don't know how to build these paths: /nix/store/4b253mcb3pqfbm0ri0prsjsb8b6swgxc-container-test-run-certificates.drv warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/8szmw7b61m20x2x0jyji389hknpr8xwc-unit-nix-daemon.service.drv' on nix-store.geninf.io:50051 unit-nix-daemon.service> build-x86-01: building 8szmw7b61m20x2x0jyji389hknpr8xwc-unit-nix-daemon.service.drv unit-nix-daemon.service> structuredAttrs is enabled building '/nix/store/3n8ps67szahqxbf1yqrvwm61ys3zh9bl-system-units.drv' on nix-store.geninf.io:50051 system-units> gi-build-x86-02: building 3n8ps67szahqxbf1yqrvwm61ys3zh9bl-system-units.drv building '/nix/store/35k21dgs9c3whxdn6wjzh99w0npy8zvn-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building 35k21dgs9c3whxdn6wjzh99w0npy8zvn-system-units.drv building '/nix/store/wg0lygs8k7awjdq37hr5wmdx3x9qacwi-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building wg0lygs8k7awjdq37hr5wmdx3x9qacwi-system-units.drv building '/nix/store/dpsh5lf43c5f836r6i3rkbn6cp33wjxj-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building dpsh5lf43c5f836r6i3rkbn6cp33wjxj-etc.drv building '/nix/store/h27lsp9k1lwzw1dzac8mf6frxpapavsr-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building h27lsp9k1lwzw1dzac8mf6frxpapavsr-etc.drv building '/nix/store/1k5h63cb760hk2cz74604m8d0nwc0p7b-activate.drv' on nix-store.geninf.io:50051 activate> build-x86-01: building 1k5h63cb760hk2cz74604m8d0nwc0p7b-activate.drv activate> structuredAttrs is enabled building '/nix/store/gqlnbq3w06qwl5wxyhy5apl1p3jnm3fb-activate.drv' on nix-store.geninf.io:50051 activate> build-x86-01: building gqlnbq3w06qwl5wxyhy5apl1p3jnm3fb-activate.drv activate> structuredAttrs is enabled building '/nix/store/g5g26gc3bz5h5mdp2b3fj76c9rhaqv9s-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> build-x86-01: building g5g26gc3bz5h5mdp2b3fj76c9rhaqv9s-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/4dv8zmb90yfqgrywd8qaaap74h70rj72-nixos-system-client-test.drv' on nix-store.geninf.io:50051 nixos-system-client-test> build-x86-01: building 4dv8zmb90yfqgrywd8qaaap74h70rj72-nixos-system-client-test.drv nixos-system-client-test> structuredAttrs is enabled building '/nix/store/0g6am4da3b9rd6j1alj2pypafmwq8kd8-run-ca-nspawn.drv' on nix-store.geninf.io:50051 run-ca-nspawn> build-x86-01: building 0g6am4da3b9rd6j1alj2pypafmwq8kd8-run-ca-nspawn.drv building '/nix/store/vbzcb10fcjyn3sknfqhkvg3485rn4k12-run-client-nspawn.drv' on nix-store.geninf.io:50051 run-client-nspawn> build-x86-01: building vbzcb10fcjyn3sknfqhkvg3485rn4k12-run-client-nspawn.drv building '/nix/store/qr5r1l8lpny55cbgqiaq6pdb67bqblp5-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-02: building qr5r1l8lpny55cbgqiaq6pdb67bqblp5-etc.drv building '/nix/store/sp20222yyg19l55aiyfyxfhmvxkc7r3b-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building sp20222yyg19l55aiyfyxfhmvxkc7r3b-activate.drv activate> structuredAttrs is enabled building '/nix/store/qq5750mdf2lfs2l4rfd4j13frzzmb8gw-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> gi-build-x86-02: building qq5750mdf2lfs2l4rfd4j13frzzmb8gw-nixos-system-server-test.drv nixos-system-server-test> structuredAttrs is enabled building '/nix/store/sbvm0cm14w8ck9linh0ap4654ybky4xw-run-server-nspawn.drv' on nix-store.geninf.io:50051 run-server-nspawn> gi-build-x86-02: building sbvm0cm14w8ck9linh0ap4654ybky4xw-run-server-nspawn.drv building '/nix/store/j3hzm6rr68prshaxc4irbd7d3yrh3vky-driverConfiguration.json.drv' on nix-store.geninf.io:50051 driverConfiguration.json> gi-build-x86-02: building j3hzm6rr68prshaxc4irbd7d3yrh3vky-driverConfiguration.json.drv driverConfiguration.json> structuredAttrs is enabled building '/nix/store/illrnjnpxc97ghxkl662jdxi2a3lznik-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> gi-build-x86-02: building illrnjnpxc97ghxkl662jdxi2a3lznik-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/4b253mcb3pqfbm0ri0prsjsb8b6swgxc-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build-x86-01: building 4b253mcb3pqfbm0ri0prsjsb8b6swgxc-container-test-run-certificates.drv container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [368181.304949] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [368181.304986] ca systemd-journald[81]: Runtime Journal (/run/log/journal/e739b5fe4db34e73a0190d285841d5b5) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [368181.311327] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [368181.319223] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [368181.327795] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [368181.328179] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [368181.328468] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [368181.355981] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/e739b5fe4db34e73a0190d285841d5b5 is 1.316ms for 7 entries. container-test-run-certificates> ca # [368181.355981] ca systemd-journald[81]: System Journal (/var/log/journal/e739b5fe4db34e73a0190d285841d5b5) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [368181.366672] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [368181.367081] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [368181.367134] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [368181.367586] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [368181.367613] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [368181.368102] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [368181.368119] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [368181.394708] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [368181.394796] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [368181.394923] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [368181.395376] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [368181.404170] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [368181.405418] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [368181.416958] ca systemd-tmpfiles[192]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [368181.417162] ca systemd-tmpfiles[192]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [368181.417290] ca systemd-tmpfiles[192]: fchmod() of /var/log/journal/e739b5fe4db34e73a0190d285841d5b5 failed: Operation not permitted container-test-run-certificates> ca # [368181.417452] ca systemd-tmpfiles[192]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [368181.418355] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [368181.418865] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [368181.419236] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [368181.425944] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [368181.431746] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [368181.432258] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [368181.439919] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [368181.969204] ca systemd-networkd[188]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [368181.969284] ca systemd-networkd[188]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [368181.977855] ca systemd-networkd[188]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [368181.978011] ca systemd-networkd[188]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [368181.978104] ca systemd-networkd[188]: lo: Link UP container-test-run-certificates> ca # [368181.978107] ca systemd-networkd[188]: lo: Gained carrier container-test-run-certificates> ca # [368181.978251] ca systemd-networkd[188]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [368181.978535] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [368181.978579] ca