these 101 derivations will be built: /nix/store/wv8vgnihxdgkmjxdh69ldvls34lgnnnh-nix.conf.drv /nix/store/w8plfsw8r0p13h4jllf03d9zm9yqpv96-X-Restart-Triggers-nix-daemon.drv /nix/store/00d99j379f788lp2jjh8nj03gnm6bcyp-unit-nix-daemon.service.drv /nix/store/055s60d6gz8yc81d3xn3sc1h67naf76w-dbus-1.drv /nix/store/095kn3p66q8l481w2x0vla119ly1bdy7-system-path.drv /nix/store/1c8nkwl2xabgwgk9vz7l2zqnlhjgff16-run-client-nspawn.drv /nix/store/1i5rws06hm619d289pillh20vld4i1sx-ensure-wrapper-integrity.drv /nix/store/1lk62n1xbcccbl4c0zbq5wi3azriwang-etc.drv /nix/store/1xi35qd7zdvi39jf9s7f6334y6a1y39a-acme-postrun.drv /nix/store/fyb0k139crccdy53i9r10ycgx30lddlk-tmpfiles.d.drv /nix/store/3sl1lznwrmym00dmas5yqkz50npaj2p9-X-Restart-Triggers-systemd-tmpfiles-resetup.drv /nix/store/1zrv7kbgil15wkbfz1arxb1xjl712lhg-unit-systemd-tmpfiles-resetup.service.drv /nix/store/241zqcpbjvm4qpzgnign2givzn5gnrfj-unit-script-acme-test.foo-start.drv /nix/store/wn4z014r3d33wzkhnjbkqdr30lhc8f50-nginx.conf.drv /nix/store/bsl3csnzab6adb8wp7ws79y61v8hqnpv-unit-script-nginx-pre-start.drv /nix/store/2an63x16ji9y5blrwbwff847f2zqnqaa-unit-nginx.service.drv /nix/store/2h4vh79dwmchkjj3dyzl80nk32px9in5-unit-acme-account-2c44cb477b4787b2cf13.target.drv /nix/store/3d2lsn545v2cr03jn64zssssgjyr18bg-unit-script-nix-gc-start.drv /nix/store/3z1rbqv3fmjlix16dhlh37fb3rsbj1vl-acme-setup-privileged.drv /nix/store/4hx2waaf3ss54dhrahfymxrfp6p6jcnz-unit-nginx-config-reload.service.drv /nix/store/4kzs1vgqx43dlllqp3c8ks5rvjvzwzr2-unit-script-acme-order-renew-test.foo-start.drv /nix/store/4p8lvv77jvq39wd7vhn6xhnm9gagwn6i-nginx.conf.drv /nix/store/wg4lq67n04brfzrv7f34s52k5zha3ssv-X-Restart-Triggers-step-ca.drv /nix/store/4y4037jfxwnz15yxjw1y7dpr9msx4np5-unit-step-ca.service.drv /nix/store/szxcpvwgr74z6wvycdcb6x1warwwskdn-firewall-start.drv /nix/store/537y3yanxipw0f0vxm2g3nyi498d1q72-firewall-reload.drv /nix/store/54gkiq79j1aaai5nhkv25dyk0b0dp906-acme-postrun.drv /nix/store/58qf201hr8gizzal3vx1888dd6gs58ry-nixos-test-driver-certificates.drv /nix/store/5swb5mdmnm01rs80c37i5s9by315l2x4-acme-setup-privileged.drv /nix/store/5zwipm2i2z6h1m04yjg902mqm9bqypdm-unit-acme-renew-test.foo.timer.drv /nix/store/clxi8adp487m80kwn1acl5qnh8hn5pkj-stage-2-init.sh.drv /nix/store/f71nm8c2fbv4kldn6xg7sx9k5ybran3l-system-path.drv /nix/store/ix8qya0qhff9nqb09hhkmigi87xzbwmv-activate.drv /nix/store/6cqb86hz0z5chrxvf17jmx9m8nwwbvfl-nixos-system-server-test.drv /nix/store/734cqcl6kqvgqdn03pjhxxds4w94bjb1-unit-acme-order-renew-test.foo.service.drv /nix/store/74432pjg6w0hdxn7arayk8xxjmv58ryl-run-server-nspawn.drv /nix/store/7mksb43vhzgyp2gsp6zx6hvb8iikj2ri-system-path.drv /nix/store/a80cwk9xjw0ivray4bmcpbrjphw7x5sk-unit-40-eth1.network.drv /nix/store/7pmalg4ias0nsnzdcv602jmgl24wfxps-X-Reload-Triggers-systemd-networkd.drv /nix/store/7smmf7x388i18lbykks9xhl24ll3k5wz-unit-acme-setup.service.drv /nix/store/8cr1ylkpc3j12nxvp45af4k2syxz81n8-system-units.drv /nix/store/8f5a3arkyxqbqqbix0hpkd6db0j3k8j9-unit-nix-optimise.service.drv /nix/store/8syqxjkirdf7w8znbrh0xmgzbjikl3zm-nixos-system-ca-test.drv /nix/store/9hn98z6rq2bydflj9frbdzbmpjjpwl2b-etc.drv /nix/store/9hpzj734nz40lvrj17nx0g34hg2xalz7-extra-hosts.drv /nix/store/k6lq96nmkrk2s98hjvyrjkhzpyplqiv0-unit-dbus-broker.service.drv /nix/store/b5l6ji1i62hbi0319g96nqys0287ldsd-user-units.drv /nix/store/jf33ljbml0x1jdjrqvg484g3wg86idl1-string-hosts.drv /nix/store/gf02njpqixzkbg3hv2z3hpbir3mvj3h3-hosts.drv /nix/store/jsncb8d2741xgx6zja04gx6js4pdyp7r-etc-hostname.drv /nix/store/l3a55d79hqnf7yr4iikmj02rnn57wfqq-dbus-1.drv /nix/store/wyxb4dvl30k4gkfbhig79d19fa139zyi-X-Restart-Triggers-dbus-broker.drv /nix/store/ckzzg9v556pdf7qvj0q7az34rpgsw1ah-unit-dbus-broker.service.drv /nix/store/r0857r1f43b6xshm8jdjjhc1wnywp8rb-unit-nix-gc.service.drv /nix/store/m19fvfd5hh27vdfdi8pwpib0c3s9hy3v-system-units.drv /nix/store/9xw4p2d81zaybqaf12a48cxz16bgbppx-etc.drv /nix/store/a36b5xlw0nzj326wr9jlp693958hmbl3-user-units.drv /nix/store/a3q6xz18027882ksgl2ypqmjbg3hvmcw-string-hosts.drv /nix/store/a79l69vfhnyab3ivgbfm7yfy3vgmn7sj-system-units.drv /nix/store/avh7iq6pxfflvv71jma3dsqywxcdwg90-system-generators.drv /nix/store/b4rfjh6vn5mfr5whkx5nivb7y01zlf42-string-hosts.drv /nix/store/b5idh8mcja29mkz02xs3fbb0665w4lcb-unit-acme-account-d22a46d9459bf683a338.target.drv /nix/store/bc5gipm9431wbp4jg8rl34xjphz065p6-unit-script-acme-order-renew-ca.foo-start.drv /nix/store/bf7r81nvvh4y736ddw4g53zgvamczfyj-container-test-run-certificates.drv /nix/store/dwf27gldd6y2cwp69z10g8aqzrf0lcq4-X-Restart-Triggers-acme-test.foo.drv /nix/store/bp90shrw7gi58pkz1qp2k9zcjdi6c7wc-unit-acme-test.foo.service.drv /nix/store/d1zyxic95qr7b3lc6ywmdhaajgfsz58k-unit-script-acme-ca.foo-start.drv /nix/store/d76pxvc0fxpd58pj4vgazn7r3mj40krl-user-generators.drv /nix/store/fcghnpbwvjz2sxsd5483pdyfmrmm753l-unit-acme-order-renew-ca.foo.service.drv /nix/store/fxnqf6cza9ibnwj1dq2linzdq88kaddr-unit-acme-renew-ca.foo.timer.drv /nix/store/gicgxddkzs9ygh4ga9lc1fynfyfnv4mx-hosts.drv /nix/store/gsrl0r7y8c3a4df0h9y9imrygqfs5v4q-unit-acme-setup.service.drv /nix/store/hq62i7jg6nvhzbv4bxs1zcvnfhyiy26i-hosts.drv /nix/store/jlc2zn98ndwkj9vwzway9bsm1b42k10k-unit-firewall.service.drv /nix/store/kapji1mpxap3k20vmw1jn03g7900i8m8-activate.drv /nix/store/k3jly0v0nmwh38yqjzc3c62j51xh6q3h-nixos-system-client-test.drv /nix/store/p2c9mgnapypf4ac1zz2c3z2dr5q4hxsd-X-Restart-Triggers-acme-ca.foo.drv /nix/store/k60vzvk5p8f0aayrj658ja600pn7cp5v-unit-acme-ca.foo.service.drv /nix/store/lb9zgcxyamghdh9rc7zcknccmq7qhplh-unit-systemd-networkd.service.drv /nix/store/lc86hl44bkd9pcjimajcir4m74cwcrx4-unit-dbus-broker.service.drv /nix/store/ljb9rwr43i71g95zahvwkirfsackh7mw-dbus-1.drv /nix/store/ryy1zpsvxkdfb5wwjap0pyxwnyc063yj-unit-script-nginx-pre-start.drv /nix/store/lrfjn4bmkrfh9gsnkwd0wm533rng1xqk-unit-nginx.service.drv /nix/store/m8pjrq9nxvby17mf4g3zq8wf90lcip44-unit-nginx-config-reload.service.drv /nix/store/mhjaqbrsniggj6scc2siy84klk4135fw-tmpfiles.d.drv /nix/store/mk60r1q5mf11ccg7a3s129ygqzxfkgs9-X-Restart-Triggers-dbus-broker.drv /nix/store/n4avyxa8w73sc953hxgdz3q3fn8adg0j-system-shutdown.drv /nix/store/njm9s03z3pnjb9lrc00yf3z73rwzy7jg-unit-dbus-broker.service.drv /nix/store/phalf4v5ip6j2w4g01wqyczmp2pmxwf9-driverConfiguration.json.drv /nix/store/prcjpflcqr50zy2wjmqv2y48qydar476-X-Restart-Triggers-systemd-tmpfiles-resetup.drv /nix/store/pwmclwmadbby7yzpv3c5dzjmzcq6j9b5-activate.drv /nix/store/qlq36rimqjyyfz37xf71961mlflwsb7i-test-script.drv /nix/store/qpbfbb3bpjjgwvyvss1mxh5dxwi1wnl7-X-Restart-Triggers-dbus-broker.drv /nix/store/rmc7fird5619w2nhxric6vlw5bgzi06y-unit-systemd-tmpfiles-resetup.service.drv /nix/store/vnrx1020r3vi27401rk1sfrd7qlw6yz5-unit-dbus-broker.service.drv /nix/store/xhv4abv4yra7n3fymxkxaxirz9r6ydwb-users-groups.json.drv /nix/store/y16ily75d16q3w6imszl7s3iswiqd1gl-run-ca-nspawn.drv /nix/store/y9fs414xl5x0ffwgjn4rpc28255cdhrg-etc-hostname.drv /nix/store/yakwbjjqv7mzyydyqna2p5bfk607pwkj-user-units.drv /nix/store/yilfk4h1b2hx1spwhbwcphwxc1gbkhq8-users-groups.json.drv /nix/store/ykzjssg36f99mdxpignzmgv8ywn3d9wr-unit-dbus-broker.service.drv these 21 paths will be fetched (0.0 KiB download, 111.5 MiB unpacked): /nix/store/a6nm7lyn7d8dv874n9p9q6lpiz0qfdbx-55-nixos-aslr-entropy.conf /nix/store/lz88x3gqghhlgif2x0pd9kzrypxbg7a6-ca.json /nix/store/lq8wgjssygk5w5abljmf8f9xkrsjvkrl-decrypt-age-secrets /nix/store/97jdkdliwdh19wv2cirj6mgngk8y4sw1-dry-activate /nix/store/kc6zr3pbbw6v717z980s7r0mclqhz334-dry-activate /nix/store/wr5hnfd0vcvnmlp2zb58j6mzidcbirgn-dry-activate /nix/store/sdfw3p1hqbys3swld4i8vgqfd0rahk7y-nixos-option-26.11 /nix/store/bdi8gqha052kx0ip9s2858an18l069dg-nixos-rebuild-ng-26.11 /nix/store/jjnpzllqpcg83qvmj4w6cmqb1zcqvrvl-nixos-test-driver-1.1 /nix/store/vprmygss2b0zj7dvwvxrmns8b0d1ikx7-nss-cacert-3.126 /nix/store/m39wdsr1n97fbj8vfs56b2z1hv576rqb-nss-cacert-3.126-p11kit /nix/store/cf5xgr3rpmzxc20laa7204y8dzvzr54p-python3.14-nixos-test-lib-1.0.0 /nix/store/40761fl0xwqip0pgx23na05yzcixfvci-run-nspawn-1.0 /nix/store/g63l2h0ydzm30i88g655xa6zn6q8pf0g-step-ca-0.30.2 /nix/store/hsqdsi77zr22z49c4l41n4m4swzrznd9-system-generators /nix/store/72cf7jswn6a62li19blq3kfr0kn3k2ks-system-shutdown /nix/store/ddlhcc7r0n81dhhnm9jz6q2m10zxc7pj-ty-0.0.86 /nix/store/0w3r1qr3ggw4006k4yxxxkhw7ddwjahd-user-generators /nix/store/3z93q7qrvp6nx28dk2cnsi9gjakz6psb-users-groups.json /nix/store/mxsdpqdf6amjhrax9c83ldkc0vbvz02f-users-groups.json /nix/store/mr0kzd06i0hz0r10g7phs7dwqlwd1r2i-vars-check-certificates warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/00d99j379f788lp2jjh8nj03gnm6bcyp-unit-nix-daemon.service.drv' on nix-store.geninf.io:50051 unit-nix-daemon.service> build-x86-01: building 00d99j379f788lp2jjh8nj03gnm6bcyp-unit-nix-daemon.service.drv building '/nix/store/avh7iq6pxfflvv71jma3dsqywxcdwg90-system-generators.drv' on nix-store.geninf.io:50051 system-generators> build-x86-01: building avh7iq6pxfflvv71jma3dsqywxcdwg90-system-generators.drv building '/nix/store/d76pxvc0fxpd58pj4vgazn7r3mj40krl-user-generators.drv' on nix-store.geninf.io:50051 user-generators> build-x86-01: building d76pxvc0fxpd58pj4vgazn7r3mj40krl-user-generators.drv building '/nix/store/7mksb43vhzgyp2gsp6zx6hvb8iikj2ri-system-path.drv' on