don't know how to build these paths: /nix/store/dkf37jw9l8j2g50vym9pxkmvc2fj1y4i-container-test-run-certificates.drv warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/syxh4mzywrpq2krcg9mcvd9w1w035swi-system-path.drv' on nix-store.geninf.io:50051 system-path> build01: building syxh4mzywrpq2krcg9mcvd9w1w035swi-system-path.drv system-path> structuredAttrs is enabled system-path> created 1716 symlinks in user environment building '/nix/store/2arp82rqiig2m19xnn17qg1rxyjii42k-unit-nix-daemon.service.drv' on nix-store.geninf.io:50051 unit-nix-daemon.service> build01: building 2arp82rqiig2m19xnn17qg1rxyjii42k-unit-nix-daemon.service.drv unit-nix-daemon.service> structuredAttrs is enabled building '/nix/store/qhvy7ywx9ifzvmfzfngpmxx4r2a5zd7i-system-path.drv' on nix-store.geninf.io:50051 system-path> build01: building qhvy7ywx9ifzvmfzfngpmxx4r2a5zd7i-system-path.drv system-path> structuredAttrs is enabled system-path> created 1716 symlinks in user environment building '/nix/store/8v7lnl1cgf8jjf4d736xcrwwaz1wxsfw-system-path.drv' on nix-store.geninf.io:50051 system-path> build01: building 8v7lnl1cgf8jjf4d736xcrwwaz1wxsfw-system-path.drv system-path> structuredAttrs is enabled system-path> created 1716 symlinks in user environment building '/nix/store/8pfxhz5ygf1wml8p827q8v4s8gb4kway-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build01: building 8pfxhz5ygf1wml8p827q8v4s8gb4kway-dbus-1.drv building '/nix/store/0nwr4jhz9qn234ym5j6rxrapmmk5lyzv-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build01: building 0nwr4jhz9qn234ym5j6rxrapmmk5lyzv-dbus-1.drv building '/nix/store/2qwhhz5s0p7i8qlzk7ns71zv5mga1lxx-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build01: building 2qwhhz5s0p7i8qlzk7ns71zv5mga1lxx-dbus-1.drv building '/nix/store/cjk940awwm7b2c4qhmgy2wa9nmvywqqk-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build01: building cjk940awwm7b2c4qhmgy2wa9nmvywqqk-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/mdllk5h21jk9g683ymyr2ak03kxbqhlc-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build01: building mdllk5h21jk9g683ymyr2ak03kxbqhlc-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/l66hv6fhja92vjx8vwq955a33lpkwiaa-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build01: building l66hv6fhja92vjx8vwq955a33lpkwiaa-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/q7fyqf2fv3qpdi6rxf5zaz190gnd5ax8-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building q7fyqf2fv3qpdi6rxf5zaz190gnd5ax8-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/zkp6d73yzgxjzc7qxh8900si48hh6lcn-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building zkp6d73yzgxjzc7qxh8900si48hh6lcn-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled 74qwdbnq2hcimg3z01pgcxcrzqfgiyh7-unit-dbus-broker.service.drv: build01: not scheduled here: 74qwdbnq2hcimg3z01pgcxcrzqfgiyh7-unit-dbus-broker.service.drv, asking the scheduler again z2pw3miqsh0qj0b13ib5w6j078ky5jk0-unit-dbus-broker.service.drv: build01: not scheduled here: z2pw3miqsh0qj0b13ib5w6j078ky5jk0-unit-dbus-broker.service.drv, asking the scheduler again ggjfah7w7m4qir50jlw3p5xhyngrqal5-unit-dbus-broker.service.drv: build01: not scheduled here: ggjfah7w7m4qir50jlw3p5xhyngrqal5-unit-dbus-broker.service.drv, asking the scheduler again building '/nix/store/74qwdbnq2hcimg3z01pgcxcrzqfgiyh7-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building 74qwdbnq2hcimg3z01pgcxcrzqfgiyh7-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled fb60iihzpwmpgsnzz8y1ygm6jnsfbhrc-unit-dbus-broker.service.drv: build01: not scheduled here: fb60iihzpwmpgsnzz8y1ygm6jnsfbhrc-unit-dbus-broker.service.drv, asking the scheduler again building '/nix/store/z2pw3miqsh0qj0b13ib5w6j078ky5jk0-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building z2pw3miqsh0qj0b13ib5w6j078ky5jk0-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/ggjfah7w7m4qir50jlw3p5xhyngrqal5-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building ggjfah7w7m4qir50jlw3p5xhyngrqal5-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/fb60iihzpwmpgsnzz8y1ygm6jnsfbhrc-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build01: building fb60iihzpwmpgsnzz8y1ygm6jnsfbhrc-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/88ndck8k9ind86rzz1zv4mfii5f55dxf-system-units.drv' on nix-store.geninf.io:50051 system-units> build01: building 88ndck8k9ind86rzz1zv4mfii5f55dxf-system-units.drv building '/nix/store/jzxrz96987b3lkyvp84djdfycm3nzsqy-user-units.drv' on nix-store.geninf.io:50051 user-units> build01: building jzxrz96987b3lkyvp84djdfycm3nzsqy-user-units.drv building '/nix/store/qnba93g02r8ff1hi967iklki7ha95siq-system-units.drv' on nix-store.geninf.io:50051 system-units> build01: building qnba93g02r8ff1hi967iklki7ha95siq-system-units.drv building '/nix/store/n9aqkr46iw5xylw84fm7hrqm4ph4r9ky-user-units.drv' on nix-store.geninf.io:50051 user-units> build01: building n9aqkr46iw5xylw84fm7hrqm4ph4r9ky-user-units.drv building '/nix/store/g9p7ln2abpw9hw8qpjv65l9lc1fh89k6-user-units.drv' on nix-store.geninf.io:50051 user-units> build01: building g9p7ln2abpw9hw8qpjv65l9lc1fh89k6-user-units.drv building '/nix/store/xgzq9a8gw1aywhjbp6l0014di1i591md-system-units.drv' on nix-store.geninf.io:50051 system-units> build01: building xgzq9a8gw1aywhjbp6l0014di1i591md-system-units.drv building '/nix/store/5x23aiysm2xmjix47k7v11rgxdl4x065-etc.drv' on nix-store.geninf.io:50051 etc> build01: building 5x23aiysm2xmjix47k7v11rgxdl4x065-etc.drv jyl323lbzvdggn08kxxjm42m8mlyk1fm-etc.drv: build01: not scheduled here: jyl323lbzvdggn08kxxjm42m8mlyk1fm-etc.drv, asking the scheduler again 91vlbksawpz7cbxagc7sw83f54wrl9x6-etc.drv: build01: not scheduled here: 91vlbksawpz7cbxagc7sw83f54wrl9x6-etc.drv, asking the scheduler again building '/nix/store/jyl323lbzvdggn08kxxjm42m8mlyk1fm-etc.drv' on nix-store.geninf.io:50051 etc> build01: building jyl323lbzvdggn08kxxjm42m8mlyk1fm-etc.drv building '/nix/store/3rcknj2c2rpwcz684zg6g4wa2qb9q3dz-activate.drv' on nix-store.geninf.io:50051 activate> build01: building 3rcknj2c2rpwcz684zg6g4wa2qb9q3dz-activate.drv activate> structuredAttrs is enabled building '/nix/store/91vlbksawpz7cbxagc7sw83f54wrl9x6-etc.drv' on nix-store.geninf.io:50051 etc> build01: building 91vlbksawpz7cbxagc7sw83f54wrl9x6-etc.drv 1q301ig97ygxn8hk37qn6dlzilnfqsi8-activate.drv: build01: not scheduled here: 1q301ig97ygxn8hk37qn6dlzilnfqsi8-activate.drv, asking the scheduler again building '/nix/store/1q301ig97ygxn8hk37qn6dlzilnfqsi8-activate.drv' on nix-store.geninf.io:50051 activate> build01: building 1q301ig97ygxn8hk37qn6dlzilnfqsi8-activate.drv activate> structuredAttrs is enabled as9d93i35pv7k0shdi5nn5g41yxfszsv-activate.drv: build01: not scheduled here: as9d93i35pv7k0shdi5nn5g41yxfszsv-activate.drv, asking the scheduler again nxynswcia9gnhlcyjl18ia6arbjjaj09-nixos-system-server-test.drv: build01: not scheduled here: nxynswcia9gnhlcyjl18ia6arbjjaj09-nixos-system-server-test.drv, asking the scheduler again building '/nix/store/as9d93i35pv7k0shdi5nn5g41yxfszsv-activate.drv' on nix-store.geninf.io:50051 activate> build01: building as9d93i35pv7k0shdi5nn5g41yxfszsv-activate.drv activate> structuredAttrs is enabled building '/nix/store/nxynswcia9gnhlcyjl18ia6arbjjaj09-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> build01: building nxynswcia9gnhlcyjl18ia6arbjjaj09-nixos-system-server-test.drv nixos-system-server-test> structuredAttrs is enabled building '/nix/store/yygxn8di8fnyhyna4ygga2ym2kahxrvf-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> build01: building yygxn8di8fnyhyna4ygga2ym2kahxrvf-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/79aiq07gjhsvyj5l4c79mqc0jrmhypdx-nixos-system-client-test.drv' on nix-store.geninf.io:50051 nixos-system-client-test> build01: building 79aiq07gjhsvyj5l4c79mqc0jrmhypdx-nixos-system-client-test.drv nixos-system-client-test> structuredAttrs is enabled building '/nix/store/ms36wval394dj7fi7z1ffn5dx5zzhpjl-run-server-nspawn.drv' on nix-store.geninf.io:50051 run-server-nspawn> build01: building ms36wval394dj7fi7z1ffn5dx5zzhpjl-run-server-nspawn.drv building '/nix/store/j2qf4nzbbzw2avd8cbxkwyy96z26qjx0-run-ca-nspawn.drv' on nix-store.geninf.io:50051 run-ca-nspawn> build01: building j2qf4nzbbzw2avd8cbxkwyy96z26qjx0-run-ca-nspawn.drv building '/nix/store/qjizmc15r5q2jx4lss8qvnijj2lc5vxp-run-client-nspawn.drv' on nix-store.geninf.io:50051 run-client-nspawn> build01: building qjizmc15r5q2jx4lss8qvnijj2lc5vxp-run-client-nspawn.drv building '/nix/store/0gf06xxbi1v9i50f1789x9lfldk2p3gb-driverConfiguration.json.drv' on