systemd-networkd[188]: eth1: Link UP container-test-run-certificates> ca # [368181.978722] ca systemd-networkd[188]: eth1: Gained carrier container-test-run-certificates> ca # [368181.979459] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [368182.006726] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [368182.083719] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [368182.299624] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [368182.472296] ca systemd-resolved[120]: Positive Trust Anchors: container-test-run-certificates> ca # [368182.472303] ca systemd-resolved[120]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [368182.472307] ca systemd-resolved[120]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [368182.472322] ca systemd-resolved[120]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [368182.483881] ca systemd-resolved[120]: Using system hostname 'ca'. container-test-run-certificates> ca # [368182.485052] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [368182.485126] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [368182.485167] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [368182.485205] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [368182.485345] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [368182.485361] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [368182.485372] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [368182.485381] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [368182.485462] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [368182.485523] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [368182.485594] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [368182.485603] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [368182.485622] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [368182.486426] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [368182.486859] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [368182.486878] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [368182.487336] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [368182.487824] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [368182.488506] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [368182.559453] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [368182.608022] ca acme-setup-privileged[204]: + set -euo pipefail container-test-run-certificates> ca # [368182.608022] ca acme-setup-privileged[204]: + cd /var/lib/acme container-test-run-certificates> ca # [368182.608246] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [368182.608978] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [368182.609852] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [368182.609887] ca acme-setup-privileged[204]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [368182.609887] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [368182.609887] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [368182.643138] ca nsncd[206]: Oct 13 15:18:43.555 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [368182.643177] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [368182.643213] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [368182.643243] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [368182.643835] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [368182.644192] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [368182.649994] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [368182.650471] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [368182.650489] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [368182.650499] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [368182.758297] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [368182.758845] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [368182.758845] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/kixpkazgihr1wbq0dw58lnlc206dl034-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [368182.759185] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [368182.762605] ca dbus-broker-launch[208]: Ready container-test-run-certificates> ca # [368183.231057] ca systemd-logind[238]: New seat seat0. container-test-run-certificates> ca # [368183.231225] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [368183.232093] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [368183.256190] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [368183.256302] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [368183.275885] ca acme-setup-start[222]: + set -euo pipefail container-test-run-certificates> ca # [368183.275885] ca acme-setup-start[222]: + test -e ca/key.pem container-test-run-certificates> ca # [368183.276164] ca acme-setup-start[222]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [368183.287395] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [368183.288218] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [368183.565441] ca step-ca[207]: badger 2026/10/13 15:18:44 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [368183.573927] ca step-ca[207]: 2026/10/13 15:18:44 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [368183.578098] ca step-ca[207]: 2026/10/13 15:18:44 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [368183.578098] ca step-ca[207]: 2026/10/13 15:18:44 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [368183.578098] ca step-ca[207]: 2026/10/13 15:18:44 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [368183.578098] ca step-ca[207]: 2026/10/13 15:18:44 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [368183.578183] ca step-ca[207]: 2026/10/13 15:18:44 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [368183.578183] ca step-ca[207]: 2026/10/13 15:18:44 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [368183.578183] ca step-ca[207]: 2026/10/13 15:18:44 X.509 Root Fingerprint: a6b7094ed9cada697e81c0c71bac4084aeeeedb2924b510c8013be30b218b4ae container-test-run-certificates> ca # [368183.578253] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [368183.578425] ca step-ca[207]: 2026/10/13 15:18:44 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [368183.742061] ca systemd-networkd[188]: eth1: Gained IPv6LL container-test-run-certificates> ca # [368183.906746] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [368183.908483] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [368183.908530] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [368183.912807] ca acme-ca.foo-start[285]: + cd ca.foo container-test-run-certificates> ca # [368183.913024] ca acme-ca.foo-start[285]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [368183.913583] ca acme-ca.foo-start[286]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [368183.913703] ca acme-ca.foo-start[285]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [368183.914315] ca acme-ca.foo-start[285]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [368183.914428] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [368183.915487] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [368183.916226] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [368183.917009] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [368183.917009] ca acme-ca.foo-start[259]: + '[' -d out ']' container-test-run-certificates> ca # [368183.917050] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [368183.917939] ca acme-ca.foo-start[259]: + chown -R acme:nginx out container-test-run-certificates> ca # [368183.919376] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [368183.919376] ca acme-ca.foo-start[259]: + '[' -d certificates ']' container-test-run-certificates> ca # [368183.921524] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [368183.922375] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [368184.578764] ca nginx-pre-start[297]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [368184.579049] ca nginx-pre-start[297]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [368184.581616] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [368184.581888] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [368184.582566] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [368185.239014] ca acme-order-renew-ca.foo-start[300]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [368185.240896] ca acme-order-renew-ca.foo-start[300]: + set -euo pipefail container-test-run-certificates> ca # [368185.240964] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [368185.240964] ca acme-order-renew-ca.foo-start[300]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [368185.241755] ca acme-order-renew-ca.foo-start[311]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [368185.243084] ca acme-order-renew-ca.foo-start[300]: + '[' -n '' ']' container-test-run-certificates> ca # [368185.243255] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [368185.243255] ca acme-order-renew-ca.foo-start[300]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [368185.243255] ca acme-order-renew-ca.foo-start[300]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [368185.314749] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.226884660Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [368185.329133] ca step-ca[207]: time="2026-10-13T15:18:46Z" level=info duration="81.854µs" duration-ns=81854 fields.time="2026-10-13T15:18:46Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c50afb53-55b2-4693-aa00-9d002a8c3a7a response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368185.329587] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.241503607Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [368185.371652] ca step-ca[207]: time="2026-10-13T15:18:46Z" level=info duration=42.173829ms duration-ns=42173829 fields.time="2026-10-13T15:18:46Z" method=HEAD name=ca nonce=U1FHRW5mdnJNUDVrczhydzZrQllrSVRQSDd0TVF1OFo path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=3e38b03f-fa3f-482c-b161-333821550cc8 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368185.379383] ca step-ca[207]: time="2026-10-13T15:18:46Z" level=info duration=7.120102ms duration-ns=7120102 fields.time="2026-10-13T15:18:46Z" method=POST name=ca nonce=VTFnRGRUN1hqRHlqUWJqWmxtSUpwNmNjMTl5dUJYRTE path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=e2d8416c-5ffc-43bc-817c-23001aa1855d response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/bD7P0bKfJXkwJM2TB7PFK4qXTeIq6NXw/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368185.379764] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.291935442Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [368185.379764] ca acme-order-renew-ca.foo-start[312]: Your account credentials have been saved in your container-test-run-certificates> ca # [368185.379764] ca acme-order-renew-ca.foo-start[312]: configuration directory at "accounts". container-test-run-certificates> ca # [368185.379764] ca acme-order-renew-ca.foo-start[312]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [368185.379764] ca acme-order-renew-ca.foo-start[312]: configuration directory will also contain private keys container-test-run-certificates> ca # [368185.379764] ca acme-order-renew-ca.foo-start[312]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [368185.379764] ca acme-order-renew-ca.foo-start[312]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [368185.379928] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.292104049Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [368185.382891] ca step-ca[207]: time="2026-10-13T15:18:46Z" level=info duration=2.661754ms duration-ns=2661754 fields.time="2026-10-13T15:18:46Z" method=POST name=ca nonce=SW1iM1F1NVdiMTNYSEhXUVpUc1lUUUd3aVIyVzZwMVk path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=66487408-eef9-434f-b6ad-c096ba41c036 response="{\"id\":\"mfvfzA9gLTJ9mJAjFSfimQL7IL5fu9v1\",\"status\":\"pending\",\"expires\":\"2026-10-14T15:18:46Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-13T15:17:46Z\",\"notAfter\":\"2027-01-11T15:18:46Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/XfspvMk3zqSVBdD2itcGOGTQExcomvz0\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/mfvfzA9gLTJ9mJAjFSfimQL7IL5fu9v1/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368185.449518] ca step-ca[207]: time="2026-10-13T15:18:46Z" level=info duration=9.906049ms duration-ns=9906049 fields.time="2026-10-13T15:18:46Z" method=POST name=ca nonce=QjlKYTFOTWVjeGNvT0VKUElvOTRjd2piTk5qdEQ2ZnU path=/acme/acme/authz/XfspvMk3zqSVBdD2itcGOGTQExcomvz0 protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b2c31495-201d-484c-a7fa-f77cf0563b6a response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"PxolumkJFALPgB3DY6iD8xmmexrN1MdG\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/XfspvMk3zqSVBdD2itcGOGTQExcomvz0/5iPXDOu021DTiey5tyFDdRgMpmFmUB7l\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"PxolumkJFALPgB3DY6iD8xmmexrN1MdG\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/XfspvMk3zqSVBdD2itcGOGTQExcomvz0/b6yLgjD2gtrLL8HTYciNHPvCX5qCv8Kq\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"PxolumkJFALPgB3DY6iD8xmmexrN1MdG\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/XfspvMk3zqSVBdD2itcGOGTQExcomvz0/NmmJZdnP82VtbIP4zJaMujAUgoRVUgtG\"}],\"wildcard\":false,\"expires\":\"2026-10-14T15:18:46Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368185.449808] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.361973769Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [368185.449832] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.361994518Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [368185.452888] ca step-ca[207]: time="2026-10-13T15:18:46Z" level=info duration=2.740472ms duration-ns=2740472 fields.time="2026-10-13T15:18:46Z" method=POST name=ca nonce=c2JqckZSRFpaS3VTYnFFcU9LczEzMWZQcVo1OGV4VWU path=/acme/acme/challenge/XfspvMk3zqSVBdD2itcGOGTQExcomvz0/b6yLgjD2gtrLL8HTYciNHPvCX5qCv8Kq protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=55a4e7ae-a901-4f36-a364-9a62d9446267 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"PxolumkJFALPgB3DY6iD8xmmexrN1MdG\",\"validated\":\"2026-10-13T15:18:46Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/XfspvMk3zqSVBdD2itcGOGTQExcomvz0/b6yLgjD2gtrLL8HTYciNHPvCX5qCv8Kq\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368185.453067] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.365218600Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [368185.453127] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.365269206Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [368185.456825] ca step-ca[207]: time="2026-10-13T15:18:46Z" level=info duration=3.362414ms duration-ns=3362414 fields.time="2026-10-13T15:18:46Z" method=POST name=ca nonce=UGxvdmlTZHVZQ05Jcmh5R3Rhd2ZaNzJ0TW96N2ZjZDg path=/acme/acme/order/mfvfzA9gLTJ9mJAjFSfimQL7IL5fu9v1/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1ac38624-09dc-4db7-a2f7-24595b842ca1 