nix-store.geninf.io:50051 system-path> build-x86-01: building 7mksb43vhzgyp2gsp6zx6hvb8iikj2ri-system-path.drv building '/nix/store/095kn3p66q8l481w2x0vla119ly1bdy7-system-path.drv' on nix-store.geninf.io:50051 system-path> build-x86-01: building 095kn3p66q8l481w2x0vla119ly1bdy7-system-path.drv building '/nix/store/f71nm8c2fbv4kldn6xg7sx9k5ybran3l-system-path.drv' on nix-store.geninf.io:50051 system-path> build-x86-01: building f71nm8c2fbv4kldn6xg7sx9k5ybran3l-system-path.drv unit-nix-daemon.service> structuredAttrs is enabled system-path> structuredAttrs is enabled system-path> structuredAttrs is enabled system-path> structuredAttrs is enabled system-path> created 1721 symlinks in user environment system-path> created 1721 symlinks in user environment system-path> created 1721 symlinks in user environment building '/nix/store/n4avyxa8w73sc953hxgdz3q3fn8adg0j-system-shutdown.drv' on nix-store.geninf.io:50051 system-shutdown> web01: building n4avyxa8w73sc953hxgdz3q3fn8adg0j-system-shutdown.drv building '/nix/store/l3a55d79hqnf7yr4iikmj02rnn57wfqq-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build-x86-01: building l3a55d79hqnf7yr4iikmj02rnn57wfqq-dbus-1.drv building '/nix/store/ljb9rwr43i71g95zahvwkirfsackh7mw-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build-x86-01: building ljb9rwr43i71g95zahvwkirfsackh7mw-dbus-1.drv building '/nix/store/055s60d6gz8yc81d3xn3sc1h67naf76w-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build-x86-01: building 055s60d6gz8yc81d3xn3sc1h67naf76w-dbus-1.drv building '/nix/store/mk60r1q5mf11ccg7a3s129ygqzxfkgs9-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build-x86-01: building mk60r1q5mf11ccg7a3s129ygqzxfkgs9-X-Restart-Triggers-dbus-broker.drv building '/nix/store/wyxb4dvl30k4gkfbhig79d19fa139zyi-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build-x86-01: building wyxb4dvl30k4gkfbhig79d19fa139zyi-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/qpbfbb3bpjjgwvyvss1mxh5dxwi1wnl7-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build-x86-01: building qpbfbb3bpjjgwvyvss1mxh5dxwi1wnl7-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/lc86hl44bkd9pcjimajcir4m74cwcrx4-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building lc86hl44bkd9pcjimajcir4m74cwcrx4-unit-dbus-broker.service.drv building '/nix/store/ykzjssg36f99mdxpignzmgv8ywn3d9wr-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building ykzjssg36f99mdxpignzmgv8ywn3d9wr-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/k6lq96nmkrk2s98hjvyrjkhzpyplqiv0-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building k6lq96nmkrk2s98hjvyrjkhzpyplqiv0-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/vnrx1020r3vi27401rk1sfrd7qlw6yz5-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building vnrx1020r3vi27401rk1sfrd7qlw6yz5-unit-dbus-broker.service.drv building '/nix/store/njm9s03z3pnjb9lrc00yf3z73rwzy7jg-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building njm9s03z3pnjb9lrc00yf3z73rwzy7jg-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/ckzzg9v556pdf7qvj0q7az34rpgsw1ah-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> gi-build-x86-02: building ckzzg9v556pdf7qvj0q7az34rpgsw1ah-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/8cr1ylkpc3j12nxvp45af4k2syxz81n8-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building 8cr1ylkpc3j12nxvp45af4k2syxz81n8-system-units.drv building '/nix/store/a36b5xlw0nzj326wr9jlp693958hmbl3-user-units.drv' on nix-store.geninf.io:50051 user-units> build-x86-01: building a36b5xlw0nzj326wr9jlp693958hmbl3-user-units.drv building '/nix/store/b5l6ji1i62hbi0319g96nqys0287ldsd-user-units.drv' on nix-store.geninf.io:50051 user-units> build-x86-01: building b5l6ji1i62hbi0319g96nqys0287ldsd-user-units.drv building '/nix/store/a79l69vfhnyab3ivgbfm7yfy3vgmn7sj-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building a79l69vfhnyab3ivgbfm7yfy3vgmn7sj-system-units.drv building '/nix/store/yakwbjjqv7mzyydyqna2p5bfk607pwkj-user-units.drv' on nix-store.geninf.io:50051 user-units> build-x86-01: building yakwbjjqv7mzyydyqna2p5bfk607pwkj-user-units.drv building '/nix/store/9hn98z6rq2bydflj9frbdzbmpjjpwl2b-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building 9hn98z6rq2bydflj9frbdzbmpjjpwl2b-etc.drv building '/nix/store/1lk62n1xbcccbl4c0zbq5wi3azriwang-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building 1lk62n1xbcccbl4c0zbq5wi3azriwang-etc.drv building '/nix/store/pwmclwmadbby7yzpv3c5dzjmzcq6j9b5-activate.drv' on nix-store.geninf.io:50051 activate> build-x86-01: building pwmclwmadbby7yzpv3c5dzjmzcq6j9b5-activate.drv activate> structuredAttrs is enabled building '/nix/store/m19fvfd5hh27vdfdi8pwpib0c3s9hy3v-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building m19fvfd5hh27vdfdi8pwpib0c3s9hy3v-system-units.drv building '/nix/store/ix8qya0qhff9nqb09hhkmigi87xzbwmv-activate.drv' on nix-store.geninf.io:50051 activate> build-x86-01: building ix8qya0qhff9nqb09hhkmigi87xzbwmv-activate.drv building '/nix/store/8syqxjkirdf7w8znbrh0xmgzbjikl3zm-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> build-x86-01: building 8syqxjkirdf7w8znbrh0xmgzbjikl3zm-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled activate> structuredAttrs is enabled building '/nix/store/9xw4p2d81zaybqaf12a48cxz16bgbppx-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building 9xw4p2d81zaybqaf12a48cxz16bgbppx-etc.drv building '/nix/store/y16ily75d16q3w6imszl7s3iswiqd1gl-run-ca-nspawn.drv' on nix-store.geninf.io:50051 run-ca-nspawn> build-x86-01: building y16ily75d16q3w6imszl7s3iswiqd1gl-run-ca-nspawn.drv building '/nix/store/6cqb86hz0z5chrxvf17jmx9m8nwwbvfl-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> build-x86-01: building 6cqb86hz0z5chrxvf17jmx9m8nwwbvfl-nixos-system-server-test.drv nixos-system-server-test> structuredAttrs is enabled building '/nix/store/kapji1mpxap3k20vmw1jn03g7900i8m8-activate.drv' on nix-store.geninf.io:50051 activate> build-x86-01: building kapji1mpxap3k20vmw1jn03g7900i8m8-activate.drv building '/nix/store/74432pjg6w0hdxn7arayk8xxjmv58ryl-run-server-nspawn.drv' on nix-store.geninf.io:50051 run-server-nspawn> build-x86-01: building 74432pjg6w0hdxn7arayk8xxjmv58ryl-run-server-nspawn.drv activate> structuredAttrs is enabled building '/nix/store/k3jly0v0nmwh38yqjzc3c62j51xh6q3h-nixos-system-client-test.drv' on nix-store.geninf.io:50051 nixos-system-client-test> build-x86-01: building k3jly0v0nmwh38yqjzc3c62j51xh6q3h-nixos-system-client-test.drv nixos-system-client-test> structuredAttrs is enabled building '/nix/store/1c8nkwl2xabgwgk9vz7l2zqnlhjgff16-run-client-nspawn.drv' on nix-store.geninf.io:50051 run-client-nspawn> build-x86-01: building 1c8nkwl2xabgwgk9vz7l2zqnlhjgff16-run-client-nspawn.drv building '/nix/store/phalf4v5ip6j2w4g01wqyczmp2pmxwf9-driverConfiguration.json.drv' on nix-store.geninf.io:50051 driverConfiguration.json> build-x86-01: building phalf4v5ip6j2w4g01wqyczmp2pmxwf9-driverConfiguration.json.drv driverConfiguration.json> structuredAttrs is enabled building '/nix/store/58qf201hr8gizzal3vx1888dd6gs58ry-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> build-x86-01: building 58qf201hr8gizzal3vx1888dd6gs58ry-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/bf7r81nvvh4y736ddw4g53zgvamczfyj-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build-x86-01: building bf7r81nvvh4y736ddw4g53zgvamczfyj-container-test-run-certificates.drv container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [540603.543296] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [540603.543343] ca systemd-journald[81]: Runtime Journal (/run/log/journal/d48395ce74f3456bbd2822c0ff01d517) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [540603.567575] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [540603.592265] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [540603.607251] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [540603.607613] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [540603.607906] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [540603.612696] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/d48395ce74f3456bbd2822c0ff01d517 is 1.501ms for 7 entries. container-test-run-certificates> ca # [540603.612696] ca systemd-journald[81]: System Journal (/var/log/journal/d48395ce74f3456bbd2822c0ff01d517) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [540603.626571] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [540603.627058] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [540603.627123] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [540603.627632] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [540603.627661] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [540603.628166] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [540603.628184] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [540603.629555] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [540603.629622] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [540603.629756] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [540603.630264] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [540603.668305] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [540603.669055] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [540603.694054] ca