nix-store.geninf.io:50051 driverConfiguration.json> build01: building 0gf06xxbi1v9i50f1789x9lfldk2p3gb-driverConfiguration.json.drv driverConfiguration.json> structuredAttrs is enabled building '/nix/store/cqh4d4zgdaqnl3llyfsv6yb43nkbms58-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> build01: building cqh4d4zgdaqnl3llyfsv6yb43nkbms58-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/dkf37jw9l8j2g50vym9pxkmvc2fj1y4i-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build01: building dkf37jw9l8j2g50vym9pxkmvc2fj1y4i-container-test-run-certificates.drv container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # No journal files were found. container-test-run-certificates> ca # No journal boot entry found for the specified boot (+0). container-test-run-certificates> ca # [361980.231097] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [361980.231155] ca systemd-journald[81]: Runtime Journal (/run/log/journal/d7a6a86e33a64fd5a5326281b2255b32) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> ca # [361980.234573] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [361980.246413] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [361980.259584] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [361980.260381] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [361980.261025] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [361980.270811] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/d7a6a86e33a64fd5a5326281b2255b32 is 3.166ms for 7 entries. container-test-run-certificates> ca # [361980.270811] ca systemd-journald[81]: System Journal (/var/log/journal/d7a6a86e33a64fd5a5326281b2255b32) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [361980.279168] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [361980.279683] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [361980.279794] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [361980.280630] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [361980.280673] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [361980.281458] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [361980.281492] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [361980.403345] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [361980.403588] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [361980.404173] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [361980.404458] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [361980.405541] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [361980.406362] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [361980.463339] ca systemd-tmpfiles[191]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [361980.463577] ca systemd-tmpfiles[191]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [361980.463738] ca systemd-tmpfiles[191]: fchmod() of /var/log/journal/d7a6a86e33a64fd5a5326281b2255b32 failed: Operation not permitted container-test-run-certificates> ca # [361980.463979] ca systemd-tmpfiles[191]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [361980.465583] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [361980.466920] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [361980.467927] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [361980.485387] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [361980.492383] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [361980.494068] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [361980.507066] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [361981.103326] ca systemd-networkd[190]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [361981.103424] ca systemd-networkd[190]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [361981.113029] ca systemd-networkd[190]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [361981.113192] ca systemd-networkd[190]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [361981.113339] ca systemd-networkd[190]: lo: Link UP container-test-run-certificates> ca # [361981.113344] ca systemd-networkd[190]: lo: Gained carrier container-test-run-certificates> ca # [361981.113511] ca systemd-networkd[190]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [361981.113973] ca systemd-networkd[190]: eth1: Link UP container-test-run-certificates> ca # [361981.114295] ca systemd-networkd[190]: eth1: Gained carrier container-test-run-certificates> ca # [361981.114666] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [361981.115788] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [361981.161808] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [361981.396391] ca systemd-resolved[113]: Positive Trust Anchors: container-test-run-certificates> ca # [361981.396405] ca systemd-resolved[113]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [361981.396408] ca systemd-resolved[113]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [361981.396441] ca systemd-resolved[113]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [361981.416817] ca systemd-resolved[113]: Using system hostname 'ca'. container-test-run-certificates> ca # [361981.418071] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [361981.418141] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [361981.418194] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [361981.418233] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [361981.428990] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [361981.429025] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [361981.429052] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [361981.429073] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [361981.429221] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [361981.429323] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [361981.429432] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [361981.429451] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [361981.429490] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [361981.430760] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [361981.431617] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [361981.431656] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [361981.432457] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [361981.433354] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [361981.434642] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [361981.519160] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [361981.573442] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [361981.575109] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [361981.638809] ca acme-setup-privileged[203]: + set -euo pipefail container-test-run-certificates> ca # [361981.638809] ca acme-setup-privileged[203]: + cd /var/lib/acme container-test-run-certificates> ca # [361981.638809] ca acme-setup-privileged[203]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [361981.640573] ca acme-setup-privileged[203]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [361981.642802] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [361981.642802] ca acme-setup-privileged[203]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [361981.642930] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [361981.642930] ca acme-setup-privileged[203]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [361981.652775] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [361981.652869] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [361981.653002] ca nsncd[205]: Oct 13 15:38:04.610 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [361981.652923] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [361981.654979] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [361981.656335] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [361981.704369] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [361981.706057] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [361981.706135] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [361981.706176] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [361981.832836] ca dbus-broker-launch[207]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [361981.834435] ca dbus-broker-launch[207]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [361981.834435] ca dbus-broker-launch[207]: Invalid user-name in /nix/store/vpm8rz7sg2zmsi366n531qm4z52ip24w-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [361981.834994] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [361981.843516] ca