response="{\"id\":\"mfvfzA9gLTJ9mJAjFSfimQL7IL5fu9v1\",\"status\":\"valid\",\"expires\":\"2026-10-14T15:18:46Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-13T15:17:46Z\",\"notAfter\":\"2027-01-11T15:18:46Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/XfspvMk3zqSVBdD2itcGOGTQExcomvz0\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/mfvfzA9gLTJ9mJAjFSfimQL7IL5fu9v1/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/bdxsCR7WudXElQaEmtxHKFDGDvWN8o47\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368185.457846] ca step-ca[207]: time="2026-10-13T15:18:46Z" level=info certificate="MIIB1DCCAXqgAwIBAgIRAI9gnsb7JfT5tBLBbASUabEwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDEzMTUxNzQ2WhcNMjcwMTExMTUxODQ2WjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASY0XRN+mvkV71wvFeUSb4LayDqykt7AY0lcK/mmg9wcmx9UdsQjvdX1ySixemaADcuan6BMZatIY+z7p2IS0Xbo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFIF5Wkpql+VvixOESj7g/O/EkuODMB8GA1UdIwQYMBaAFAU7vohW+ijxy5tV8yqNhVGRUEnlMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIgClib97Lczd6hlfSWH6U2Gpza8aW3lx5PlMp+pX4dayUCIQCUZd5ijOUCeVU8xbvcSxspk06Zrg3ScjhIPN7n22tWeg==" duration="600.801µs" duration-ns=600801 fields.time="2026-10-13T15:18:46Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=cUhNcmxZOVhSY3MycjduTlFOYU9hc2RrOWdCNVRqaFE path=/acme/acme/certificate/bdxsCR7WudXElQaEmtxHKFDGDvWN8o47 protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=5d436513-29b2-4a7d-8a4f-030faca0c70d sans="map[dns:[ca.foo]]" serial=190581284281282492649969258677679712689 size=1344 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-13T15:17:46Z" valid-to="2027-01-11T15:18:46Z" container-test-run-certificates> ca # [368185.457910] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.370087772Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [368185.457935] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.370114232Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [368185.457975] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.370155210Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [368185.457999] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.370179866Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [368185.458045] ca acme-order-renew-ca.foo-start[312]: 2026-10-13T15:18:46.370225752Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [368185.460384] ca acme-order-renew-ca.foo-start[300]: + touch out/acme-success container-test-run-certificates> ca # [368185.461185] ca acme-order-renew-ca.foo-start[300]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [368185.461765] ca acme-order-renew-ca.foo-start[300]: + touch out/renewed container-test-run-certificates> ca # [368185.462502] ca acme-order-renew-ca.foo-start[300]: + echo Installing new certificate container-test-run-certificates> ca # [368185.462502] ca acme-order-renew-ca.foo-start[300]: Installing new certificate container-test-run-certificates> ca # [368185.462530] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [368185.463257] ca acme-order-renew-ca.foo-start[332]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [368185.463444] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [368185.464031] ca acme-order-renew-ca.foo-start[333]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [368185.464181] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [368185.464877] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [368185.465018] ca acme-order-renew-ca.foo-start[300]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [368185.465775] ca acme-order-renew-ca.foo-start[300]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [368185.466581] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [368185.466595] ca acme-order-renew-ca.foo-start[300]: + '[' -d out ']' container-test-run-certificates> ca # [368185.466595] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [368185.467383] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx out container-test-run-certificates> ca # [368185.469032] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [368185.469032] ca acme-order-renew-ca.foo-start[300]: + '[' -d certificates ']' container-test-run-certificates> ca # [368185.469063] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [368185.469921] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [368185.471201] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [368185.583314] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [368185.585715] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [368185.585833] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [368186.253761] ca nginx[350]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [368186.254114] ca nginx[350]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 6.14 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [368186.877774] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [368186.877971] ca systemd[1]: Startup finished in 5.822s. container-test-run-certificates> ca # [368186.924816] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [368186.986015] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [368186.986132] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [368186.986143] ca systemd[1]: nginx.service: Consumed 2.504s CPU time over 3.063s wall clock time. container-test-run-certificates> ca # [368186.987468] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.75 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 443) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 446) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ca # [368187.664857] ca nginx-pre-start[374]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [368187.665127] ca nginx-pre-start[374]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [368187.668418] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> client # [368188.204985] client systemd-journald[72]: Journal started container-test-run-certificates> server # [368188.214510] server systemd-journald[72]: Journal started container-test-run-certificates> client # [368188.205020] client systemd-journald[72]: Runtime Journal (/run/log/journal/0930891104a6432b9b68d9c5adfea5eb) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [368188.214536] server systemd-journald[72]: Runtime Journal (/run/log/journal/e40a89511d9d40baa76c0acd6c9b2e12) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [368188.211548] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [368188.218347] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [368188.219942] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [368188.226171] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [368188.226800] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [368188.226541] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [368188.226911] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [368188.237306] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [368188.231542] client systemd-journald[72]: Time spent on flushing to /var/log/journal/0930891104a6432b9b68d9c5adfea5eb is 1.191ms for 7 entries. container-test-run-certificates> client # [368188.231542] client systemd-journald[72]: System Journal (/var/log/journal/0930891104a6432b9b68d9c5adfea5eb) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [368188.237637] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [368188.245980] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [368188.237920] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [368188.246330] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [368188.246378] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [368188.242995] server