systemd-tmpfiles[192]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [540603.694262] ca systemd-tmpfiles[192]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [540603.694399] ca systemd-tmpfiles[192]: fchmod() of /var/log/journal/d48395ce74f3456bbd2822c0ff01d517 failed: Operation not permitted container-test-run-certificates> ca # [540603.694603] ca systemd-tmpfiles[192]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [540603.695497] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [540603.696029] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [540603.696346] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [540603.702775] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [540603.708071] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [540603.708482] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [540603.713196] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [540604.253137] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [540604.445309] ca systemd-networkd[188]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [540604.445392] ca systemd-networkd[188]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [540604.458009] ca systemd-networkd[188]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [540604.458186] ca systemd-networkd[188]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [540604.458282] ca systemd-networkd[188]: lo: Link UP container-test-run-certificates> ca # [540604.458287] ca systemd-networkd[188]: lo: Gained carrier container-test-run-certificates> ca # [540604.458448] ca systemd-networkd[188]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [540604.458748] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [540604.478438] ca systemd-networkd[188]: eth1: Link UP container-test-run-certificates> ca # [540604.478603] ca systemd-networkd[188]: eth1: Gained carrier container-test-run-certificates> ca # [540604.478618] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [540604.498217] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [540604.540583] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [540605.023654] ca systemd-resolved[162]: Positive Trust Anchors: container-test-run-certificates> ca # [540605.023662] ca systemd-resolved[162]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [540605.023665] ca systemd-resolved[162]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [540605.023680] ca systemd-resolved[162]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [540605.033879] ca systemd-resolved[162]: Using system hostname 'ca'. container-test-run-certificates> ca # [540605.034756] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [540605.034818] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [540605.034859] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [540605.034889] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [540605.035063] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [540605.035083] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [540605.035098] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [540605.035114] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [540605.035210] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [540605.035287] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [540605.035373] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [540605.035388] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [540605.035413] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [540605.036388] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [540605.036893] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [540605.036916] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [540605.037427] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [540605.037959] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [540605.038734] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [540605.073743] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [540605.173114] ca acme-setup-privileged[204]: + set -euo pipefail container-test-run-certificates> ca # [540605.173114] ca acme-setup-privileged[204]: + cd /var/lib/acme container-test-run-certificates> ca # [540605.173397] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [540605.173946] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [540605.174772] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [540605.174786] ca acme-setup-privileged[204]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [540605.174786] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [540605.174808] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [540605.202469] ca nsncd[206]: Oct 15 15:12:26.114 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [540605.202496] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [540605.202545] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [540605.202585] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [540605.203214] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [540605.203565] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [540605.211097] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [540605.211864] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [540605.211891] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [540605.211904] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [540605.392539] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [540605.392899] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [540605.392899] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/lsc0b0562pij6ss7kcz6xi3ics1q6i9l-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [540605.393164] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [540605.397765] ca dbus-broker-launch[208]: Ready container-test-run-certificates> ca # [540605.759076] ca systemd-networkd[188]: eth1: Gained IPv6LL container-test-run-certificates> ca # [540606.032416] ca systemd-logind[233]: New seat seat0. container-test-run-certificates> ca # [540606.032580] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [540606.033656] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [540606.051184] ca acme-setup-start[222]: + set -euo pipefail container-test-run-certificates> ca # [540606.051184] ca acme-setup-start[222]: + test -e ca/key.pem container-test-run-certificates> ca # [540606.051478] ca acme-setup-start[222]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [540606.058381] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [540606.058525] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [540606.058839] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [540606.059961] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [540606.449865] ca step-ca[207]: badger 2026/10/15 15:12:27 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [540606.452156] ca step-ca[207]: 2026/10/15 15:12:27 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [540606.454530] ca step-ca[207]: 2026/10/15 15:12:27 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [540606.454530] ca step-ca[207]: 2026/10/15 15:12:27 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [540606.454530] ca step-ca[207]: 2026/10/15 15:12:27 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [540606.454530] ca step-ca[207]: 2026/10/15 15:12:27 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [540606.454613] ca step-ca[207]: 2026/10/15 15:12:27 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [540606.454613] ca step-ca[207]: 2026/10/15 15:12:27 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [540606.454613] ca step-ca[207]: 2026/10/15 15:12:27 X.509 Root Fingerprint: a6b7094ed9cada697e81c0c71bac4084aeeeedb2924b510c8013be30b218b4ae container-test-run-certificates> ca # [540606.454694] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [540606.454743] ca step-ca[207]: 2026/10/15 15:12:27 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [540606.914920] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [540606.916531] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [540606.916550] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [540606.920930] ca acme-ca.foo-start[284]: + cd ca.foo container-test-run-certificates> ca # [540606.921111] ca acme-ca.foo-start[284]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [540606.921711] ca acme-ca.foo-start[285]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [540606.921832] ca acme-ca.foo-start[284]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [540606.922422] ca acme-ca.foo-start[284]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [540606.922535] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [540606.923329] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [540606.924077] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [540606.924922] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [540606.924922] ca acme-ca.foo-start[259]: + '[' -d out ']' container-test-run-certificates> ca # [540606.924972] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [540606.925759] ca