container-test-run-certificates
checks.aarch64-linux.certificates
· build #951
· raw
1build01: building hq3yvmjm4hp1w3ydp8py4a62v9s4ijmj-container-test-run-certificates.drv2additionally exposed symbols:3 ca, client, server,4 start_all, machines, driver, Machine, wait_for_signal5Starting ca6Starting client7Starting server89101112<<< NixOS Stage 2 >>>1314booting system configuration /nix/store/i5wbi7hybynhvnk5yvhb3zxig9mwlg89-nixos-system-ca-test15running activation script...16setting up /etc...172: host0@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100018 link/ether 42:06:76:42:a9:8d brd ff:ff:ff:ff:ff:ff link-netnsid 019setting up age secrets...20starting systemd...21systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)22Detected virtualization systemd-nspawn.23Detected architecture arm64.24Detected first boot.25Initializing machine ID from container UUID.26Applying preset policy.27Populated /etc with preset unit settings.28Queued start job for default target Multi-User System.29303132<<< Welcome to NixOS test (aarch64) - console >>>33+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo 2e6bafd3-8d6d-4c9a-8b16-19b0fa7db460'34Running as unit: run-p468-i1217261.service; invocation ID: 538a745c49224ecc84d5e8c72d06317135To attach to container ca run on the same machine that runs the test:36 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*2e6bafd3-8d6d-4c9a-8b16-19b0fa7db460') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 3738To inject external network and continue test, run:39sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 2e6bafd3-8d6d-4c9a-8b16-19b0fa7db4604041<<< NixOS Stage 2 >>>4243booting system configuration /nix/store/zpk3krv2ysivmxf1zcvxbca2m3w8adxi-nixos-system-client-test44running activation script...45setting up /etc...462: host0@if5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100047 link/ether 2a:42:35:28:b1:2f brd ff:ff:ff:ff:ff:ff link-netnsid 048setting up age secrets...49starting systemd...50systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)51Detected virtualization systemd-nspawn.52Detected architecture arm64.53Detected first boot.54Initializing machine ID from container UUID.55Applying preset policy.56Populated /etc with preset unit settings.57Queued start job for default target Multi-User System.58596061<<< Welcome to NixOS test (aarch64) - console >>>62+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo 6e7b2d11-f822-45f1-971d-230d5e888eff'63Running as unit: run-p304-i1217264.service; invocation ID: c8aa2e4cc7b2489b9ac8cad9e932d07a64To attach to container client run on the same machine that runs the test:65 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*6e7b2d11-f822-45f1-971d-230d5e888eff') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 6667To inject external network and continue test, run:68sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 6e7b2d11-f822-45f1-971d-230d5e888eff6970<<< NixOS Stage 2 >>>7172booting system configuration /nix/store/5dr906dhpfsq8xzv292szl5cvac6j0zz-nixos-system-server-test73running activation script...74setting up /etc...752: host0@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100076 link/ether be:aa:dd:39:86:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 077setting up age secrets...78starting systemd...79systemd 260.4 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)80Detected virtualization systemd-nspawn.81Detected architecture arm64.82Detected first boot.83Initializing machine ID from container UUID.84Applying preset policy.85Populated /etc with preset unit settings.86Queued start job for default target Multi-User System.87888990<<< Welcome to NixOS test (aarch64) - console >>>91+ systemd-run /bin/sh -c '/nix/store/fl0k50cdb33a5xxzlzmz5782yw66rj4r-coreutils-9.11/bin/sleep 999999999 && echo b985c191-596a-49d8-8ede-73de0d4733a3'92Running as unit: run-p398-i1217267.service; invocation ID: f52c8681218441d79b25500db43a187c93To attach to container server run on the same machine that runs the test:94 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*b985c191-596a-49d8-8ede-73de0d4733a3') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 9596To inject external network and continue test, run:97sudo /nix/store/76jq0mngg7m8zv5yjz1qgg0xspzi8x2w-python3-3.13.15/bin/python3.13 /nix/store/1v002aslhnn1b7kr1fq8m14lldran2b0-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py b985c191-596a-49d8-8ede-73de0d4733a398+ systemctl restart acme-order-renew-ca.foo.service99+ systemctl restart acme-test.foo.service100client: waiting for success: curl -v https://test.foo101+ curl -v https://test.foo102* Host test.foo:443 was resolved.103* IPv6: (none)104* IPv4: 192.168.1.3105* Trying 192.168.1.3:443...106* ALPN: curl offers h2,http/1.1107} [5 bytes data]108* TLSv1.3 (OUT), TLS handshake, Client hello (1):109} [1552 bytes data]110* SSL Trust Anchors:111* OpenSSL default paths (fallback)112{ [5 bytes data]113* TLSv1.3 (IN), TLS handshake, Server hello (2):114{ [1210 bytes data]115* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):116{ [1 bytes data]117* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):118{ [19 bytes data]119* TLSv1.3 (IN), TLS handshake, Certificate (11):120{ [1009 bytes data]121* TLSv1.3 (IN), TLS handshake, CERT verify (15):122{ [111 bytes data]123* TLSv1.3 (IN), TLS handshake, Finished (20):124{ [52 bytes data]125* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):126} [1 bytes data]127* TLSv1.3 (OUT), TLS handshake, Finished (20):128} [52 bytes data]129* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey130* ALPN: server accepted h2131* Server certificate:132* subject: CN=test.foo133* start date: Oct 13 00:32:43 2026 GMT134* expire date: Nov 12 00:32:43 2028 GMT135* issuer: CN=minica root ca 082e9b136* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384137* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384138* subjectAltName: "test.foo" matches cert's "test.foo"139* OpenSSL verify result: 13140* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)141* closing connection #0142curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)143More details here: https://curl.se/docs/sslcerts.html144145curl failed to verify the legitimacy of the server and therefore could not146establish a secure connection to it. To learn more about this situation and147how to fix it, please visit the webpage mentioned above.148+ curl -v https://test.foo149* Host test.foo:443 was resolved.150* IPv6: (none)151* IPv4: 192.168.1.3152* Trying 192.168.1.3:443...153* ALPN: curl offers h2,http/1.1154} [5 bytes data]155* TLSv1.3 (OUT), TLS handshake, Client hello (1):156} [1552 bytes data]157* SSL Trust Anchors:158* OpenSSL default paths (fallback)159{ [5 bytes data]160* TLSv1.3 (IN), TLS handshake, Server hello (2):161{ [1210 bytes data]162* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):163{ [1 bytes data]164* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):165{ [19 bytes data]166* TLSv1.3 (IN), TLS handshake, Certificate (11):167{ [1009 bytes data]168* TLSv1.3 (IN), TLS handshake, CERT verify (15):169{ [111 bytes data]170* TLSv1.3 (IN), TLS handshake, Finished (20):171{ [52 bytes data]172* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):173} [1 bytes data]174* TLSv1.3 (OUT), TLS handshake, Finished (20):175} [52 bytes data]176* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey177* ALPN: server accepted h2178* Server certificate:179* subject: CN=test.foo180* start date: Oct 13 00:32:43 2026 GMT181* expire date: Nov 12 00:32:43 2028 GMT182* issuer: CN=minica root ca 082e9b183* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384184* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384185* subjectAltName: "test.foo" matches cert's "test.foo"186* OpenSSL verify result: 13187* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)188* closing connection #0189curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)190More details here: https://curl.se/docs/sslcerts.html191192curl failed to verify the legitimacy of the server and therefore could not193establish a secure connection to it. To learn more about this situation and194how to fix it, please visit the webpage mentioned above.195+ curl -v https://test.foo196* Host test.foo:443 was resolved.197* IPv6: (none)198* IPv4: 192.168.1.3199* Trying 192.168.1.3:443...200* ALPN: curl offers h2,http/1.1201} [5 bytes data]202* TLSv1.3 (OUT), TLS handshake, Client hello (1):203} [1552 bytes data]204* SSL Trust Anchors:205* OpenSSL default paths (fallback)206{ [5 bytes data]207* TLSv1.3 (IN), TLS handshake, Server hello (2):208{ [1210 bytes data]209* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):210{ [1 bytes data]211* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):212{ [19 bytes data]213* TLSv1.3 (IN), TLS handshake, Certificate (11):214{ [1009 bytes data]215* TLSv1.3 (IN), TLS handshake, CERT verify (15):216{ [110 bytes data]217* TLSv1.3 (IN), TLS handshake, Finished (20):218{ [52 bytes data]219* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):220} [1 bytes data]221* TLSv1.3 (OUT), TLS handshake, Finished (20):222} [52 bytes data]223* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey224* ALPN: server accepted h2225* Server certificate:226* subject: CN=test.foo227* start date: Oct 13 00:32:43 2026 