dbus-broker-launch[207]: Ready container-test-run-certificates> ca # [361982.268162] ca systemd-networkd[190]: eth1: Gained IPv6LL container-test-run-certificates> ca # [361982.477986] ca systemd-logind[233]: New seat seat0. container-test-run-certificates> ca # [361982.478192] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [361982.480228] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [361982.530563] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [361982.530875] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [361982.546901] ca acme-setup-start[222]: + set -euo pipefail container-test-run-certificates> ca # [361982.546901] ca acme-setup-start[222]: + test -e ca/key.pem container-test-run-certificates> ca # [361982.547379] ca acme-setup-start[222]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [361982.569973] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [361982.571653] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [361982.873709] ca step-ca[206]: badger 2026/10/13 15:38:05 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [361982.908906] ca step-ca[206]: 2026/10/13 15:38:05 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [361982.915372] ca step-ca[206]: 2026/10/13 15:38:05 Starting Smallstep CA/0.30.2 (linux/arm64) container-test-run-certificates> ca # [361982.915372] ca step-ca[206]: 2026/10/13 15:38:05 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [361982.915372] ca step-ca[206]: 2026/10/13 15:38:05 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [361982.915372] ca step-ca[206]: 2026/10/13 15:38:05 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [361982.915372] ca step-ca[206]: 2026/10/13 15:38:05 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [361982.915372] ca step-ca[206]: 2026/10/13 15:38:05 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [361982.915372] ca step-ca[206]: 2026/10/13 15:38:05 X.509 Root Fingerprint: 137d8173c35112c0105e02d18918e70953da0eedb7ead14cdca50a680b599c66 container-test-run-certificates> ca # [361982.916086] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [361982.916454] ca step-ca[206]: 2026/10/13 15:38:05 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [361983.413651] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [361983.417130] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [361983.417224] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [361983.433309] ca acme-ca.foo-start[296]: + cd ca.foo container-test-run-certificates> ca # [361983.433923] ca acme-ca.foo-start[296]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [361983.435043] ca acme-ca.foo-start[297]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [361983.435378] ca acme-ca.foo-start[296]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [361983.436609] ca acme-ca.foo-start[296]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [361983.436838] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [361983.438519] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [361983.440555] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [361983.442205] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [361983.442205] ca acme-ca.foo-start[259]: + '[' -d out ']' container-test-run-certificates> ca # [361983.442205] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [361983.444042] ca acme-ca.foo-start[259]: + chown -R acme:nginx out container-test-run-certificates> ca # [361983.448254] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [361983.448254] ca acme-ca.foo-start[259]: + '[' -d certificates ']' container-test-run-certificates> ca # [361983.453043] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [361983.455764] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [361984.335695] ca nginx-pre-start[308]: nginx: the configuration file /nix/store/c95c0r61f8c2340m1hbq85gjw9mhn5vh-nginx.conf syntax is ok container-test-run-certificates> ca # [361984.336166] ca nginx-pre-start[308]: nginx: configuration file /nix/store/c95c0r61f8c2340m1hbq85gjw9mhn5vh-nginx.conf test is successful container-test-run-certificates> ca # [361984.342610] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [361984.343082] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [361984.344613] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [361985.225659] ca acme-order-renew-ca.foo-start[311]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [361985.229044] ca acme-order-renew-ca.foo-start[311]: + set -euo pipefail container-test-run-certificates> ca # [361985.229194] ca acme-order-renew-ca.foo-start[311]: + exec container-test-run-certificates> ca # [361985.229278] ca acme-order-renew-ca.foo-start[311]: + /nix/store/vf2h24m5aa7phb4v1kbc2qd9r41jdfqv-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [361985.230814] ca acme-order-renew-ca.foo-start[323]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [361985.234066] ca acme-order-renew-ca.foo-start[311]: + '[' -n '' ']' container-test-run-certificates> ca # [361985.234149] ca acme-order-renew-ca.foo-start[311]: + exec container-test-run-certificates> ca # [361985.234199] ca acme-order-renew-ca.foo-start[311]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [361985.234199] ca acme-order-renew-ca.foo-start[311]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [361985.264250] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.221825778Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [361985.298154] ca step-ca[206]: time="2026-10-13T15:38:08Z" level=info duration="227.604µs" duration-ns=227604 fields.time="2026-10-13T15:38:08Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=8cc3d879-6fa3-47db-843f-5697ea0377fb response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361985.298860] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.256451935Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [361985.457487] ca step-ca[206]: time="2026-10-13T15:38:08Z" level=info duration=158.278824ms duration-ns=158278824 fields.time="2026-10-13T15:38:08Z" method=HEAD name=ca nonce=R0M5aGtFVDNpYUR6dHRib1VCckd4cnV1Y1lFa1l2NXA path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c384d564-d9a4-4bdb-b609-f025469e5c65 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361985.475462] ca step-ca[206]: time="2026-10-13T15:38:08Z" level=info duration=16.72463ms duration-ns=16724630 fields.time="2026-10-13T15:38:08Z" method=POST name=ca nonce=Y3ZPYmVwbXNpT2V1d1J1dUdyOGVVT1dXTnRlbHJZWDk path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=4923f07c-3974-4866-b4b2-cc9faa2d9062 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/AxqTChOPLQFkOWq4yIPimmaOOmQcTIDQ/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361985.476187] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.433743422Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [361985.476187] ca acme-order-renew-ca.foo-start[324]: Your account credentials have been saved in your container-test-run-certificates> ca # [361985.476187] ca acme-order-renew-ca.foo-start[324]: configuration directory at "accounts". container-test-run-certificates> ca # [361985.476187] ca acme-order-renew-ca.foo-start[324]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [361985.476187] ca acme-order-renew-ca.foo-start[324]: configuration directory will also contain private keys container-test-run-certificates> ca # [361985.476187] ca acme-order-renew-ca.foo-start[324]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [361985.476187] ca acme-order-renew-ca.foo-start[324]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [361985.476535] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.434012585Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [361985.483399] ca step-ca[206]: time="2026-10-13T15:38:08Z" level=info duration=6.128565ms duration-ns=6128565 fields.time="2026-10-13T15:38:08Z" method=POST name=ca nonce=YmlPdngzQkZBa0JxaUN0NVNodUxDRUJudEZxcXVTVFQ path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=8fae785d-c120-4841-a357-7573a4847cb3 response="{\"id\":\"Y5TIwSP3hmjq5a4MtHswVYkgXHgqx0U2\",\"status\":\"pending\",\"expires\":\"2026-10-14T15:38:08Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-13T15:37:08Z\",\"notAfter\":\"2027-01-11T15:38:08Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/5bbVLOiB0jrkCCKzoWzgIfzr1MZqejre\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/Y5TIwSP3hmjq5a4MtHswVYkgXHgqx0U2/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361985.548857] ca step-ca[206]: time="2026-10-13T15:38:08Z" level=info