acme-ca.foo-start[259]: + chown -R acme:nginx out container-test-run-certificates> ca # [540606.927376] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [540606.927376] ca acme-ca.foo-start[259]: + '[' -d certificates ']' container-test-run-certificates> ca # [540606.931409] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [540606.932170] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [540607.660068] ca nginx-pre-start[296]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [540607.660432] ca nginx-pre-start[296]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [540607.664025] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [540607.664332] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [540607.664997] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [540608.352172] ca acme-order-renew-ca.foo-start[299]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [540608.353616] ca acme-order-renew-ca.foo-start[299]: + set -euo pipefail container-test-run-certificates> ca # [540608.353669] ca acme-order-renew-ca.foo-start[299]: + exec container-test-run-certificates> ca # [540608.353700] ca acme-order-renew-ca.foo-start[299]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [540608.354363] ca acme-order-renew-ca.foo-start[310]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [540608.355659] ca acme-order-renew-ca.foo-start[299]: + '[' -n '' ']' container-test-run-certificates> ca # [540608.355694] ca acme-order-renew-ca.foo-start[299]: + exec container-test-run-certificates> ca # [540608.355732] ca acme-order-renew-ca.foo-start[299]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [540608.355758] ca acme-order-renew-ca.foo-start[299]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [540608.365070] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.277234403Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [540608.379725] ca step-ca[207]: time="2026-10-15T15:12:29Z" level=info duration="83.207µs" duration-ns=83207 fields.time="2026-10-15T15:12:29Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=607b9547-7812-4574-ad6e-5b93054c6206 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540608.379955] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.292130451Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [540608.449505] ca step-ca[207]: time="2026-10-15T15:12:29Z" level=info duration=69.444363ms duration-ns=69444363 fields.time="2026-10-15T15:12:29Z" method=HEAD name=ca nonce=clRKWmE2d2g0QVg5c1RNaFZwZlhidjRmM1M1T04zSGw path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=e1a2e325-6fb1-41d4-96b8-94f7d3888708 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540608.468539] ca step-ca[207]: time="2026-10-15T15:12:29Z" level=info duration=18.61913ms duration-ns=18619130 fields.time="2026-10-15T15:12:29Z" method=POST name=ca nonce=N1RqN285eFJnSUdEelhkdXZQSWJITzFDc1VMcERSMmg path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=21f3a72d-9e6a-4c13-8aaf-a06f20424098 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/Jpwk2pmjlokW9mg6Y7tB8BJRk36F7OOp/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540608.468717] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.380890988Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [540608.468717] ca acme-order-renew-ca.foo-start[311]: Your account credentials have been saved in your container-test-run-certificates> ca # [540608.468717] ca acme-order-renew-ca.foo-start[311]: configuration directory at "accounts". container-test-run-certificates> ca # [540608.468717] ca acme-order-renew-ca.foo-start[311]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [540608.468717] ca acme-order-renew-ca.foo-start[311]: configuration directory will also contain private keys container-test-run-certificates> ca # [540608.468717] ca acme-order-renew-ca.foo-start[311]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [540608.468717] ca acme-order-renew-ca.foo-start[311]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [540608.468833] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.380956001Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [540608.471866] ca step-ca[207]: time="2026-10-15T15:12:29Z" level=info duration=2.903589ms duration-ns=2903589 fields.time="2026-10-15T15:12:29Z" method=POST name=ca nonce=UEMzamFPZW56RUIzNldhQVBsT0RxQkNyVmZya2hxazY path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=0b39d4f3-1464-49dd-b993-bae280ab0547 response="{\"id\":\"ulc2n9OIF8WEQawwCqwIsTGquNhEo2we\",\"status\":\"pending\",\"expires\":\"2026-10-16T15:12:29Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-15T15:11:29Z\",\"notAfter\":\"2027-01-13T15:12:29Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/RPXQOeJYm0WWTD54UQYkMonAPYJ1uzId\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/ulc2n9OIF8WEQawwCqwIsTGquNhEo2we/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540608.535501] ca step-ca[207]: time="2026-10-15T15:12:29Z" level=info duration=7.217815ms duration-ns=7217815 fields.time="2026-10-15T15:12:29Z" method=POST name=ca nonce=VE1LaVczNlNGZmY0eVBnZVNHakVldDB0aU5LUGVBWjE path=/acme/acme/authz/RPXQOeJYm0WWTD54UQYkMonAPYJ1uzId protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=170ed798-7b47-4702-a563-cf10018ef1ab response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"M8ZtPz1tpNs7kJNePF1fBjmCcxT8Xfxy\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/RPXQOeJYm0WWTD54UQYkMonAPYJ1uzId/9SkrOx12IrLJgV9pTsnQjBkcMeuSrxwq\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"M8ZtPz1tpNs7kJNePF1fBjmCcxT8Xfxy\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/RPXQOeJYm0WWTD54UQYkMonAPYJ1uzId/4vuTM2UhULVZqeQavCFwPLkZUsiqDvty\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"M8ZtPz1tpNs7kJNePF1fBjmCcxT8Xfxy\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/RPXQOeJYm0WWTD54UQYkMonAPYJ1uzId/PoeQd7PF86vSFdpM0YPZyWMS4Xb6ZUWt\"}],\"wildcard\":false,\"expires\":\"2026-10-16T15:12:29Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540608.535811] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.447979144Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [540608.535842] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.447998079Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [540608.539612] ca step-ca[207]: time="2026-10-15T15:12:29Z" level=info duration=3.438256ms duration-ns=3438256 fields.time="2026-10-15T15:12:29Z" method=POST name=ca nonce=VlBQaFV1bXRubktvSFNQa0s5SVdrOEhsOHRjNUdXMG0 path=/acme/acme/challenge/RPXQOeJYm0WWTD54UQYkMonAPYJ1uzId/4vuTM2UhULVZqeQavCFwPLkZUsiqDvty protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=31808ec9-b52f-4fdf-afc6-92ffc3404743 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"M8ZtPz1tpNs7kJNePF1fBjmCcxT8Xfxy\",\"validated\":\"2026-10-15T15:12:29Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/RPXQOeJYm0WWTD54UQYkMonAPYJ1uzId/4vuTM2UhULVZqeQavCFwPLkZUsiqDvty\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540608.539819] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.451988786Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [540608.539867] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.452044762Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [540608.543504] ca step-ca[207]: time="2026-10-15T15:12:29Z" level=info duration=3.221979ms duration-ns=3221979 fields.time="2026-10-15T15:12:29Z" method=POST name=ca nonce=MEtDcmFMbFdaRWtsMW9EYmVZbHU2RGdVdW13YndLbGE path=/acme/acme/order/ulc2n9OIF8WEQawwCqwIsTGquNhEo2we/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=5a4848ee-fc3d-476d-8a53-d79c6408f6c6 response="{\"id\":\"ulc2n9OIF8WEQawwCqwIsTGquNhEo2we\",\"status\":\"valid\",\"expires\":\"2026-10-16T15:12:29Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-15T15:11:29Z\",\"notAfter\":\"2027-01-13T15:12:29Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/RPXQOeJYm0WWTD54UQYkMonAPYJ1uzId\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/ulc2n9OIF8WEQawwCqwIsTGquNhEo2we/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/02r8wOWS6UJUvqQ6cIbkoumLR8xxMEex\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540608.544654] ca step-ca[207]: time="2026-10-15T15:12:29Z" level=info certificate=MIIB0zCCAXmgAwIBAgIQDBvV4IWcz+PRW0OdJ+/IhTAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjEwMTUxNTExMjlaFw0yNzAxMTMxNTEyMjlaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABL66wwJ1Yt6g1kkoii9FaIFCCHIxqZ7XNT0tv5tRQOdsa4H/KbSkutNhLybCI5cz9DmWaMGSCXoOAos9UK5OpJKjgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU9mK81fKwtHmJ3A1mJ7knTT048YMwHwYDVR0jBBgwFoAUBTu+iFb6KPHLm1XzKo2FUZFQSeUwEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNIADBFAiEAp3Iy3JJ9CKccuFCO0FQtazLqHD+OcOuLIaK1CyOwPCgCIGwy9lduapxV/KZDcaVilj1zc6xDYOruLa93ui1UhsrI duration="800.678µs" duration-ns=800678 fields.time="2026-10-15T15:12:29Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=bGQxU1U5NjJaMndlOTJCbEhSM0RmVXBqa1dOYklIb1U path=/acme/acme/certificate/02r8wOWS6UJUvqQ6cIbkoumLR8xxMEex protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=bdaa8aa5-6140-4b65-989b-3bf4ebd5d345 sans="map[dns:[ca.foo]]" serial=16095265906304492288285290601965930629 