GMT228* expire date: Nov 12 00:32:43 2028 GMT229* issuer: CN=minica root ca 082e9b230* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384231* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384232* subjectAltName: "test.foo" matches cert's "test.foo"233* OpenSSL verify result: 13234* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)235* closing connection #0236curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)237More details here: https://curl.se/docs/sslcerts.html238239curl failed to verify the legitimacy of the server and therefore could not240establish a secure connection to it. To learn more about this situation and241how to fix it, please visit the webpage mentioned above.242+ curl -v https://test.foo243* Host test.foo:443 was resolved.244* IPv6: (none)245* IPv4: 192.168.1.3246* Trying 192.168.1.3:443...247* ALPN: curl offers h2,http/1.1248} [5 bytes data]249* TLSv1.3 (OUT), TLS handshake, Client hello (1):250} [1552 bytes data]251* SSL Trust Anchors:252* OpenSSL default paths (fallback)253{ [5 bytes data]254* TLSv1.3 (IN), TLS handshake, Server hello (2):255{ [1210 bytes data]256* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):257{ [1 bytes data]258* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):259{ [19 bytes data]260* TLSv1.3 (IN), TLS handshake, Certificate (11):261{ [930 bytes data]262* TLSv1.3 (IN), TLS handshake, CERT verify (15):263{ [79 bytes data]264* TLSv1.3 (IN), TLS handshake, Finished (20):265{ [52 bytes data]266* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):267} [1 bytes data]268* TLSv1.3 (OUT), TLS handshake, Finished (20):269} [52 bytes data]270* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey271* ALPN: server accepted h2272* Server certificate:273* subject: CN=test.foo274* start date: Oct 13 00:31:57 2026 GMT275* expire date: Jan 11 00:32:57 2027 GMT276* issuer: CN=Clan Intermediate CA277* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256278* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256279* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256280* subjectAltName: "test.foo" matches cert's "test.foo"281* OpenSSL verify result: 0282* SSL certificate verified via OpenSSL.283* Established connection to test.foo (192.168.1.3 port 443) from 192.168.1.2 port 39588 284 % Total % Received % Xferd Average Speed Time Time Time Current285 Dload Upload Total Spent Left Speed286 0 0 0 0 0 0 0 0 0* using HTTP/2287* [HTTP/2] [1] OPENED stream for https://test.foo/288* [HTTP/2] [1] [:method: GET]289* [HTTP/2] [1] [:scheme: https]290* [HTTP/2] [1] [:authority: test.foo]291* [HTTP/2] [1] [:path: /]292* [HTTP/2] [1] [user-agent: curl/8.22.0]293* [HTTP/2] [1] [accept: */*]294} [5 bytes data]295296297298299300* Request completely sent off301{ [5 bytes data]302* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):303{ [265 bytes data]304* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):305{ [265 bytes data]306307308309310311312313{ [5 bytes data]314100 20 100 20 0 0 667 0 0315* Connection #0 to host test.foo:443 left intact316(finished: waiting for success: curl -v https://test.foo, in 3.19 seconds)317+ openssl s_client -connect test.foo:443 -servername test.foo318+ openssl x509 -text -noout319Certificate:320 Data:321 Version: 3 (0x2)322 Serial Number:323 81:df:0d:d4:20:a2:c8:50:e6:05:b7:e5:6b:32:a9:f2324 Signature Algorithm: ecdsa-with-SHA256325 Issuer: CN=Clan Intermediate CA326 Validity327 Not Before: Oct 13 00:31:57 2026 GMT328 Not After : Jan 11 00:32:57 2027 GMT329 Subject: CN=test.foo330 Subject Public Key Info:331 Public Key Algorithm: id-ecPublicKey332 Public-Key: (256 bit)333 pub:334 04:58:de:65:88:f4:a4:ba:18:f7:3f:51:b2:92:46:335 01:e6:d9:f5:94:0f:d7:7b:f9:95:64:54:11:ed:8a:336 f9:9d:95:fe:f2:0d:0f:67:fc:1f:53:ad:f8:c0:66:337 98:fd:05:00:ec:e7:8e:a2:fc:c8:21:c9:f0:0d:53:338 7c:a9:4e:c6:d7339 ASN1 OID: prime256v1340 NIST CURVE: P-256341 X509v3 extensions:342 X509v3 Key Usage: critical343 Digital Signature344 X509v3 Extended Key Usage: 345 TLS Web Server Authentication, TLS Web Client Authentication346 X509v3 Subject Key Identifier: 347 13:00:81:4D:F0:A5:B3:44:FA:B3:C1:74:A8:36:94:66:8C:48:77:D1348 X509v3 Authority Key Identifier: 349 4A:14:2D:B9:3B:DA:1B:14:BA:07:FB:34:03:38:BE:1E:D7:85:AF:A6350 X509v3 Subject Alternative Name: 351 DNS:test.foo352 1.3.6.1.4.1.37476.9000.64.1: 353 0......acme..354 Signature Algorithm: ecdsa-with-SHA256355 Signature Value:356 30:45:02:20:6d:1f:ec:f7:33:26:11:6d:55:4c:f9:d6:02:7b:357 94:34:aa:ad:5c:01:6a:36:16:a5:cd:ae:da:a8:70:e8:76:91:358 02:21:00:fa:a7:a2:ec:e7:75:55:01:6e:6d:52:69:2a:d8:58:359 73:40:85:ae:e7:88:58:db:a0:3b:14:40:98:7a:d3:9e:91360361362