duration=8.127593ms duration-ns=8127593 fields.time="2026-10-13T15:38:08Z" method=POST name=ca nonce=eGMwajdMVnBvVGR0MEFYRHVuMXN2OXhkQXhaS2llTm8 path=/acme/acme/authz/5bbVLOiB0jrkCCKzoWzgIfzr1MZqejre protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f0dc0439-bf96-4bfe-8471-d11d408d5770 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"sjckVHGCLw6Cqt3ucFD0dBkukLNvcbbJ\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/5bbVLOiB0jrkCCKzoWzgIfzr1MZqejre/C7mkgC1VJhcNsB0RGUHCTgEDEfGofB5o\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"sjckVHGCLw6Cqt3ucFD0dBkukLNvcbbJ\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/5bbVLOiB0jrkCCKzoWzgIfzr1MZqejre/9mpPjDcy1xe62TGPmZYriYqSyikTsOEq\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"sjckVHGCLw6Cqt3ucFD0dBkukLNvcbbJ\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/5bbVLOiB0jrkCCKzoWzgIfzr1MZqejre/OMolObZxx3HHt4qkPdedujKHERWrfRmV\"}],\"wildcard\":false,\"expires\":\"2026-10-14T15:38:08Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361985.549492] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.507086193Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [361985.549566] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.507142434Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [361985.558036] ca step-ca[206]: time="2026-10-13T15:38:08Z" level=info duration=7.577504ms duration-ns=7577504 fields.time="2026-10-13T15:38:08Z" method=POST name=ca nonce=OHRIYnk2cTJYVHNvWExYWjdoN3ZxNGNLQXB5amhVbEg path=/acme/acme/challenge/5bbVLOiB0jrkCCKzoWzgIfzr1MZqejre/9mpPjDcy1xe62TGPmZYriYqSyikTsOEq protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=d2179107-55f8-463c-9524-9dc1240a4cd0 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"sjckVHGCLw6Cqt3ucFD0dBkukLNvcbbJ\",\"validated\":\"2026-10-13T15:38:08Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/5bbVLOiB0jrkCCKzoWzgIfzr1MZqejre/9mpPjDcy1xe62TGPmZYriYqSyikTsOEq\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361985.558487] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.516089838Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [361985.558600] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.516216759Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [361985.571872] ca step-ca[206]: time="2026-10-13T15:38:08Z" level=info duration=11.517559ms duration-ns=11517559 fields.time="2026-10-13T15:38:08Z" method=POST name=ca nonce=bDZack95clp6emhvUE5GaDU3ZjRZZE9UQ29TUFc2N3k path=/acme/acme/order/Y5TIwSP3hmjq5a4MtHswVYkgXHgqx0U2/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=283c0167-0ed4-4fc1-a246-229915881249 response="{\"id\":\"Y5TIwSP3hmjq5a4MtHswVYkgXHgqx0U2\",\"status\":\"valid\",\"expires\":\"2026-10-14T15:38:08Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-13T15:37:08Z\",\"notAfter\":\"2027-01-11T15:38:08Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/5bbVLOiB0jrkCCKzoWzgIfzr1MZqejre\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/Y5TIwSP3hmjq5a4MtHswVYkgXHgqx0U2/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/ZeCfLdFQ5KDLGyprxhUeCSjFil2TbhSr\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361985.574972] ca step-ca[206]: time="2026-10-13T15:38:08Z" level=info certificate=MIIB0zCCAXmgAwIBAgIQZeELAGE9NmAaW1BzJ75UpzAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjEwMTMxNTM3MDhaFw0yNzAxMTExNTM4MDhaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAvAiFhCvkpdVDEJDkvw+RDiqLhkJrnBxJXO3/hnG4QRl9X2x8RuL2IJNkKHW4M9/xrLWSmRxW0NUlFnM63vlECjgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU7oFaucwUQXX1YMBK7Om5IV0+N2AwHwYDVR0jBBgwFoAUc93V/HLvYrvsZZPFzc0FVbk0XMYwEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNIADBFAiEAwievG3e0ovaDfrZ78BAjTcTgjjNC/TDwejeJ5V/pOLICIHBHwTANv9vifq35WCfkgeJpsMl5TIbRVktycgcN9/qD duration=2.19955ms duration-ns=2199550 fields.time="2026-10-13T15:38:08Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=RVhEQ2F6UzRvUjRDTzA1dFlsWmxpVklTYWdZa3ZnWGI path=/acme/acme/certificate/ZeCfLdFQ5KDLGyprxhUeCSjFil2TbhSr protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=7f379c67-55b9-4a60-af9f-0eab10685c77 sans="map[dns:[ca.foo]]" serial=135420517504046526756322208388457845927 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= valid-from="2026-10-13T15:37:08Z" valid-to="2027-01-11T15:38:08Z" container-test-run-certificates> ca # [361985.575243] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.532851909Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [361985.575311] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.532939070Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [361985.575445] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.533065432Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [361985.575502] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.533129473Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [361985.575618] ca acme-order-renew-ca.foo-start[324]: 2026-10-13T15:38:08.533238514Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [361985.580974] ca acme-order-renew-ca.foo-start[311]: + touch out/acme-success container-test-run-certificates> ca # [361985.583088] ca acme-order-renew-ca.foo-start[311]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [361985.585013] ca acme-order-renew-ca.foo-start[311]: + touch out/renewed container-test-run-certificates> ca # [361985.587103] ca acme-order-renew-ca.foo-start[311]: + echo Installing new certificate container-test-run-certificates> ca # [361985.587103] ca acme-order-renew-ca.foo-start[311]: Installing new certificate container-test-run-certificates> ca # [361985.587103] ca acme-order-renew-ca.foo-start[311]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [361985.589208] ca acme-order-renew-ca.foo-start[354]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [361985.589571] ca acme-order-renew-ca.foo-start[311]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [361985.591303] ca acme-order-renew-ca.foo-start[355]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [361985.591603] ca acme-order-renew-ca.foo-start[311]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [361985.593511] ca acme-order-renew-ca.foo-start[356]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [361985.593812] ca acme-order-renew-ca.foo-start[311]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [361985.595646] ca acme-order-renew-ca.foo-start[311]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [361985.597885] ca acme-order-renew-ca.foo-start[311]: + for fixpath in out certificates container-test-run-certificates> ca # [361985.597885] ca acme-order-renew-ca.foo-start[311]: + '[' -d out ']' container-test-run-certificates> ca # [361985.597983] ca acme-order-renew-ca.foo-start[311]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [361985.599635] ca acme-order-renew-ca.foo-start[311]: + chown -R acme:nginx out container-test-run-certificates> ca # [361985.602687] ca acme-order-renew-ca.foo-start[311]: + for fixpath in out certificates container-test-run-certificates> ca # [361985.602687] ca acme-order-renew-ca.foo-start[311]: + '[' -d certificates ']' container-test-run-certificates> ca # [361985.602803] ca acme-order-renew-ca.foo-start[311]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [361985.604618] ca acme-order-renew-ca.foo-start[311]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [361985.608387] ca acme-order-renew-ca.foo-start[311]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [361985.795803] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [361985.800510] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [361985.800763] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [361985.801006] ca systemd[1]: acme-order-renew-ca.foo.service: Consumed 1.130s CPU time over 1.455s wall clock time. container-test-run-certificates> ca # [361986.668142] ca nginx[372]: nginx: the configuration file /nix/store/c95c0r61f8c2340m1hbq85gjw9mhn5vh-nginx.conf syntax is ok container-test-run-certificates> ca # [361986.668683] ca nginx[372]: nginx: configuration file /nix/store/c95c0r61f8c2340m1hbq85gjw9mhn5vh-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 8.66 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.01 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [361987.567588] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [361987.568099] ca systemd[1]: Startup finished in 7.848s. container-test-run-certificates> ca # [361987.883285] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [361987.967476] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [361987.967782] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [361987.967819] ca systemd[1]: nginx.service: Consumed 3.379s CPU time over 4.511s wall clock time. container-test-run-certificates> ca # [361987.973103] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 1.02 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 466) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 469) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ca # [361988.876399] ca nginx-pre-start[396]: nginx: the configuration file /nix/store/c95c0r61f8c2340m1hbq85gjw9mhn5vh-nginx.conf syntax is ok container-test-run-certificates> ca # [361988.876940] ca nginx-pre-start[396]: nginx: configuration file /nix/store/c95c0r61f8c2340m1hbq85gjw9mhn5vh-nginx.conf test is successful container-test-run-certificates> ca # [361988.882924] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # No journal files were found. container-test-run-certificates> server # No journal boot entry found for the specified boot (+0). container-test-run-certificates> client # No journal files were found. container-test-run-certificates> client # No journal boot entry found for the specified boot (+0). container-test-run-certificates> server # [361990.229110] server systemd-journald[72]: Journal started container-test-run-certificates> server # [361990.229171] server systemd-journald[72]: Runtime Journal (/run/log/journal/aaf1bf087ddf483b91d46836a14bd55a) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> server # [361990.241514] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [361990.255289] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [361990.271732] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [361990.272567] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [361990.273248] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [361990.326767] server systemd-journald[72]: Time spent on flushing to /var/log/journal/aaf1bf087ddf483b91d46836a14bd55a is 2.050ms for 7 entries. container-test-run-certificates> server # [361990.326767] server systemd-journald[72]: System Journal (/var/log/journal/aaf1bf087ddf483b91d46836a14bd55a) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [361990.349745] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [361990.350351] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [361990.350476] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [361990.351305] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [361990.351353] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [361990.352355] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [361990.352384] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [361990.407870] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [361990.408105] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [361990.408510] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [361990.410102] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [361990.411771] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [361990.413624] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [361990.434887] server systemd-tmpfiles[182]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [361990.435162] server systemd-tmpfiles[182]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [361990.435352] server systemd-tmpfiles[182]: fchmod() of /var/log/journal/aaf1bf087ddf483b91d46836a14bd55a failed: Operation not permitted container-test-run-certificates> server # [361990.435634] server systemd-tmpfiles[182]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [361990.437944] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [361990.439622] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [361990.440850] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [361990.457277] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [361990.464147] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [361990.465800] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [361990.477041] server systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [361990.239310] client systemd-journald[72]: Journal started container-test-run-certificates> client # [361990.239369] client systemd-journald[72]: Runtime Journal (/run/log/journal/0e9da2cc80cf4583bcb42dbf83f31c4a) is 8M, max 2.5G, 2.4G free. container-test-run-certificates> client # [361990.244490] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [361990.257154] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [361990.271782] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [361990.272795] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [361990.273431] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [361990.326882] client systemd-journald[72]: Time spent on flushing to /var/log/journal/0e9da2cc80cf4583bcb42dbf83f31c4a is 3.786ms for 7 entries. container-test-run-certificates> client # [361990.326882] client systemd-journald[72]: System Journal (/var/log/journal/0e9da2cc80cf4583bcb42dbf83f31c4a) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [361990.349782] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [361990.350367] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [361990.350471] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [361990.351305] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [361990.351356] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [361990.352370] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [361990.352404] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [361990.408401] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [361990.408967] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [361990.409256] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [361990.410361] client systemd[1]: Starting Network Management... container-test-run-certificates> client # [361990.411972] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [361990.413500] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [361990.432380] client systemd-tmpfiles[178]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [361990.432622] client systemd-tmpfiles[178]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [361990.432791] client systemd-tmpfiles[178]: fchmod() of /var/log/journal/0e9da2cc80cf4583bcb42dbf83f31c4a failed: Operation not permitted container-test-run-certificates> client # [361990.433115] client systemd-tmpfiles[178]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [361990.434537] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [361990.435822] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [361990.436915] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [361990.450248] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [361990.460277] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [361990.461343] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [361990.473232] client systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [361990.934898] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [361991.100708] server systemd-networkd[180]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [361991.100798] server systemd-networkd[180]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [361991.110329] server systemd-networkd[180]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [361991.110498] server systemd-networkd[180]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [361991.110637] server systemd-networkd[180]: lo: Link UP container-test-run-certificates> server # [361991.110645] server systemd-networkd[180]: lo: Gained carrier container-test-run-certificates> server # [361991.110814] server systemd-networkd[180]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [361991.111227] server systemd[1]: Started Network Management. container-test-run-certificates> server # [361991.148258] server systemd-networkd[180]: eth1: Link UP container-test-run-certificates> server # [361991.148564] server systemd-networkd[180]: eth1: Gained carrier container-test-run-certificates> server # [361991.148671] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [361991.178768] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [361991.240810] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [361990.935575] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [361991.087637] client systemd-networkd[176]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [361991.087727] client