container-test-run-certificates
checks.aarch64-linux.certificates
· build #966
· raw
1build01: building xp4n58s8rxnl4pkf6gzpzvcfvhqf5nnn-container-test-run-certificates.drv2additionally exposed symbols:3 ca, client, server,4 start_all, machines, driver, Machine, wait_for_signal5Starting ca6Starting client7Starting server89101112<<< NixOS Stage 2 >>>1314booting system configuration /nix/store/7p64jhks9jx3hijknwwlhr6n77az5rj7-nixos-system-ca-test15running activation script...16setting up /etc...172: host0@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100018 link/ether 42:06:76:42:a9:8d brd ff:ff:ff:ff:ff:ff link-netnsid 019setting up age secrets...20starting systemd...21systemd 260.5 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)22Detected virtualization systemd-nspawn.23Detected architecture arm64.24Detected first boot.25Initializing machine ID from container UUID.26Applying preset policy.27Populated /etc with preset unit settings.28Queued start job for default target Multi-User System.29303132<<< Welcome to NixOS test (aarch64) - console >>>33+ systemd-run /bin/sh -c '/nix/store/3l7ygqcc6v0rbi9d4j1m6phi6sz86j98-coreutils-9.11/bin/sleep 999999999 && echo 54b16d35-f00e-46a3-b7c2-c4c64e923f92'34Running as unit: run-p468-i3773816.service; invocation ID: c1f7307bf41f4f55b8e923dcb159558635To attach to container ca run on the same machine that runs the test:36 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*54b16d35-f00e-46a3-b7c2-c4c64e923f92') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 3738To inject external network and continue test, run:39sudo /nix/store/q1khrhbn506imjxx7kiqcbihycawa6kl-python3-3.13.15/bin/python3.13 /nix/store/qq5ppp119nyp6wdn1gi4pr1xkmgs2ny1-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 54b16d35-f00e-46a3-b7c2-c4c64e923f924041<<< NixOS Stage 2 >>>4243booting system configuration /nix/store/fvqbb6pqkc7pl4nrm2kwsr28dcg7gmcm-nixos-system-client-test44running activation script...45setting up /etc...462: host0@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100047 link/ether 2a:42:35:28:b1:2f brd ff:ff:ff:ff:ff:ff link-netnsid 048setting up age secrets...49starting systemd...50systemd 260.5 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)51Detected virtualization systemd-nspawn.52Detected architecture arm64.53Detected first boot.54Initializing machine ID from container UUID.55Applying preset policy.56Populated /etc with preset unit settings.57Queued start job for default target Multi-User System.58596061<<< Welcome to NixOS test (aarch64) - console >>>62+ systemd-run /bin/sh -c '/nix/store/3l7ygqcc6v0rbi9d4j1m6phi6sz86j98-coreutils-9.11/bin/sleep 999999999 && echo 43c75eac-1332-48f0-8110-1aa9b786ddea'63Running as unit: run-p302-i3773819.service; invocation ID: 0ae64653dc3844d1b71b82accfe659f564To attach to container client run on the same machine that runs the test:65 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*43c75eac-1332-48f0-8110-1aa9b786ddea') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 6667To inject external network and continue test, run:68sudo /nix/store/q1khrhbn506imjxx7kiqcbihycawa6kl-python3-3.13.15/bin/python3.13 /nix/store/qq5ppp119nyp6wdn1gi4pr1xkmgs2ny1-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 43c75eac-1332-48f0-8110-1aa9b786ddea6970<<< NixOS Stage 2 >>>7172booting system configuration /nix/store/4grg9d151ab9v5xip8a2bavq1bnf7gx3-nixos-system-server-test73running activation script...74setting up /etc...752: host0@if5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100076 link/ether be:aa:dd:39:86:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 077setting up age secrets...78starting systemd...79systemd 260.5 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)80Detected virtualization systemd-nspawn.81Detected architecture arm64.82Detected first boot.83Initializing machine ID from container UUID.84Applying preset policy.85Populated /etc with preset unit settings.86Queued start job for default target Multi-User System.87888990<<< Welcome to NixOS test (aarch64) - console >>>91+ systemd-run /bin/sh -c '/nix/store/3l7ygqcc6v0rbi9d4j1m6phi6sz86j98-coreutils-9.11/bin/sleep 999999999 && echo c730b51d-6a3b-4364-b856-fa2b1c656b17'92Running as unit: run-p396-i3773822.service; invocation ID: d8d5bec871ed433695393d14ccde70b993To attach to container server run on the same machine that runs the test:94 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*c730b51d-6a3b-4364-b856-fa2b1c656b17') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 9596To inject external network and continue test, run:97sudo /nix/store/q1khrhbn506imjxx7kiqcbihycawa6kl-python3-3.13.15/bin/python3.13 /nix/store/qq5ppp119nyp6wdn1gi4pr1xkmgs2ny1-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py