systemd-journald[72]: Time spent on flushing to /var/log/journal/e40a89511d9d40baa76c0acd6c9b2e12 is 1.539ms for 7 entries. container-test-run-certificates> client # [368188.246790] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [368188.242995] server systemd-journald[72]: System Journal (/var/log/journal/e40a89511d9d40baa76c0acd6c9b2e12) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [368188.246814] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [368188.259706] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [368188.247226] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [368188.260339] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [368188.247243] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [368188.260417] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [368188.266452] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [368188.260938] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [368188.260967] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [368188.267152] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [368188.261458] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [368188.279772] client systemd-tmpfiles[153]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [368188.261476] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [368188.267238] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [368188.279964] client systemd-tmpfiles[153]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [368188.267736] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [368188.280103] client systemd-tmpfiles[153]: fchmod() of /var/log/journal/0930891104a6432b9b68d9c5adfea5eb failed: Operation not permitted container-test-run-certificates> server # [368188.280229] server systemd-tmpfiles[139]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [368188.280301] client systemd-tmpfiles[153]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [368188.280425] server systemd-tmpfiles[139]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [368188.282137] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [368188.280554] server systemd-tmpfiles[139]: fchmod() of /var/log/journal/e40a89511d9d40baa76c0acd6c9b2e12 failed: Operation not permitted container-test-run-certificates> client # [368188.283186] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [368188.280731] server systemd-tmpfiles[139]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [368188.283843] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [368188.282075] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [368188.290363] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [368188.282664] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [368188.291530] client systemd[1]: Finished Firewall. container-test-run-certificates> server # [368188.282972] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [368188.291631] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [368188.289504] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [368188.291808] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [368188.294211] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [368188.292545] client systemd[1]: Starting Network Management... container-test-run-certificates> server # [368188.295150] server systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [368188.296468] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [368188.300044] server systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [368188.296898] client systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [368188.311966] server systemd[1]: Finished Firewall. container-test-run-certificates> client # [368188.303970] client systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [368188.312096] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [368188.621154] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [368188.312278] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [368188.312909] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [368188.621046] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [368188.815770] client systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [368188.815844] client systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [368188.822827] client systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [368188.822966] client systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [368188.823044] client systemd-networkd[182]: lo: Link UP container-test-run-certificates> client # [368188.823048] client systemd-networkd[182]: lo: Gained carrier container-test-run-certificates> client # [368188.823174] client systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [368188.823426] client systemd[1]: Started Network Management. container-test-run-certificates> client # [368188.823460] client systemd-networkd[182]: eth1: Link UP container-test-run-certificates> client # [368188.823575] client systemd-networkd[182]: eth1: Gained carrier container-test-run-certificates> client # [368188.824293] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [368188.851869] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [368188.839861] server systemd-networkd[189]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [368188.839930] server systemd-networkd[189]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [368188.847110] server systemd-networkd[189]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [368188.847255] server systemd-networkd[189]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [368188.847320] server systemd-networkd[189]: lo: Link UP container-test-run-certificates> server # [368188.847323] server systemd-networkd[189]: lo: Gained carrier container-test-run-certificates> server # [368188.847443] server systemd-networkd[189]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [368188.847657] server systemd[1]: Started Network Management. container-test-run-certificates> server # [368188.848107] server systemd-networkd[189]: eth1: Link UP container-test-run-certificates> server # [368188.848224] server systemd-networkd[189]: eth1: Gained carrier container-test-run-certificates> server # [368188.848255] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [368188.860140] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [368189.192266] server systemd-resolved[109]: Positive Trust Anchors: container-test-run-certificates> server # [368189.192271] server systemd-resolved[109]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [368189.192275] server systemd-resolved[109]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [368189.192290] server systemd-resolved[109]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [368189.202264] server systemd-resolved[109]: Using system hostname 'server'. container-test-run-certificates> server # [368189.203117] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [368189.203165] server systemd[1]: Reached target Network. container-test-run-certificates> server # [368189.203194] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [368189.203218] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [368189.203350] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [368189.203373] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [368189.203385] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [368189.203396] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [368189.203467] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [368189.203528] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [368189.203599] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [368189.203609] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [368189.203628] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [368189.204361] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [368189.204684] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [368189.204703] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [368189.205055] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [368189.213133] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [368189.224145] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [368189.231819] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [368189.319979] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [368189.319979] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [368189.320212] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [368189.320775] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [368189.321870] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [368189.321908] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [368189.321908] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [368189.321908] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [368189.343814] server nsncd[197]: Oct 13 15:18:50.255 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [368189.343847] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [368189.343885] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [368189.343919] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [368189.354121] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [368189.354432] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [368189.359294] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [368189.359731] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [368189.359752] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [368189.359761] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [368189.455603] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [368189.455985] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [368189.455985] server dbus-broker-launch[198]: Invalid user-name in /nix/store/fimaswanbxnfazj78kcfwgk6rqj2yp60-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [368189.203190] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [368189.226363] client systemd-resolved[107]: Positive Trust Anchors: container-test-run-certificates> client # [368189.226369] client systemd-resolved[107]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [368189.226372] client systemd-resolved[107]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [368189.226389] client systemd-resolved[107]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [368189.236373] client systemd-resolved[107]: Using system hostname 'client'. container-test-run-certificates> client # [368189.237166] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [368189.237202] client systemd[1]: Reached target Network. container-test-run-certificates> client # [368189.237233] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [368189.237263] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [368189.237278] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [368189.237289] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [368189.237356] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [368189.237409] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [368189.237477] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [368189.237484] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [368189.237505] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [368189.238004] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [368189.238339] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [368189.238833] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [368189.246988] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [368189.353408] client nsncd[192]: Oct 13 15:18:50.265 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [368189.353447] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [368189.353476] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [368189.353512] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [368189.354126] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [368189.354431] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [368189.359296] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [368189.359726] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [368189.359752] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [368189.359764] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [368189.464891] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [368189.465186] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [368189.465186] client dbus-broker-launch[193]: Invalid user-name in /nix/store/m4ivw8jwjlx3d2m7fn54br6h9cqmm383-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [368189.465426] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [368189.456387] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [368189.459718] server dbus-broker-launch[198]: Ready container-test-run-certificates> client # [368189.468627] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [368189.911163] server systemd-logind[222]: New seat seat0. container-test-run-certificates> server # [368189.911267] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [368189.911943] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [368189.940126] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [368189.940210] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [368189.967754] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [368189.967754] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [368189.968071] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [368189.975499] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [368189.976352] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> server # [368190.143047] server systemd-networkd[189]: eth1: Gained IPv6LL container-test-run-certificates> client # [368189.917209] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [368189.917364] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [368189.935306] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [368189.944665] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [368189.944755] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [368189.945060] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [368189.945173] client systemd[1]: Startup finished in 2.014s. container-test-run-certificates> client # [368190.463070] client systemd-networkd[182]: eth1: Gained IPv6LL container-test-run-certificates> server # [368190.618767] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [368190.620258] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [368190.620258] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [368190.624880] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [368190.625073] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [368190.625595] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [368190.625724] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [368190.626292] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [368190.626405] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [368190.627223] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [368190.628293] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [368190.629097] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [368190.629111] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [368190.629111] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [368190.629858] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [368190.631264] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [368190.631264] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [368190.633185] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [368190.633927] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [368191.263120] server