systemd-networkd[176]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [361991.097380] client systemd-networkd[176]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [361991.097547] client systemd-networkd[176]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [361991.097686] client systemd-networkd[176]: lo: Link UP container-test-run-certificates> client # [361991.097691] client systemd-networkd[176]: lo: Gained carrier container-test-run-certificates> client # [361991.097861] client systemd-networkd[176]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [361991.098276] client systemd[1]: Started Network Management. container-test-run-certificates> client # [361991.098349] client systemd-networkd[176]: eth1: Link UP container-test-run-certificates> client # [361991.098664] client systemd-networkd[176]: eth1: Gained carrier container-test-run-certificates> client # [361991.100208] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [361991.157560] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [361991.251043] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [361991.511453] client systemd-resolved[107]: Positive Trust Anchors: container-test-run-certificates> client # [361991.511463] client systemd-resolved[107]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [361991.511466] client systemd-resolved[107]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [361991.511500] client systemd-resolved[107]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [361991.531349] client systemd-resolved[107]: Using system hostname 'client'. container-test-run-certificates> client # [361991.532641] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [361991.532767] client systemd[1]: Reached target Network. container-test-run-certificates> client # [361991.532885] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [361991.532978] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [361991.533030] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [361991.533066] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [361991.533280] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [361991.533494] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [361991.533716] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [361991.533765] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [361991.533835] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [361991.568738] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [361991.570431] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [361991.572672] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [361991.594858] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [361991.765944] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [361991.766017] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [361991.766091] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [361991.766422] client nsncd[192]: Oct 13 15:38:14.723 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [361991.496990] server systemd-resolved[111]: Positive Trust Anchors: container-test-run-certificates> server # [361991.497000] server systemd-resolved[111]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [361991.497005] server systemd-resolved[111]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [361991.497039] server systemd-resolved[111]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [361991.517609] server systemd-resolved[111]: Using system hostname 'server'. container-test-run-certificates> server # [361991.518946] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [361991.519074] server systemd[1]: Reached target Network. container-test-run-certificates> server # [361991.519183] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [361991.519269] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [361991.519673] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [361991.519724] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [361991.519772] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [361991.519816] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [361991.520074] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [361991.520284] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [361991.520513] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [361991.520561] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [361991.520640] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [361991.522806] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [361991.524218] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [361991.524285] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [361991.525688] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [361991.527853] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [361991.586061] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [361991.734376] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [361991.734376] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [361991.734376] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [361991.736225] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [361991.738296] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [361991.738296] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [361991.738421] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [361991.738421] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [361991.777358] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [361991.777470] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [361991.777566] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [361991.777868] server nsncd[197]: Oct 13 15:38:14.735 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [361991.784492] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [361991.785804] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [361991.797392] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [361991.799126] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [361991.799203] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [361991.799244] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [361991.961482] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [361991.962546] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [361991.962546] server dbus-broker-launch[198]: Invalid user-name in /nix/store/c8f3qz6w6svymqwchhh7z3pl33x9a7hi-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [361991.963052] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [361991.971896] server dbus-broker-launch[198]: Ready container-test-run-certificates> client # [361991.784406] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [361991.785519] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [361991.797695] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [361991.799393] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [361991.799465] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [361991.799510] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [361991.929968] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [361991.930914] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [361991.930914] client dbus-broker-launch[193]: Invalid user-name in /nix/store/qqw8mnm6ad1za3jrf45wymr9cl9qg4kx-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [361991.931433] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [361991.939867] client dbus-broker-launch[193]: Ready container-test-run-certificates> client # [361992.156175] client systemd-networkd[176]: eth1: Gained IPv6LL container-test-run-certificates> server # [361992.596081] server systemd-logind[222]: New seat seat0. container-test-run-certificates> server # [361992.596260] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [361992.612864] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [361992.627632] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [361992.627891] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [361992.666986] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [361992.666986] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [361992.667430] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [361992.690379] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [361992.692991] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> client # [361992.571714] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [361992.571894] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [361992.573977] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [361992.623445] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [361992.623718] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [361992.624668] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [361992.624985] client