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-15T15:11:29Z" valid-to="2027-01-13T15:12:29Z" container-test-run-certificates> ca # [540608.544759] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.456932118Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [540608.544795] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.456973315Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [540608.544848] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.457026726Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [540608.544875] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.457054899Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [540608.544927] ca acme-order-renew-ca.foo-start[311]: 2026-10-15T15:12:29.457105925Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [540608.547232] ca acme-order-renew-ca.foo-start[299]: + touch out/acme-success container-test-run-certificates> ca # [540608.548230] ca acme-order-renew-ca.foo-start[299]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [540608.548800] ca acme-order-renew-ca.foo-start[299]: + touch out/renewed container-test-run-certificates> ca # [540608.549868] ca acme-order-renew-ca.foo-start[299]: + echo Installing new certificate container-test-run-certificates> ca # [540608.549868] ca acme-order-renew-ca.foo-start[299]: Installing new certificate container-test-run-certificates> ca # [540608.549868] ca acme-order-renew-ca.foo-start[299]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [540608.550823] ca acme-order-renew-ca.foo-start[331]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [540608.550991] ca acme-order-renew-ca.foo-start[299]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [540608.551795] ca acme-order-renew-ca.foo-start[332]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [540608.551949] ca acme-order-renew-ca.foo-start[299]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [540608.552620] ca acme-order-renew-ca.foo-start[333]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [540608.552746] ca acme-order-renew-ca.foo-start[299]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [540608.553519] ca acme-order-renew-ca.foo-start[299]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [540608.554321] ca acme-order-renew-ca.foo-start[299]: + for fixpath in out certificates container-test-run-certificates> ca # [540608.554342] ca acme-order-renew-ca.foo-start[299]: + '[' -d out ']' container-test-run-certificates> ca # [540608.554342] ca acme-order-renew-ca.foo-start[299]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [540608.555100] ca acme-order-renew-ca.foo-start[299]: + chown -R acme:nginx out container-test-run-certificates> ca # [540608.556461] ca acme-order-renew-ca.foo-start[299]: + for fixpath in out certificates container-test-run-certificates> ca # [540608.556472] ca acme-order-renew-ca.foo-start[299]: + '[' -d certificates ']' container-test-run-certificates> ca # [540608.556472] ca acme-order-renew-ca.foo-start[299]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [540608.557216] ca acme-order-renew-ca.foo-start[299]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [540608.558538] ca acme-order-renew-ca.foo-start[299]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [540608.658546] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [540608.661886] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [540608.662066] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [540609.510936] ca nginx[349]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [540609.511214] ca nginx[349]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 7.65 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [540610.325524] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [540610.325692] ca systemd[1]: Startup finished in 7.079s. container-test-run-certificates> ca # [540610.631245] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [540610.669397] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [540610.674125] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [540610.674147] ca systemd[1]: nginx.service: Consumed 2.772s CPU time over 3.737s wall clock time. container-test-run-certificates> ca # [540610.676110] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.87 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 442) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 445) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ca # [540611.491078] ca nginx-pre-start[373]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [540611.491387] ca nginx-pre-start[373]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [540611.494778] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> client # [540612.048121] client systemd-journald[72]: Journal started container-test-run-certificates> server # [540612.048062] server systemd-journald[72]: Journal started container-test-run-certificates> client # [540612.048157] client systemd-journald[72]: Runtime Journal (/run/log/journal/fa150b7ddb6b46089d863768ee46a117) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [540612.048100] server systemd-journald[72]: Runtime Journal (/run/log/journal/665c9154a39646489042de5513a0ef25) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [540612.057132] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [540612.052745] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [540612.065558] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [540612.060309] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [540612.087186] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [540612.068716] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [540612.087560] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [540612.069149] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [540612.087854] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [540612.069540] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [540612.092152] client systemd-journald[72]: Time spent on flushing to /var/log/journal/fa150b7ddb6b46089d863768ee46a117 is 1.020ms for 7 entries. container-test-run-certificates> server # [540612.091178] server systemd-journald[72]: Time spent on flushing to /var/log/journal/665c9154a39646489042de5513a0ef25 is 1.522ms for 7 entries. container-test-run-certificates> client # [540612.092152] client systemd-journald[72]: System Journal (/var/log/journal/fa150b7ddb6b46089d863768ee46a117) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [540612.091178] server systemd-journald[72]: System Journal (/var/log/journal/665c9154a39646489042de5513a0ef25) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [540612.115055] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [540612.115707] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [540612.115793] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [540612.112550] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [540612.116424] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [540612.113104] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [540612.116458] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [540612.113190] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [540612.117031] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [540612.113677] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [540612.117051] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [540612.113705] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [540612.124109] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [540612.114202] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [540612.124921] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [540612.114219] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [540612.135743] client systemd[1]: Finished Firewall. container-test-run-certificates> server # [540612.125518] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [540612.135835] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [540612.126567] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [540612.135974] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [540612.136538] client systemd[1]: Starting Network Management... container-test-run-certificates> server # [540612.136367] server systemd-tmpfiles[167]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [540612.141756] client systemd-tmpfiles[165]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [540612.136514] server systemd-tmpfiles[167]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [540612.142068] client systemd-tmpfiles[165]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [540612.136611] server systemd-tmpfiles[167]: fchmod() of /var/log/journal/665c9154a39646489042de5513a0ef25 failed: Operation not permitted container-test-run-certificates> client # [540612.142256] client systemd-tmpfiles[165]: fchmod() of /var/log/journal/fa150b7ddb6b46089d863768ee46a117 failed: Operation not permitted container-test-run-certificates> server # [540612.136758] server systemd-tmpfiles[167]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [540612.142463] client