nginx-pre-start[270]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [368191.263509] server nginx-pre-start[270]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [368191.266289] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [368191.266511] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [368191.267107] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [368191.910384] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [368191.912249] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [368191.912301] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [368191.912331] server acme-order-renew-test.foo-start[273]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [368191.913052] server acme-order-renew-test.foo-start[284]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [368191.914466] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [368191.914522] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [368191.914522] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [368191.914555] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [368191.926067] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.838221103Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [368191.942302] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.854464790Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [368191.981859] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.894020709Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [368191.981859] server acme-order-renew-test.foo-start[285]: Your account credentials have been saved in your container-test-run-certificates> server # [368191.981859] server acme-order-renew-test.foo-start[285]: configuration directory at "accounts". container-test-run-certificates> server # [368191.981859] server acme-order-renew-test.foo-start[285]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [368191.981859] server acme-order-renew-test.foo-start[285]: configuration directory will also contain private keys container-test-run-certificates> server # [368191.981859] server acme-order-renew-test.foo-start[285]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [368191.981859] server acme-order-renew-test.foo-start[285]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [368191.982044] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.894144593Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [368192.048209] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.960366720Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [368192.048209] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.960389964Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [368192.051504] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.963676655Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [368192.051558] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.963714767Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [368192.056437] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.968609948Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [368192.056488] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.968642719Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [368192.056508] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.968687714Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [368192.056536] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.968707141Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [368192.056565] server acme-order-renew-test.foo-start[285]: 2026-10-13T15:18:52.968745453Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [368192.058885] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [368192.059852] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [368192.060482] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [368192.061274] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [368192.061289] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [368192.061289] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [368192.062054] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [368192.062194] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [368192.062974] server acme-order-renew-test.foo-start[308]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [368192.063110] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [368192.063917] server acme-order-renew-test.foo-start[309]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [368192.064097] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [368192.064896] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [368192.065867] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [368192.065880] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [368192.065890] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [368192.066734] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [368192.068096] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [368192.068096] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [368192.068115] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [368192.068914] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [368192.070126] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [368192.183320] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [368191.942056] ca step-ca[207]: time="2026-10-13T15:18:52Z" level=info duration="38.983µs" duration-ns=38983 fields.time="2026-10-13T15:18:52Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=56e2d8c0-30ac-48f2-8bac-5024d449d09e response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368191.971214] ca step-ca[207]: time="2026-10-13T15:18:52Z" level=info duration=28.056348ms duration-ns=28056348 fields.time="2026-10-13T15:18:52Z" method=HEAD name=ca nonce=b3Q3MTdMenZYNEk5WFphUFFUbnpka2pQQnE3UlJEUnI path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=1fdd383d-1d7b-4b53-97fe-24334913c8d5 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368191.981363] ca step-ca[207]: time="2026-10-13T15:18:52Z" level=info duration=8.56851ms duration-ns=8568510 fields.time="2026-10-13T15:18:52Z" method=POST name=ca nonce=UGNtQXM3VHUwNVp0UXkwcU5XRGE1ZHJaT2hXOHFteXo path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=f22bf193-5752-4cb9-8e1e-d48298096817 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/26hOo4fjdZOp93QZJVhzWoPycjEbahVM/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368191.985761] ca step-ca[207]: time="2026-10-13T15:18:52Z" level=info duration=2.192079ms duration-ns=2192079 fields.time="2026-10-13T15:18:52Z" method=POST name=ca nonce=NVFzRTk0bXhCVnUwd2ltazRDNUIwYjNtcUxtTHlrcDU path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=ae3c0456-43cc-4915-bf18-34dbae28055c response="{\"id\":\"fBijIBebvmKlr4EoBgE78sY3uDOsKte8\",\"status\":\"pending\",\"expires\":\"2026-10-14T15:18:52Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-13T15:17:52Z\",\"notAfter\":\"2027-01-11T15:18:52Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/UEyWQk99UIyQvdGUp1mU5LHIbfcQDT7O\"],\"finalize\":\"https://ca.foo/acme/acme/order/fBijIBebvmKlr4EoBgE78sY3uDOsKte8/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368192.047823] ca