systemd[1]: Startup finished in 3.218s. container-test-run-certificates> server # [361993.052265] server systemd-networkd[180]: eth1: Gained IPv6LL container-test-run-certificates> server # [361993.543994] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [361993.547276] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [361993.547276] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [361993.563225] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [361993.564152] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [361993.564886] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [361993.565300] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [361993.566466] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [361993.566714] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [361993.568323] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [361993.570248] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [361993.572573] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [361993.572573] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [361993.572696] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [361993.574464] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [361993.578580] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [361993.578580] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [361993.583552] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [361993.586029] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [361994.443497] server nginx-pre-start[270]: nginx: the configuration file /nix/store/m0mx0dyvazvzhw8b23hfjcf1l4lh5wns-nginx.conf syntax is ok container-test-run-certificates> server # [361994.444145] server nginx-pre-start[270]: nginx: configuration file /nix/store/m0mx0dyvazvzhw8b23hfjcf1l4lh5wns-nginx.conf test is successful container-test-run-certificates> server # [361994.452500] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [361994.453251] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [361994.455600] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> ca # [361995.450442] ca step-ca[206]: time="2026-10-13T15:38:18Z" level=info duration="59.721µs" duration-ns=59721 fields.time="2026-10-13T15:38:18Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=62805ee8-5f32-425d-903a-2396e7bbb234 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361995.764518] ca step-ca[206]: time="2026-10-13T15:38:18Z" level=info duration=309.714273ms duration-ns=309714273 fields.time="2026-10-13T15:38:18Z" method=HEAD name=ca nonce=SVAxWmdQNlVBY2w4UVZpbGdFc1d0OVVvaVVtZm9xT0s path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=12ec622f-62cd-418d-80dc-82b1ae7e2d54 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> server # [361995.376104] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [361995.379445] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [361995.379584] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [361995.379641] server acme-order-renew-test.foo-start[273]: + /nix/store/vf2h24m5aa7phb4v1kbc2qd9r41jdfqv-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [361995.381557] server acme-order-renew-test.foo-start[285]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [361995.384708] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [361995.384792] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [361995.384842] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [361995.384842] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [361995.409154] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.366731073Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [361995.451219] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.408806893Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [361995.840842] ca step-ca[206]: time="2026-10-13T15:38:18Z" level=info duration=71.645548ms duration-ns=71645548 fields.time="2026-10-13T15:38:18Z" method=POST name=ca nonce=YXRHWFpEcE9YeWc3ZHdOd2ZXeTUydHBNTzVtZ1dNaHU path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=7c6b6b49-c0d7-4a54-afa6-c61a948bc3e8 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/rFQhq0mJXdFts3rsVfMRikLbJA0btwPZ/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361995.854298] ca step-ca[206]: time="2026-10-13T15:38:18Z" level=info duration=8.040151ms duration-ns=8040151 fields.time="2026-10-13T15:38:18Z" method=POST name=ca nonce=b0Q4NXNNWnJadGYxMWpSYmVtQUIzS1d0M3ZrR0J1N3g path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=023a3418-ae74-45b3-834f-2fc689df5257 response="{\"id\":\"bvVVyBvEHKS7UW9A9KNcGbHI1FOS4eJ5\",\"status\":\"pending\",\"expires\":\"2026-10-14T15:38:18Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-13T15:37:18Z\",\"notAfter\":\"2027-01-11T15:38:18Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/ZRvHjafaTms75pVxkuX15buFj2IG4gaf\"],\"finalize\":\"https://ca.foo/acme/acme/order/bvVVyBvEHKS7UW9A9KNcGbHI1FOS4eJ5/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361995.928159] ca step-ca[206]: time="2026-10-13T15:38:18Z" level=info duration=12.817057ms duration-ns=12817057 fields.time="2026-10-13T15:38:18Z" method=POST name=ca nonce=Z3U2ZlVESURJSTRxZVpwcWVEOEU3S3J3NE5OVDVwcHY path=/acme/acme/authz/ZRvHjafaTms75pVxkuX15buFj2IG4gaf protocol=HTTP/1.1 referer= remote-address="::1" request-id=ffd42fda-f0a4-40e7-81a3-c94acc951fb7 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"rg9Nk6rAlYtLazNCP8zstwXMGHKQhNpE\",\"url\":\"https://ca.foo/acme/acme/challenge/ZRvHjafaTms75pVxkuX15buFj2IG4gaf/Q3zhQOIeZfpGMXODJDMi84Sxe1pn1430\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"rg9Nk6rAlYtLazNCP8zstwXMGHKQhNpE\",\"url\":\"https://ca.foo/acme/acme/challenge/ZRvHjafaTms75pVxkuX15buFj2IG4gaf/iYIIoi28SrKEMugssNYbS26cw4FzTLsH\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"rg9Nk6rAlYtLazNCP8zstwXMGHKQhNpE\",\"url\":\"https://ca.foo/acme/acme/challenge/ZRvHjafaTms75pVxkuX15buFj2IG4gaf/4PjtRkrujqeA5KRT7N58Xn7SO9UmaZ5N\"}],\"wildcard\":false,\"expires\":\"2026-10-14T15:38:18Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361995.940794] ca step-ca[206]: time="2026-10-13T15:38:18Z" level=info duration=7.579945ms duration-ns=7579945 fields.time="2026-10-13T15:38:18Z" method=POST name=ca nonce=U0w0UXNHYkxkbVg5QWIzN1M3Y1RneGJSSVhSVkNTSWE path=/acme/acme/challenge/ZRvHjafaTms75pVxkuX15buFj2IG4gaf/iYIIoi28SrKEMugssNYbS26cw4FzTLsH protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=a3624073-6030-4083-bbb8-3a3cc6fe9776 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"rg9Nk6rAlYtLazNCP8zstwXMGHKQhNpE\",\"validated\":\"2026-10-13T15:38:18Z\",\"url\":\"https://ca.foo/acme/acme/challenge/ZRvHjafaTms75pVxkuX15buFj2IG4gaf/iYIIoi28SrKEMugssNYbS26cw4FzTLsH\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361995.960475] ca step-ca[206]: time="2026-10-13T15:38:18Z" level=info duration=13.730349ms duration-ns=13730349 fields.time="2026-10-13T15:38:18Z" method=POST name=ca nonce=azdVVzgzSWV3c0RHTVFPQ3lRQ21DMUdIRWxvWWlnb3E path=/acme/acme/order/bvVVyBvEHKS7UW9A9KNcGbHI1FOS4eJ5/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=1603edd7-d62a-4556-a5a2-59ec6e9ba678 response="{\"id\":\"bvVVyBvEHKS7UW9A9KNcGbHI1FOS4eJ5\",\"status\":\"valid\",\"expires\":\"2026-10-14T15:38:18Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-13T15:37:18Z\",\"notAfter\":\"2027-01-11T15:38:18Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/ZRvHjafaTms75pVxkuX15buFj2IG4gaf\"],\"finalize\":\"https://ca.foo/acme/acme/order/bvVVyBvEHKS7UW9A9KNcGbHI1FOS4eJ5/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/6vlARDel6C16sz9pinXTWXvOLy8d4Phr\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= container-test-run-certificates> ca # [361995.967352] ca step-ca[206]: time="2026-10-13T15:38:18Z" level=info certificate=MIIB2TCCAX6gAwIBAgIRAMIxVFVuyjKum5Wp+3s8igswCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDEzMTUzNzE4WhcNMjcwMTExMTUzODE4WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJXSDZZ9QRHNIpaI2LgOlWRyjmY6K4iSGlL+uTiKnExQuiL6efCr/02/plvI5pWFS8ynRpQDl6Dq34msONmbMZijgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUTSuhPrGFsjNKMoiUtr6lO2vjStQwHwYDVR0jBBgwFoAUc93V/HLvYrvsZZPFzc0FVbk0XMYwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0kAMEYCIQDPl8z3uE3S4oMzywOFkosbUfvja6zMsZhvzbGLOblGQAIhAKu+CIeJpEbOwh99Vm7B4E3tNe/5Vp1FWBh/ABIwv2lf duration=3.348247ms