c730b51d-6a3b-4364-b856-fa2b1c656b1798+ systemctl restart acme-order-renew-ca.foo.service99+ systemctl restart acme-test.foo.service100client: waiting for success: curl -v https://test.foo101+ curl -v https://test.foo102* Host test.foo:443 was resolved.103* IPv6: (none)104* IPv4: 192.168.1.3105* Trying 192.168.1.3:443...106* ALPN: curl offers h2,http/1.1107} [5 bytes data]108* TLSv1.3 (OUT), TLS handshake, Client hello (1):109} [1552 bytes data]110* SSL Trust Anchors:111* OpenSSL default paths (fallback)112{ [5 bytes data]113* TLSv1.3 (IN), TLS handshake, Server hello (2):114{ [1210 bytes data]115* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):116{ [1 bytes data]117* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):118{ [19 bytes data]119* TLSv1.3 (IN), TLS handshake, Certificate (11):120{ [1009 bytes data]121* TLSv1.3 (IN), TLS handshake, CERT verify (15):122{ [111 bytes data]123* TLSv1.3 (IN), TLS handshake, Finished (20):124{ [52 bytes data]125* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):126} [1 bytes data]127* TLSv1.3 (OUT), TLS handshake, Finished (20):128} [52 bytes data]129* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey130* ALPN: server accepted h2131* Server certificate:132* subject: CN=test.foo133* start date: Oct 13 15:55:00 2026 GMT134* expire date: Nov 12 15:55:00 2028 GMT135* issuer: CN=minica root ca 723c47136* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384137* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384138* subjectAltName: "test.foo" matches cert's "test.foo"139* OpenSSL verify result: 13140* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)141* closing connection #0142curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)143More details here: https://curl.se/docs/sslcerts.html144145curl failed to verify the legitimacy of the server and therefore could not146establish a secure connection to it. To learn more about this situation and147how to fix it, please visit the webpage mentioned above.148+ curl -v https://test.foo149* Host test.foo:443 was resolved.150* IPv6: (none)151* IPv4: 192.168.1.3152* Trying 192.168.1.3:443...153* ALPN: curl offers h2,http/1.1154} [5 bytes data]155* TLSv1.3 (OUT), TLS handshake, Client hello (1):156} [1552 bytes data]157* SSL Trust Anchors:158* OpenSSL default paths (fallback)159{ [5 bytes data]160* TLSv1.3 (IN), TLS handshake, Server hello (2):161{ [1210 bytes data]162* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):163{ [1 bytes data]164* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):165{ [19 bytes data]166* TLSv1.3 (IN), TLS handshake, Certificate (11):167{ [1009 bytes data]168* TLSv1.3 (IN), TLS handshake, CERT verify (15):169{ [111 bytes data]170* TLSv1.3 (IN), TLS handshake, Finished (20):171{ [52 bytes data]172* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):173} [1 bytes data]174* TLSv1.3 (OUT), TLS handshake, Finished (20):175} [52 bytes data]176* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey177* ALPN: server accepted h2178* Server certificate:179* subject: CN=test.foo180* start date: Oct 13 15:55:00 2026 GMT181* expire date: Nov 12 15:55:00 2028 GMT182* issuer: CN=minica root ca 723c47183* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384184* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384185* subjectAltName: "test.foo" matches cert's "test.foo"186* OpenSSL verify result: 13187* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)188* closing connection #0189curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)190More details here: https://curl.se/docs/sslcerts.html191192curl failed to verify the legitimacy of the server and therefore could not193establish a secure connection to it. To learn more about this situation and194how to fix it, please visit the webpage mentioned above.195+ curl -v https://test.foo196* Host test.foo:443 was resolved.197* IPv6: (none)198* IPv4: 192.168.1.3199* Trying 192.168.1.3:443...200* ALPN: curl offers h2,http/1.1201} [5 bytes data]202* TLSv1.3 (OUT), TLS handshake, Client hello (1):203} [1552 bytes data]204* SSL Trust Anchors:205* OpenSSL default paths (fallback)206{ [5 bytes data]207* TLSv1.3 (IN), TLS handshake, Server hello (2):208{ [1210 bytes data]209* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):210{ [1 bytes data]211* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):212{ [19 bytes data]213* TLSv1.3 (IN), TLS handshake, Certificate (11):214{ [1009 bytes data]215* TLSv1.3 (IN), TLS handshake, CERT verify (15):216{ [112 bytes data]217* TLSv1.3 (IN), TLS handshake, Finished (20):218{ [52 bytes data]219* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):220} [1 bytes data]221* TLSv1.3 (OUT), TLS handshake, Finished (20):222} [52 bytes data]223* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey224* ALPN: server accepted h2225* Server certificate:226* subject: CN=test.foo227* start date: Oct 13 15:55:00 2026 GMT228* expire date: Nov 12 15:55:00 2028 GMT229* issuer: CN=minica root ca 723c47230* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384231* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384232* subjectAltName: "test.foo" matches cert's "test.foo"233* OpenSSL verify result: 13234* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)235* closing connection #0236curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)237More details here: https://curl.se/docs/sslcerts.html238239curl failed to verify the legitimacy of the server and therefore could not240establish a secure connection to it. To learn more about this situation and241how to fix it, please visit the webpage mentioned above.242+ curl -v https://test.foo243* Host test.foo:443 was resolved.244* IPv6: (none)245* IPv4: 192.168.1.3246* Trying 192.168.1.3:443...247* ALPN: curl offers h2,http/1.1248} [5 bytes data]249* TLSv1.3 (OUT), TLS handshake, Client hello (1):250} [1552 bytes data]251* SSL Trust Anchors:252* OpenSSL default paths (fallback)253{ [5 bytes data]254* TLSv1.3 (IN), TLS handshake, Server hello (2):255{ [1210 bytes data]256* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):257{ [1 bytes data]258* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):259{ [19 bytes data]260* TLSv1.3 (IN), TLS handshake, Certificate (11):261{ [931 bytes data]262* TLSv1.3 (IN), TLS handshake, CERT verify (15):263{ [80 bytes data]264* TLSv1.3 (IN), TLS handshake, Finished (20):265{ [52 bytes data]266* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):267} [1 bytes data]268* TLSv1.3 (OUT), TLS handshake, Finished (20):269} [52 bytes data]270* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey271* ALPN: server accepted h2272* Server certificate:273* subject: CN=test.foo274* start date: Oct 13 15:54:13 2026 GMT275* expire date: Jan 11 15:55:13 2027 GMT276* issuer: CN=Clan Intermediate CA277* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256278* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256279* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256280* subjectAltName: "test.foo" matches cert's "test.foo"281* OpenSSL verify result: 0282* SSL certificate verified via OpenSSL.283* Established connection to test.foo (192.168.1.3 port 443) from 192.168.1.2 port 39950 284 % Total % Received % Xferd Average Speed Time Time Time Current285 Dload Upload Total Spent Left Speed286 0 0 0 0 0 0 0 0 0* using HTTP/2287* [HTTP/2] [1] OPENED stream for https://test.foo/288* [HTTP/2] [1] [:method: GET]289* [HTTP/2] [1] [:scheme: https]290* [HTTP/2] [1] [:authority: test.foo]291* [HTTP/2] [1] [:path: /]292* [HTTP/2] [1] [user-agent: curl/8.22.0]293* [HTTP/2] [1] [accept: */*]294} [5 bytes data]295296297298299300* Request completely sent off301{ [5 bytes data]302* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):303{ [265 bytes data]304* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):305{ [265 bytes data]306307308309310311312313{ [5 bytes data]314100 20 100 20 0 0 672 0 0315* Connection #0 to host test.foo:443 left intact316(finished: waiting for success: curl -v https://test.foo, in 3.19 seconds)317+ openssl s_client -connect test.foo:443 -servername test.foo318+ openssl x509 -text -noout319Certificate:320 Data:321 Version: 3 (0x2)322 Serial Number:323 9c:f7:26:38:60:37:64:66:39:3a:f8:df:74:24:3a:80324 Signature Algorithm: ecdsa-with-SHA256325 Issuer: CN=Clan Intermediate CA326 Validity327 Not Before: Oct 13 15:54:13 2026 GMT328 Not After : Jan 11 15:55:13 2027 GMT329 Subject: CN=test.foo330 Subject Public Key Info:331 Public Key Algorithm: id-ecPublicKey332 Public-Key: (256 bit)333 pub:334 04:2a:0b:e0:fb:b3:b4:57:2b:18:87:34:fd:1b:3b:335 50:d0:84:80:c1:b5:86:a6:75:f4:95:5f:a3:5c:87:336 6a:6f:cb:11:5d:c0:c9:34:f6:34:cb:fc:49:f6:91:337 07:82:a4:67:45:61:29:9b:55:ae:c7:21:6c:27:ba:338 28:68:be:e5:53339 ASN1 OID: prime256v1340 NIST CURVE: P-256341 X509v3 extensions:342 X509v3 Key Usage: critical343 Digital Signature344 X509v3 Extended Key Usage: 345 TLS Web Server Authentication, TLS Web Client Authentication346 X509v3 Subject Key Identifier: 347 0B:97:22:58:11:45:49:B9:C9:C5:58:E4:4B:FA:AD:31:C8:18:BF:04348 X509v3 Authority Key Identifier: 349 AF:3D:FB:7F:3A:E2:22:0C:FC:17:43:CF:2B:14:28:42:1E:EC:D0:EF350 X509v3 Subject Alternative Name: 351 DNS:test.foo352 1.3.6.1.4.1.37476.9000.64.1: 353 0......acme..354 Signature Algorithm: ecdsa-with-SHA256355 Signature Value:356 30:44:02:20:21:79:27:69:74:d2:36:d1:37:ff:bf:28:c1:69:357 14:38:6e:08:ad:b6:37:7c:f8:3c:51:6a:71:08:f2:0e:9a:99:358 02:20:5d:b4:80:a9:a8:73:e5:a4:43:d1:95:37:59:96:d6:e5:359 7b:e3:4b:5d:cd:e1:47:93:0b:6e:33:55:e6:d3:30:d0360361362