systemd-tmpfiles[165]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [540612.137493] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [540612.143905] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [540612.137963] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [540612.144617] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [540612.138272] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [540612.144988] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [540612.140581] server systemd[1]: Finished Firewall. container-test-run-certificates> client # [540612.152304] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [540612.140665] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [540612.157973] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [540612.140797] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [540612.159255] client systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [540612.141258] server systemd[1]: Starting Network Management... container-test-run-certificates> client # [540612.166164] client systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [540612.145693] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [540612.168370] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [540612.151473] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [540612.152070] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [540612.159568] server systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [540612.169184] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [540612.795237] client systemd-networkd[178]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [540612.795303] client systemd-networkd[178]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [540612.802658] client systemd-networkd[178]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [540612.802824] client systemd-networkd[178]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [540612.802886] client systemd-networkd[178]: lo: Link UP container-test-run-certificates> client # [540612.802889] client systemd-networkd[178]: lo: Gained carrier container-test-run-certificates> client # [540612.802999] client systemd-networkd[178]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [540612.803239] client systemd[1]: Started Network Management. container-test-run-certificates> client # [540612.803256] client systemd-networkd[178]: eth1: Link UP container-test-run-certificates> client # [540612.803368] client systemd-networkd[178]: eth1: Gained carrier container-test-run-certificates> client # [540612.804059] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [540612.833327] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [540613.043790] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [540612.825179] server systemd-networkd[185]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [540612.825250] server systemd-networkd[185]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [540612.834579] server systemd-networkd[185]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [540612.834769] server systemd-networkd[185]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [540612.834837] server systemd-networkd[185]: lo: Link UP container-test-run-certificates> server # [540612.834842] server systemd-networkd[185]: lo: Gained carrier container-test-run-certificates> server # [540612.835011] server systemd-networkd[185]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [540612.835262] server systemd[1]: Started Network Management. container-test-run-certificates> server # [540612.835311] server systemd-networkd[185]: eth1: Link UP container-test-run-certificates> server # [540612.835454] server systemd-networkd[185]: eth1: Gained carrier container-test-run-certificates> server # [540612.835862] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [540612.855119] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [540613.042963] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [540613.325732] server systemd-resolved[107]: Positive Trust Anchors: container-test-run-certificates> server # [540613.325739] server systemd-resolved[107]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [540613.325742] server systemd-resolved[107]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [540613.325758] server systemd-resolved[107]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [540613.338486] server systemd-resolved[107]: Using system hostname 'server'. container-test-run-certificates> server # [540613.339492] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [540613.339548] server systemd[1]: Reached target Network. container-test-run-certificates> server # [540613.339579] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [540613.339602] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [540613.339736] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [540613.339750] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [540613.339760] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [540613.339770] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [540613.339848] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [540613.339906] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [540613.339975] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [540613.339982] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [540613.340012] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [540613.355528] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [540613.356024] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [540613.356045] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [540613.356463] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [540613.357058] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [540613.367634] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [540613.472220] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [540613.472220] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [540613.472220] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [540613.475077] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [540613.476311] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [540613.476333] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [540613.476333] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [540613.476333] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [540613.482276] server nsncd[197]: Oct 15 15:12:34.394 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [540613.482243] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [540613.482283] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [540613.482313] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [540613.482922] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [540613.483332] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [540613.511075] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [540613.511579] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [540613.511599] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [540613.511609] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [540613.329490] client systemd-resolved[123]: Positive Trust Anchors: container-test-run-certificates> client # [540613.329496] client systemd-resolved[123]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [540613.329499] client systemd-resolved[123]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [540613.329515] client systemd-resolved[123]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [540613.339362] client systemd-resolved[123]: Using system hostname 'client'. container-test-run-certificates> client # [540613.340262] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [540613.340324] client systemd[1]: Reached target Network. container-test-run-certificates> client # [540613.340364] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [540613.340401] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [540613.340422] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [540613.340433] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [540613.340527] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [540613.340601] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [540613.340686] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [540613.340703] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [540613.340730] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [540613.355604] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [540613.356053] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [540613.356617] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [540613.366025] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [540613.492232] client nsncd[192]: Oct 15 15:12:34.404 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [540613.492271] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [540613.492307] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [540613.492339] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [540613.507168] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [540613.507583] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [540613.513845] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [540613.514418] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [540613.514438] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [540613.514448] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [540613.635039] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [540613.635588] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [540613.635588] client