duration-ns=3348247 fields.time="2026-10-13T15:38:18Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=U2FoclUxdzc3ZzZiaEs5ZlhnOHNVQWlMWk9KQTRXaWc path=/acme/acme/certificate/6vlARDel6C16sz9pinXTWXvOLy8d4Phr protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=d3d5e34f-7734-4fb1-9c89-034464ef705b sans="map[dns:[test.foo]]" serial=258126364219430199785099649740579834379 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= valid-from="2026-10-13T15:37:18Z" valid-to="2027-01-11T15:38:18Z" container-test-run-certificates> server # [361995.841725] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.799325601Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [361995.841725] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your container-test-run-certificates> server # [361995.841725] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts". container-test-run-certificates> server # [361995.841725] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [361995.841725] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys container-test-run-certificates> server # [361995.841725] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [361995.841725] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [361995.842066] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.799585285Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [361995.928972] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.886562565Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [361995.928972] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.886622126Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [361995.941529] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.899130898Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [361995.941661] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.899277340Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [361995.968135] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.925732386Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [361995.968210] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.925838587Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [361995.968368] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.925985349Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [361995.968453] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.926063870Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [361995.968585] server acme-order-renew-test.foo-start[286]: 2026-10-13T15:38:18.926203152Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [361995.974734] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [361995.977338] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [361995.978728] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [361995.981056] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [361995.981056] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [361995.981056] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [361995.982875] server acme-order-renew-test.foo-start[316]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [361995.983189] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [361995.985061] server acme-order-renew-test.foo-start[317]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [361995.985445] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [361995.986980] server acme-order-renew-test.foo-start[318]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [361995.987303] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [361995.989316] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [361995.991463] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [361995.991519] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [361995.991519] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [361995.993465] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [361995.996843] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [361995.996843] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [361995.996928] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [361995.998556] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [361996.001760] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [361996.164263] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [361996.169421] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [361996.169696] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> server # [361996.169930] server systemd[1]: acme-order-renew-test.foo.service: Consumed 1.122s CPU time over 1.713s wall clock time. container-test-run-certificates> server # [361997.131186] server nginx[334]: nginx: the configuration file /nix/store/m0mx0dyvazvzhw8b23hfjcf1l4lh5wns-nginx.conf syntax is ok container-test-run-certificates> server # [361997.131584] server nginx[334]: nginx: configuration file /nix/store/m0mx0dyvazvzhw8b23hfjcf1l4lh5wns-nginx.conf test is successful container-test-run-certificates> server # [361998.082118] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [361998.082652] server systemd[1]: Startup finished in 8.672s. container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 9.65 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [361998.555054] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [361998.639694] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [361998.639917] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [361998.639976] server systemd[1]: nginx.service: Consumed 5.178s CPU time over 5.053s wall clock time. container-test-run-certificates> server # [361998.643488] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 1.02 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 57438 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 60426 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 2 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 2 ms: Could not connect to server container-test-run-certificates> server # [361999.557489] server nginx-pre-start[357]: nginx: the configuration file /nix/store/m0mx0dyvazvzhw8b23hfjcf1l4lh5wns-nginx.conf syntax is ok container-test-run-certificates> server # [361999.558033] server nginx-pre-start[357]: nginx: configuration file /nix/store/m0mx0dyvazvzhw8b23hfjcf1l4lh5wns-nginx.conf test is successful container-test-run-certificates> server # [361999.563202] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1554 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [933 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [78 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Oct 13 15:37:18 2026 GMT container-test-run-certificates> * expire date: Jan 11 15:38:18 2027 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 57448 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 897 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.06 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> c2:31:54:55:6e:ca:32:ae:9b:95:a9:fb:7b:3c:8a:0b container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Oct 13 15:37:18 2026 GMT container-test-run-certificates> Not After : Jan 11 15:38:18 2027 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:95:d2:0d:96:7d:41:11:cd:22:96:88:d8:b8:0e: container-test-run-certificates> 95:64:72:8e:66:3a:2b:88:92:1a:52:fe:b9:38:8a: container-test-run-certificates> 9c:4c:50:ba:22:fa:79:f0:ab:ff:4d:bf:a6:5b:c8: container-test-run-certificates> e6:95:85:4b:cc:a7:46:94:03:97:a0:ea:df:89:ac: container-test-run-certificates> 38:d9:9b:31:98 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> 4D:2B:A1:3E:B1:85:B2:33:4A:32:88:94:B6:BE:A5:3B:6B:E3:4A:D4 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 73:DD:D5:FC:72:EF:62:BB:EC:65:93:C5:CD:CD:05:55:B9:34:5C:C6 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:46:02:21:00:cf:97:cc:f7:b8:4d:d2:e2:83:33:cb:03:85: container-test-run-certificates> 92:8b:1b:51:fb:e3:6b:ac:cc:b1:98:6f:cd:b1:8b:39:b9:46: container-test-run-certificates> 40:02:21:00:ab:be:08:87:89:a4:46:ce:c2:1f:7d:56:6e:c1: container-test-run-certificates> e0:4d:ed:35:ef:f9:56:9d:45:58:18:7f:00:12:30:bf:69:5f container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.04 seconds) container-test-run-certificates> (finished: run the VM test script, in 21.46 seconds) container-test-run-certificates> test script finished in 21.53s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 469) container-test-run-certificates> kill NspawnMachine (pid 466) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> Container server terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.49 seconds)