step-ca[207]: time="2026-10-13T15:18:52Z" level=info duration=4.437288ms duration-ns=4437288 fields.time="2026-10-13T15:18:52Z" method=POST name=ca nonce=WjVnaVVaSnp1WFJ0ZmFTYTVKYlZBQ01XZ1V6TENTVTA path=/acme/acme/authz/UEyWQk99UIyQvdGUp1mU5LHIbfcQDT7O protocol=HTTP/1.1 referer= remote-address="::1" request-id=3a8dbcad-951f-49e9-a657-104be733e1aa response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"ZR4kLjzQ4jFL8vnLKEQibaGWyXQzyQ8w\",\"url\":\"https://ca.foo/acme/acme/challenge/UEyWQk99UIyQvdGUp1mU5LHIbfcQDT7O/LZt0YBrVsSIU2Bw1OJdorSIHx2vfNNSQ\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"ZR4kLjzQ4jFL8vnLKEQibaGWyXQzyQ8w\",\"url\":\"https://ca.foo/acme/acme/challenge/UEyWQk99UIyQvdGUp1mU5LHIbfcQDT7O/pB1Y7KcL3aFlVACZIVy4FSdng1AzQili\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"ZR4kLjzQ4jFL8vnLKEQibaGWyXQzyQ8w\",\"url\":\"https://ca.foo/acme/acme/challenge/UEyWQk99UIyQvdGUp1mU5LHIbfcQDT7O/SECmGpsF7McVLLoVxnnBxWBubZOlLFCl\"}],\"wildcard\":false,\"expires\":\"2026-10-14T15:18:52Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368192.051198] ca step-ca[207]: time="2026-10-13T15:18:52Z" level=info duration=2.063717ms duration-ns=2063717 fields.time="2026-10-13T15:18:52Z" method=POST name=ca nonce=bHE2dVZiZWltbmgwZkRxOUk4MTR2cDV3bG9GYkRLQTY path=/acme/acme/challenge/UEyWQk99UIyQvdGUp1mU5LHIbfcQDT7O/pB1Y7KcL3aFlVACZIVy4FSdng1AzQili protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=1f7e3b5d-9bad-4769-92ec-fd04c53a4e96 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"ZR4kLjzQ4jFL8vnLKEQibaGWyXQzyQ8w\",\"validated\":\"2026-10-13T15:18:52Z\",\"url\":\"https://ca.foo/acme/acme/challenge/UEyWQk99UIyQvdGUp1mU5LHIbfcQDT7O/pB1Y7KcL3aFlVACZIVy4FSdng1AzQili\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368192.054711] ca step-ca[207]: time="2026-10-13T15:18:52Z" level=info duration=2.421601ms duration-ns=2421601 fields.time="2026-10-13T15:18:52Z" method=POST name=ca nonce=eVV0M2xGTXE1ZFMyMGJ6MGFkNzJ0NnFiWWFCMmNoaVY path=/acme/acme/order/fBijIBebvmKlr4EoBgE78sY3uDOsKte8/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=6bdc1dbb-b09e-4f70-86fd-7929937f53ed response="{\"id\":\"fBijIBebvmKlr4EoBgE78sY3uDOsKte8\",\"status\":\"valid\",\"expires\":\"2026-10-14T15:18:52Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-13T15:17:52Z\",\"notAfter\":\"2027-01-11T15:18:52Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/UEyWQk99UIyQvdGUp1mU5LHIbfcQDT7O\"],\"finalize\":\"https://ca.foo/acme/acme/order/fBijIBebvmKlr4EoBgE78sY3uDOsKte8/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/yjkw2a7yXNdvt71dmmLU69DvtgKYRURH\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [368192.056290] ca step-ca[207]: time="2026-10-13T15:18:52Z" level=info certificate=MIIB2TCCAX6gAwIBAgIRAJxzD8Er4XJWnaVx5xMUGTMwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDEzMTUxNzUyWhcNMjcwMTExMTUxODUyWjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAYaOVlpSbDQLCHpDobLLxBVRsj2hvBCYFrw0aDMJ5wy/za9PVn1Jjxm2RSpSuhJq13ndRDM4+qUQa1+tpijclajgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUjMlW6tt5weE3+xr0gu5q8nYPP0MwHwYDVR0jBBgwFoAUBTu+iFb6KPHLm1XzKo2FUZFQSeUwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0kAMEYCIQDUs4YKRQDPP3FuIpy3z8z/d9mUOHWSsUgnhklgfoPl+AIhAOd+RuPMXeF+Z8N1Y63g4Rm3Bxbbl3bIFM3VnBVS4jwL duration="719.425µs" duration-ns=719425 fields.time="2026-10-13T15:18:52Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=dEQ0bk1rQXhMN1hja3YwcmtQajUwbDBZMXFQSVlhZjE path=/acme/acme/certificate/yjkw2a7yXNdvt71dmmLU69DvtgKYRURH protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=0b37bd0f-6f4b-47de-8c68-eb49d4b6136a sans="map[dns:[test.foo]]" serial=207957001021938205057638201114779457843 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-13T15:17:52Z" valid-to="2027-01-11T15:18:52Z" container-test-run-certificates> server # [368192.185697] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [368192.185854] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> server # [368192.846592] server nginx[325]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [368192.846965] server nginx[325]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 6.14 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [368193.593587] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [368193.593780] server systemd[1]: Startup finished in 5.662s. container-test-run-certificates> server # [368193.814454] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [368193.856478] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [368193.856682] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [368193.856729] server systemd[1]: nginx.service: Consumed 3.889s CPU time over 3.222s wall clock time. container-test-run-certificates> server # [368193.858512] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.71 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 48574 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 50726 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 0 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 0 ms: Could not connect to server container-test-run-certificates> server # [368194.514755] server nginx-pre-start[348]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [368194.515037] server nginx-pre-start[348]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [368194.518194] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1554 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [933 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [78 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Oct 13 15:17:52 2026 GMT container-test-run-certificates> * expire date: Jan 11 15:18:52 2027 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 48586 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1889 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> 9c:73:0f:c1:2b:e1:72:56:9d:a5:71:e7:13:14:19:33 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Oct 13 15:17:52 2026 GMT container-test-run-certificates> Not After : Jan 11 15:18:52 2027 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:06:1a:39:59:69:49:b0:d0:2c:21:e9:0e:86:cb: container-test-run-certificates> 2f:10:55:46:c8:f6:86:f0:42:60:5a:f0:d1:a0:cc: container-test-run-certificates> 27:9c:32:ff:36:bd:3d:59:f5:26:3c:66:d9:14:a9: container-test-run-certificates> 4a:e8:49:ab:5d:e7:75:10:cc:e3:ea:94:41:ad:7e: container-test-run-certificates> b6:98:a3:72:56 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> 8C:C9:56:EA:DB:79:C1:E1:37:FB:1A:F4:82:EE:6A:F2:76:0F:3F:43 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 05:3B:BE:88:56:FA:28:F1:CB:9B:55:F3:2A:8D:85:51:91:50:49:E5 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:46:02:21:00:d4:b3:86:0a:45:00:cf:3f:71:6e:22:9c:b7: container-test-run-certificates> cf:cc:ff:77:d9:94:38:75:92:b1:48:27:86:49:60:7e:83:e5: container-test-run-certificates> f8:02:21:00:e7:7e:46:e3:cc:5d:e1:7e:67:c3:75:63:ad:e0: container-test-run-certificates> e1:19:b7:07:16:db:97:76:c8:14:cd:d5:9c:15:52:e2:3c:0b container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 14.79 seconds) container-test-run-certificates> test script finished in 15.07s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 446) container-test-run-certificates> kill NspawnMachine (pid 443) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.24 seconds) container-test-run-certificates> Container server terminated by signal KILL.