dbus-broker-launch[193]: Invalid user-name in /nix/store/6jc90vf07dk215a5yf9f687z22x3a7l6-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [540613.637430] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [540613.635908] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [540613.638017] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [540613.640254] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [540613.638017] server dbus-broker-launch[198]: Invalid user-name in /nix/store/r1nnqk0mc4ywr2mqnllk7gxshp9p2gx4-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [540613.638093] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [540613.642392] server dbus-broker-launch[198]: Ready container-test-run-certificates> server # [540614.475936] server systemd-logind[222]: New seat seat0. container-test-run-certificates> server # [540614.476058] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [540614.477019] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [540614.501035] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [540614.501118] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [540614.540065] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [540614.540299] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [540614.540299] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [540614.548355] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [540614.549258] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> client # [540614.398101] client systemd-networkd[178]: eth1: Gained IPv6LL container-test-run-certificates> client # [540614.489723] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [540614.489894] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [540614.495285] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [540614.503473] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [540614.503555] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [540614.503821] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [540614.505047] client systemd[1]: Startup finished in 2.743s. container-test-run-certificates> server # [540614.783273] server systemd-networkd[185]: eth1: Gained IPv6LL container-test-run-certificates> server # [540615.363060] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [540615.364775] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [540615.364810] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [540615.370099] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [540615.370297] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [540615.371099] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [540615.371244] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [540615.371988] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [540615.372130] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [540615.373111] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [540615.373979] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [540615.374931] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [540615.374957] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [540615.374957] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [540615.376028] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [540615.377991] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [540615.377991] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [540615.380968] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [540615.382131] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [540616.286632] server nginx-pre-start[270]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [540616.286916] server nginx-pre-start[270]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [540616.290697] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [540616.291044] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [540616.291850] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [540617.328497] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [540617.330131] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [540617.330169] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [540617.330196] server acme-order-renew-test.foo-start[273]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [540617.330889] server acme-order-renew-test.foo-start[285]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [540617.332193] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [540617.332225] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [540617.332248] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [540617.332269] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [540617.343658] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.255815200Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [540617.359899] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.272066951Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [540617.369388] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.281555343Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [540617.369388] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your container-test-run-certificates> server # [540617.369388] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts". container-test-run-certificates> server # [540617.369388] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [540617.369388] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys container-test-run-certificates> server # [540617.369388] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [540617.369388] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [540617.369555] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.281626557Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [540617.436980] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.349145465Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [540617.436980] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.349163228Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [540617.441596] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.353768963Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [540617.441667] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.353811443Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [540617.449949] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.362123139Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [540617.449990] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.362153136Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [540617.450021] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.362200625Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [540617.450044] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.362223057Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [540617.450082] server acme-order-renew-test.foo-start[286]: 2026-10-15T15:12:38.362262732Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [540617.453631] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [540617.454751] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [540617.455378] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [540617.456084] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [540617.456084] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [540617.456108] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [540617.456825] server acme-order-renew-test.foo-start[305]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [540617.456956] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [540617.457774] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [540617.457913] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [540617.458690] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [540617.458816] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [540617.459665] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [540617.460506] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [540617.460517] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [540617.460517] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [540617.461296] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [540617.462659] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [540617.462659] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [540617.462690] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [540617.463425] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [540617.464621] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [540617.359649] ca step-ca[207]: time="2026-10-15T15:12:38Z" level=info duration="40.296µs" duration-ns=40296 fields.time="2026-10-15T15:12:38Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=12ca1f45-94e0-4c5e-9a80-0966c282c3a6 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540617.365865] ca step-ca[207]: time="2026-10-15T15:12:38Z" level=info