container-test-run-certificates
checks.aarch64-linux.certificates
· build #993
· raw
1build01: building rak5ql5mna75j9qsa7vqmjrfljnsyfx0-container-test-run-certificates.drv2additionally exposed symbols:3 ca, client, server,4 start_all, machines, driver, Machine, wait_for_signal5Starting ca6Starting client7Starting server89101112<<< NixOS Stage 2 >>>1314booting system configuration /nix/store/6z3iq42222a1jwhydy5s76maw15rwmrz-nixos-system-ca-test15running activation script...16setting up /etc...172: host0@if5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100018 link/ether 42:06:76:42:a9:8d brd ff:ff:ff:ff:ff:ff link-netnsid 019setting up age secrets...20starting systemd...21systemd 260.5 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)22Detected virtualization systemd-nspawn.23Detected architecture arm64.24Detected first boot.25Initializing machine ID from container UUID.26Applying preset policy.27Populated /etc with preset unit settings.28Queued start job for default target Multi-User System.29303132<<< Welcome to NixOS test (aarch64) - console >>>33+ systemd-run /bin/sh -c '/nix/store/3l7ygqcc6v0rbi9d4j1m6phi6sz86j98-coreutils-9.11/bin/sleep 999999999 && echo 409db8b6-eb54-4d2b-bd2d-5cfd10921c82'34Running as unit: run-p466-i6148736.service; invocation ID: 37cfcee0d7e340d5a1d819d1a7ec34de35To attach to container ca run on the same machine that runs the test:36 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*409db8b6-eb54-4d2b-bd2d-5cfd10921c82') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 3738To inject external network and continue test, run:39sudo /nix/store/q1khrhbn506imjxx7kiqcbihycawa6kl-python3-3.13.15/bin/python3.13 /nix/store/qq5ppp119nyp6wdn1gi4pr1xkmgs2ny1-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 409db8b6-eb54-4d2b-bd2d-5cfd10921c824041<<< NixOS Stage 2 >>>4243booting system configuration /nix/store/5dc1i05pd0dh3mhqilyx2718c20mf4bq-nixos-system-client-test44running activation script...45setting up /etc...462: host0@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100047 link/ether 2a:42:35:28:b1:2f brd ff:ff:ff:ff:ff:ff link-netnsid 048setting up age secrets...49starting systemd...50systemd 260.5 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)51Detected virtualization systemd-nspawn.52Detected architecture arm64.53Detected first boot.54Initializing machine ID from container UUID.55Applying preset policy.56Populated /etc with preset unit settings.57Queued start job for default target Multi-User System.58596061<<< Welcome to NixOS test (aarch64) - console >>>62+ systemd-run /bin/sh -c '/nix/store/3l7ygqcc6v0rbi9d4j1m6phi6sz86j98-coreutils-9.11/bin/sleep 999999999 && echo e1b291c3-7399-429b-bc37-ee4f0048d86e'63Running as unit: run-p304-i6148739.service; invocation ID: 5edceaec3e704b10ba3da4cfa13e168e64To attach to container client run on the same machine that runs the test:65 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*e1b291c3-7399-429b-bc37-ee4f0048d86e') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 6667To inject external network and continue test, run:68sudo /nix/store/q1khrhbn506imjxx7kiqcbihycawa6kl-python3-3.13.15/bin/python3.13 /nix/store/qq5ppp119nyp6wdn1gi4pr1xkmgs2ny1-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py e1b291c3-7399-429b-bc37-ee4f0048d86e6970<<< NixOS Stage 2 >>>7172booting system configuration /nix/store/wy55n4f2y47i75qivfgarl4yf66d4q1r-nixos-system-server-test73running activation script...74setting up /etc...752: host0@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 100076 link/ether be:aa:dd:39:86:e7 brd ff:ff:ff:ff:ff:ff link-netnsid 077setting up age secrets...78starting systemd...79systemd 260.5 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)80Detected virtualization systemd-nspawn.81Detected architecture arm64.82Detected first boot.83Initializing machine ID from container UUID.84Applying preset policy.85Populated /etc with preset unit settings.86Queued start job for default target Multi-User System.87888990<<< Welcome to NixOS test (aarch64) - console >>>91+ systemd-run /bin/sh -c '/nix/store/3l7ygqcc6v0rbi9d4j1m6phi6sz86j98-coreutils-9.11/bin/sleep 999999999 && echo 714d9645-c300-4a7b-ae23-8c328d71d500'92Running as unit: run-p397-i6148795.service; invocation ID: 5c208ea0ef1c4355afe0b2db5802cc0093To attach to container server run on the same machine that runs the test:94 sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*714d9645-c300-4a7b-ae23-8c328d71d500') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 9596To inject external network and continue test, run:97sudo /nix/store/q1khrhbn506imjxx7kiqcbihycawa6kl-python3-3.13.15/bin/python3.13 /nix/store/qq5ppp119nyp6wdn1gi4pr1xkmgs2ny1-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 714d9645-c300-4a7b-ae23-8c328d71d50098+ systemctl restart acme-order-renew-ca.foo.service99+ systemctl restart acme-test.foo.service100client: waiting for success: curl -v https://test.foo101+ curl -v https://test.foo102* Host test.foo:443 was resolved.103* IPv6: (none)104* IPv4: 192.168.1.3105* Trying 192.168.1.3:443...106* ALPN: curl offers h2,http/1.1107} [5 bytes data]108* TLSv1.3 (OUT), TLS handshake, Client hello (1):109} [1552 bytes data]110* SSL Trust Anchors:111* OpenSSL default paths (fallback)112{ [5 bytes data]113* TLSv1.3 (IN), TLS handshake, Server hello (2):114{ [1210 bytes data]115* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):116{ [1 bytes data]117* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):118{ [19 bytes data]119* TLSv1.3 (IN), TLS handshake, Certificate (11):120{ [1009 bytes data]121* TLSv1.3 (IN), TLS handshake, CERT verify (15):122{ [111 bytes data]123* TLSv1.3 (IN), TLS handshake, Finished (20):124{ [52 bytes data]125* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):126} [1 bytes data]127* TLSv1.3 (OUT), TLS handshake, Finished (20):128} [52 bytes data]129* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey130* ALPN: server accepted h2131* Server certificate:132* subject: CN=test.foo133* start date: Oct 14 20:23:04 2026 GMT134* expire date: Nov 13 20:23:04 2028 GMT135* issuer: CN=minica root ca 0cd692136* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384137* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384138* subjectAltName: "test.foo" matches cert's "test.foo"139* OpenSSL verify result: 13140* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)141* closing connection #0142curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)143More details here: https://curl.se/docs/sslcerts.html144145curl failed to verify the legitimacy of the server and therefore could not146establish a secure connection to it. To learn more about this situation and147how to fix it, please visit the webpage mentioned above.148+ curl -v https://test.foo149* Host test.foo:443 was resolved.150* IPv6: (none)151* IPv4: 192.168.1.3152* Trying 192.168.1.3:443...153* ALPN: curl offers h2,http/1.1154} [5 bytes data]155* TLSv1.3 (OUT), TLS handshake, Client hello (1):156} [1552 bytes data]157* SSL Trust Anchors:158* OpenSSL default paths (fallback)159{ [5 bytes data]160* TLSv1.3 (IN), TLS handshake, Server hello (2):161{ [1210 bytes data]162* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):163{ [1 bytes data]164* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):165{ [19 bytes data]166* TLSv1.3 (IN), TLS handshake, Certificate (11):167{ [1009 bytes data]168* TLSv1.3 (IN), TLS handshake, CERT verify (15):169{ [111 bytes data]170* TLSv1.3 (IN), TLS handshake, Finished (20):171{ [52 bytes data]172* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):173} [1 bytes data]174* TLSv1.3 (OUT), TLS handshake, Finished (20):175} [52 bytes data]176* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey177* ALPN: server accepted h2178* Server certificate:179* subject: CN=test.foo180* start date: Oct 14 20:23:04 2026 GMT181* expire date: Nov 13 20:23:04 2028 GMT182* issuer: CN=minica root ca 0cd692183* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384184* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384185* subjectAltName: "test.foo" matches cert's "test.foo"186* OpenSSL verify result: 13187* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)188* closing connection #0189curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)190More details here: https://curl.se/docs/sslcerts.html191192curl failed to verify the legitimacy of the server and therefore could not193establish a secure connection to it. To learn more about this situation and194how to fix it, please visit the webpage mentioned above.195+ curl -v https://test.foo196* Host test.foo:443 was resolved.197* IPv6: (none)198* IPv4: 192.168.1.3199* Trying 192.168.1.3:443...200* ALPN: curl offers h2,http/1.1201} [5 bytes data]202* TLSv1.3 (OUT), TLS handshake, Client hello (1):203} [1552 bytes data]204* SSL Trust Anchors:205* OpenSSL default paths (fallback)206{ [5 bytes data]207* TLSv1.3 (IN), TLS handshake, Server hello (2):208{ [1210 bytes data]209* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):210{ [1 bytes data]211* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):212{ [19 bytes data]213* TLSv1.3 (IN), TLS handshake, Certificate (11):214{ [1009 bytes data]215* TLSv1.3 (IN), TLS handshake, CERT verify (15):216{ [111 bytes data]217* TLSv1.3 (IN), TLS handshake, Finished (20):218{ [52 bytes data]219* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):220} [1 bytes data]221* TLSv1.3 (OUT), TLS handshake, Finished (20):222} [52 bytes data]223* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey224* ALPN: server accepted h2225* Server certificate:226* subject: CN=test.foo227* start date: Oct 14 20:23:04 2026 GMT228* expire date: Nov 13 20:23:04 2028 GMT229* issuer: CN=minica root ca 0cd692230* Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384231* Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384232* subjectAltName: "test.foo" matches cert's "test.foo"233* OpenSSL verify result: 13234* SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)235* closing connection #0236curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)237More details here: https://curl.se/docs/sslcerts.html238239curl failed to verify the legitimacy of the server and therefore could not240establish a secure connection to it. To learn more about this situation and241how to fix it, please visit the webpage mentioned above.242+ curl -v https://test.foo243* Host test.foo:443 was resolved.244* IPv6: (none)245* IPv4: 192.168.1.3246* Trying 192.168.1.3:443...247* ALPN: curl offers h2,http/1.1248} [5 bytes data]249* TLSv1.3 (OUT), TLS handshake, Client hello (1):250} [1552 bytes data]251* SSL Trust Anchors:252* OpenSSL default paths (fallback)253{ [5 bytes data]254* TLSv1.3 (IN), TLS handshake, Server hello (2):255{ [1210 bytes data]256* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):257{ [1 bytes data]258* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):259{ [19 bytes data]260* TLSv1.3 (IN), TLS handshake, Certificate (11):261{ [932 bytes data]262* TLSv1.3 (IN), TLS handshake, CERT verify (15):263{ [79 bytes data]264* TLSv1.3 (IN), TLS handshake, Finished (20):265{ [52 bytes data]266* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):267} [1 bytes data]268* TLSv1.3 (OUT), TLS handshake, Finished (20):269} [52 bytes data]270* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey271* ALPN: server accepted h2272* Server certificate:273* subject: CN=test.foo274* start date: Oct 14 20:22:17 2026 GMT275* expire date: Jan 12 20:23:17 2027 GMT276* issuer: CN=Clan Intermediate CA277* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256278* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256279* Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256280* subjectAltName: "test.foo" matches cert's "test.foo"281* OpenSSL verify result: 0282* SSL certificate verified via OpenSSL.283* Established connection to test.foo (192.168.1.3 port 443) from 192.168.1.2 port 54716 284 % Total % Received % Xferd Average Speed Time Time Time Current285 Dload Upload Total Spent Left Speed286 0 0 0 0 0 0 0 0 0* using HTTP/2287* [HTTP/2] [1] OPENED stream for https://test.foo/288* [HTTP/2] [1] [:method: GET]289* [HTTP/2] [1] [:scheme: https]290* [HTTP/2] [1] [:authority: test.foo]291* [HTTP/2] [1] [:path: /]292* [HTTP/2] [1] [user-agent: curl/8.22.0]293* [HTTP/2] [1] [accept: */*]294} [5 bytes data]295296297298299300* Request completely sent off301{ [5 bytes data]302* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):303{ [265 bytes data]304* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):305{ [265 bytes data]306307308309310311312313{ [5 bytes data]314100 20 100 20 0 0 662 0 0315* Connection #0 to host test.foo:443 left intact316(finished: waiting for success: curl -v https://test.foo, in 3.19 seconds)317+ openssl s_client -connect test.foo:443 -servername test.foo318+ openssl x509 -text -noout319Certificate:320 Data:321 Version: 3 (0x2)322 Serial Number:323 51:7a:00:ab:a8:c9:29:50:15:35:93:63:c5:0f:fc:28324 Signature Algorithm: ecdsa-with-SHA256325 Issuer: CN=Clan Intermediate CA326 Validity327 Not Before: Oct 14 20:22:17 2026 GMT328 Not After : Jan 12 20:23:17 2027 GMT329 Subject: CN=test.foo330 Subject Public Key Info:331 Public Key Algorithm: id-ecPublicKey332 Public-Key: (256 bit)333 pub:334 04:66:1e:48:2e:c3:52:71:3a:d2:81:dd:a5:d6:89:335 3c:96:27:0d:38:1c:49:b1:ee:27:c6:d2:6e:9d:3c:336 6a:a6:f8:e4:df:e1:5a:c3:2d:0e:02:98:51:59:51:337 40:0b:0c:3c:72:5b:77:8b:7b:1b:8f:97:f1:b2:ac:338 f8:4d:51:2e:5e339 ASN1 OID: prime256v1340 NIST CURVE: P-256341 X509v3 extensions:342 X509v3 Key Usage: critical343 Digital Signature344 X509v3 Extended Key Usage: 345 TLS Web Server Authentication, TLS Web Client Authentication346 X509v3 Subject Key Identifier: 347 C5:CE:D6:E7:64:4F:D5:9F:0F:D6:C4:79:37:A4:EA:B0:13:41:D8:B4348 X509v3 Authority Key Identifier: 349 AF:3D:FB:7F:3A:E2:22:0C:FC:17:43:CF:2B:14:28:42:1E:EC:D0:EF350 X509v3 Subject Alternative Name: 351 DNS:test.foo352 1.3.6.1.4.1.37476.9000.64.1: 353 0......acme..354 Signature Algorithm: ecdsa-with-SHA256355 Signature Value:356 30:46:02:21:00:94:b0:83:72:55:b6:99:51:9a:83:0e:3c:83:357 fa:25:62:7f:17:e3:9f:2d:ed:fb:5d:b5:7e:51:e1:ac:4a:b4:358 2e:02:21:00:d5:2b:7d:3e:02:f0:fd:2a:8a:97:7d:52:3d:22:359 8d:8e:1f:db:ba:13:84:15:cd:24:d5:79:ee:48:08:95:dd:26360361362