not240establish a secure connection to it. To learn more about this situation and241how to fix it, please visit the webpage mentioned above.242+ curl -v https://test.foo243* Host test.foo:443 was resolved.244* IPv6: (none)245* IPv4: 192.168.1.3246* Trying 192.168.1.3:443...247* ALPN: curl offers h2,http/1.1248} [5 bytes data]249* TLSv1.3 (OUT), TLS handshake, Client hello (1):250} [1552 bytes data]251* SSL Trust Anchors:252* OpenSSL default paths (fallback)253{ [5 bytes data]254* TLSv1.3 (IN), TLS handshake, Server hello (2):255{ [1210 bytes data]256* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):257{ [1 bytes data]258* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):259{ [19 bytes data]260* TLSv1.3 (IN), TLS handshake, Certificate (11):261{ [931 bytes data]262* TLSv1.3 (IN), TLS handshake, CERT verify (15):263{ [80 bytes data]264* TLSv1.3 (IN), TLS handshake, Finished (20):265{ [52 bytes data]266* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):267} [1 bytes data]268* TLSv1.3 (OUT), TLS handshake, Finished (20):269} [52 bytes data]270* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey271* ALPN: server accepted h2272* Server certificate:273* subject: CN=test.foo274* start date: Sep 29 15:23:36 2026 GMT275* expire date: Dec 28 15:24:36 2026 GMT276* issuer: CN=Clan Intermediate CA277* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256278* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256279* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256280* subjectAltName: "test.foo" matches cert's "test.foo"281* OpenSSL verify result: 0282* SSL certificate verified via OpenSSL.283* Established connection to test.foo (192.168.1.3 port 443) from 192.168.1.2 port 44618 284 % Total % Received % Xferd Average Speed Time Time Time Current285 Dload Upload Total Spent Left Speed286 0 0 0 0 0 0 0 0 0* using HTTP/2287* [HTTP/2] [1] OPENED stream for https://test.foo/288* [HTTP/2] [1] [:method: GET]289* [HTTP/2] [1] [:scheme: https]290* [HTTP/2] [1] [:authority: test.foo]291* [HTTP/2] [1] [:path: /]292* [HTTP/2] [1] [user-agent: curl/8.22.0]293* [HTTP/2] [1] [accept: */*]294} [5 bytes data]295296297298299300* Request completely sent off301{ [5 bytes data]302* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):303{ [265 bytes data]304* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):305{ [265 bytes data]306307308309310311312313{ [5 bytes data]314100 20 100 20 0 0 672 0 0315* Connection #0 to host test.foo:443 left intact316(finished: waiting for success: curl -v https://test.foo, in 3.19 seconds)317+ openssl s_client -connect test.foo:443 -servername test.foo318+ openssl x509 -text -noout319Certificate:320 Data:321 Version: 3 (0x2)322 Serial Number:323 c7:c0:6c:5e:ed:3d:e1:d5:67:0e:76:14:65:e9:c8:6c324 Signature Algorithm: ecdsa-with-SHA256325 Issuer: CN=Clan Intermediate CA326 Validity327 Not Before: Sep 29 15:23:36 2026 GMT328 Not After : Dec 28 15:24:36 2026 GMT329 Subject: CN=test.foo330 Subject Public Key Info:331 Public Key Algorithm: id-ecPublicKey332 Public-Key: (256 bit)333 pub:334 04:7f:2f:8c:fa:02:80:be:6a:67:d3:af:86:cd:a0:335 e8:ec:c6:11:9a:14:10:4f:d2:87:c4:14:86:8c:f1:336 87:f6:bc:a1:35:18:8e:68:97:a3:30:32:ab:51:38:337 5e:06:a0:30:06:79:66:c5:ea:e1:40:86:40:3d:c6:338 ce:14:6c:b4:6b339 ASN1 OID: prime256v1340 NIST CURVE: P-256341 X509v3 extensions:342 X509v3 Key Usage: critical343 Digital Signature344 X509v3 Extended Key Usage: 345 TLS Web Server Authentication, TLS Web Client Authentication346 X509v3 Subject Key Identifier: 347 27:0D:26:59:8B:75:2D:3A:F5:E8:B3:B6:89:29:81:78:72:B1:C8:01348 X509v3 Authority Key Identifier: 349 12:7B:BB:87:0A:DE:A2:A4:61:95:C5:6B:DF:BC:AA:93:FE:C3:16:9F350 X509v3 Subject Alternative Name: 351 DNS:test.foo352 1.3.6.1.4.1.37476.9000.64.1: 353 0......acme..354 Signature Algorithm: ecdsa-with-SHA256355 Signature Value:356 30:45:02:20:46:92:31:de:9d:c2:05:72:8f:a9:40:e5:0d:d5:357 76:bf:c6:92:a7:a3:64:b6:38:11:b0:f5:47:e3:db:c7:65:0e:358 02:21:00:d7:89:6e:fc:f0:e4:2b:7f:ef:83:32:52:cd:dc:69:359 cc:49:ca:76:1f:44:06:61:2b:bd:07:b3:92:61:30:32:2a360361362