duration=5.13366ms duration-ns=5133660 fields.time="2026-10-15T15:12:38Z" method=HEAD name=ca nonce=ZU1hUGJOZXBadHpIdmVHOFNLSGJyRUExR1JZVEw4b1Y path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=8d9c7758-315e-4d4e-bcbc-5cd0255b3fca size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540617.368904] ca step-ca[207]: time="2026-10-15T15:12:38Z" level=info duration=2.101618ms duration-ns=2101618 fields.time="2026-10-15T15:12:38Z" method=POST name=ca nonce=OWczR2lXUEM1Wk9qaVRjRTB3cTllZEJQVjcyM3FDY0o path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=7abfe9e2-341c-4b83-8bb2-779c1b469154 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/zOmFvuxxDcpIbWXAQXd5QiUgevjT7oph/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540617.373147] ca step-ca[207]: time="2026-10-15T15:12:38Z" level=info duration=2.646154ms duration-ns=2646154 fields.time="2026-10-15T15:12:38Z" method=POST name=ca nonce=eWxTNFNpamVCcWVGRXRmRGxjVnEwcU51eHhJNWtYWHA path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=d64af644-ad63-4d03-a5c1-7eb6391169bb response="{\"id\":\"s6URS5glq3S2IobPHLW5NOCuBzPmTkbI\",\"status\":\"pending\",\"expires\":\"2026-10-16T15:12:38Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-15T15:11:38Z\",\"notAfter\":\"2027-01-13T15:12:38Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/C4e3JMx0hlm4JI5PjzcmEVdckTauKkFf\"],\"finalize\":\"https://ca.foo/acme/acme/order/s6URS5glq3S2IobPHLW5NOCuBzPmTkbI/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540617.436723] ca step-ca[207]: time="2026-10-15T15:12:38Z" level=info duration=6.172496ms duration-ns=6172496 fields.time="2026-10-15T15:12:38Z" method=POST name=ca nonce=dklyaEtoY1B6dWczNnhCcDVkY3RpVjd1U1NaZ1p3WlM path=/acme/acme/authz/C4e3JMx0hlm4JI5PjzcmEVdckTauKkFf protocol=HTTP/1.1 referer= remote-address="::1" request-id=48dacb9f-290a-4873-9bff-3d55b65744d9 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"4LiwzAzKEwMxRU43opCvq7Htp3yqTskw\",\"url\":\"https://ca.foo/acme/acme/challenge/C4e3JMx0hlm4JI5PjzcmEVdckTauKkFf/yN5PpzP0MBfFSeWpGezkdGWN9pZG9445\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"4LiwzAzKEwMxRU43opCvq7Htp3yqTskw\",\"url\":\"https://ca.foo/acme/acme/challenge/C4e3JMx0hlm4JI5PjzcmEVdckTauKkFf/icb9d3kgDAedFDtEDmWqUfXni69KHGKG\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"4LiwzAzKEwMxRU43opCvq7Htp3yqTskw\",\"url\":\"https://ca.foo/acme/acme/challenge/C4e3JMx0hlm4JI5PjzcmEVdckTauKkFf/TfmLYZqiKksJ8enAenbySwQHJ7cR1lse\"}],\"wildcard\":false,\"expires\":\"2026-10-16T15:12:38Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540617.441381] ca step-ca[207]: time="2026-10-15T15:12:38Z" level=info duration=3.506655ms duration-ns=3506655 fields.time="2026-10-15T15:12:38Z" method=POST name=ca nonce=Q1lmUFkxT09jQldkZGs1UGhNcUZiVTNFbkd0WFZoOWM path=/acme/acme/challenge/C4e3JMx0hlm4JI5PjzcmEVdckTauKkFf/icb9d3kgDAedFDtEDmWqUfXni69KHGKG protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=60d153e8-13b4-4850-b3fb-a0f3d7c01a81 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"4LiwzAzKEwMxRU43opCvq7Htp3yqTskw\",\"validated\":\"2026-10-15T15:12:38Z\",\"url\":\"https://ca.foo/acme/acme/challenge/C4e3JMx0hlm4JI5PjzcmEVdckTauKkFf/icb9d3kgDAedFDtEDmWqUfXni69KHGKG\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540617.448075] ca step-ca[207]: time="2026-10-15T15:12:38Z" level=info duration=5.504107ms duration-ns=5504107 fields.time="2026-10-15T15:12:38Z" method=POST name=ca nonce=cFN6YUpSbThhQXh5TjRBVDhpb0FsbFlUME5vUGVyNWc path=/acme/acme/order/s6URS5glq3S2IobPHLW5NOCuBzPmTkbI/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=2ce1d932-17e0-4c54-b224-3061357f4cb9 response="{\"id\":\"s6URS5glq3S2IobPHLW5NOCuBzPmTkbI\",\"status\":\"valid\",\"expires\":\"2026-10-16T15:12:38Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-15T15:11:38Z\",\"notAfter\":\"2027-01-13T15:12:38Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/C4e3JMx0hlm4JI5PjzcmEVdckTauKkFf\"],\"finalize\":\"https://ca.foo/acme/acme/order/s6URS5glq3S2IobPHLW5NOCuBzPmTkbI/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/KS8uIgeyo7Z8cL0fk3t4QvRVhBjHCYwA\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [540617.449789] ca step-ca[207]: time="2026-10-15T15:12:38Z" level=info certificate="MIIB1zCCAX2gAwIBAgIQbxRbuxqjRb38HqjKinFktDAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjEwMTUxNTExMzhaFw0yNzAxMTMxNTEyMzhaMBMxETAPBgNVBAMTCHRlc3QuZm9vMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyOxoXGUPm3kf+0Vynw+ZXDZ7+DobQtejekbfBieDugvKM8f6bd/rTnsBMwCwpdQXfmQmG0v8u78zCSAljx+qS6OBpjCBozAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBR6WV6PPJYogK7vSNyV1lTlQJtWIjAfBgNVHSMEGDAWgBQFO76IVvoo8cubVfMqjYVRkVBJ5TATBgNVHREEDDAKggh0ZXN0LmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIgJCGWeDA3Kxh3ONTgXYL/az8aPab3TxZsXno06+AQH8cCIQDcgwF6E183MmRGqXYiZ7JyxNTH8mH+PzEgVZigG8RWKg==" duration="863.427µs" duration-ns=863427 fields.time="2026-10-15T15:12:38Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=dUlwbXl4ejN1ZTBSYVJnQVFhQ2FwS29LMVNyczZQZlk path=/acme/acme/certificate/KS8uIgeyo7Z8cL0fk3t4QvRVhBjHCYwA protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=5986d251-9d37-43ed-a3b5-a910762f0b4e sans="map[dns:[test.foo]]" serial=147650013992480675426174150623953511604 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-15T15:11:38Z" valid-to="2027-01-13T15:12:38Z" container-test-run-certificates> server # [540617.605803] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [540617.608995] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [540617.609188] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> server # [540618.443813] server nginx[323]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [540618.444112] server nginx[323]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [540619.186745] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [540619.187842] server systemd[1]: Startup finished in 7.422s. container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 8.14 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [540619.640661] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [540619.671278] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [540619.671471] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [540619.671501] server systemd[1]: nginx.service: Consumed 4.350s CPU time over 4.289s wall clock time. container-test-run-certificates> server # [540619.673029] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 1.10 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 42282 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 53910 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> server # [540620.730455] server nginx-pre-start[346]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [540620.730846] server nginx-pre-start[346]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [540620.736315] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 42286 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 53920 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1554 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [931 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [78 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Oct 15 15:11:38 2026 GMT container-test-run-certificates> * expire date: Jan 13 15:12:38 2027 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 42300 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1125 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 2.05 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> 6f:14:5b:bb:1a:a3:45:bd:fc:1e:a8:ca:8a:71:64:b4 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Oct 15 15:11:38 2026 GMT container-test-run-certificates> Not After : Jan 13 15:12:38 2027 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:c8:ec:68:5c:65:0f:9b:79:1f:fb:45:72:9f:0f: container-test-run-certificates> 99:5c:36:7b:f8:3a:1b:42:d7:a3:7a:46:df:06:27: container-test-run-certificates> 83:ba:0b:ca:33:c7:fa:6d:df:eb:4e:7b:01:33:00: container-test-run-certificates> b0:a5:d4:17:7e:64:26:1b:4b:fc:bb:bf:33:09:20: container-test-run-certificates> 25:8f:1f:aa:4b container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> 7A:59:5E:8F:3C:96:28:80:AE:EF:48:DC:95:D6:54:E5:40:9B:56:22 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 05:3B:BE:88:56:FA:28:F1:CB:9B:55:F3:2A:8D:85:51:91:50:49:E5 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:45:02:20:24:21:96:78:30:37:2b:18:77:38:d4:e0:5d:82: container-test-run-certificates> ff:6b:3f:1a:3d:a6:f7:4f:16:6c:5e:7a:34:eb:e0:10:1f:c7: container-test-run-certificates> 02:21:00:dc:83:01:7a:13:5f:37:32:64:46:a9:76:22:67:b2: container-test-run-certificates> 72:c4:d4:c7:f2:61:fe:3f:31:20:55:98:a0:1b:c4:56:2a container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 19.83 seconds) container-test-run-certificates> test script finished in 20.58s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 445) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> kill NspawnMachine (pid 442) container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> Container server terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.29 seconds)