CHAT_OUTPUT_BEGIN
COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-APPLY13
STATUS=FAIL
RC=1
HOST=pve01
MODE=change
COMPONENT=newfi-staging-local-proof-fix-existing-cert-route-dns
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=81a540993275ea3e4490b436e70a575c75210637401d741d60449e5231b90cd0
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=true
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=FAIL
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=1
CHANGES_MADE=true
ROLLBACK_STARTED=true
ROLLBACK_RESTORED=true
MUTATION_OUTCOME=ROLLED_BACK
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=f6bf2515e0d1852fc3ff47fc360f13571dc25f84bd97a9eb0cd7c618084a2c2d
SANITIZED_OUTPUT_SHA256=fbdf5a88bdabf56bf86bc9a0ce9467fce632eef5a2f5a7f1f879d488cef225b2
OUTPUT_BEGIN
APPLY13_BEGIN=true
COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-APPLY13
COMPONENT=newfi-staging-local-proof-fix-existing-cert-route-dns
MODE=change
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
REFERENCE_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d
PRIOR_APPLY12_HISTORY_SHA256=4b5163ee81bc5e070614287d9b524b7ab5d2962d7887f707c08b1a35d2cac9a0
PORTAL_PRODUCT_STATE_GATE=PASS
STAGING_PREFLIGHT={"backend_ip":"[PRIVATE_IP]","local_http":"503"}
NPMPLUS_LOCAL_PROOF_TOOL_GATE={"curl":"/usr/bin/curl"}
EXISTING_CERT_GATE={"authenticator":"dns-cloudflare","cert":"/data/tls/certbot/live/newfi-staging-gram1-ru/fullchain.pem","cert_name":"newfi-staging-gram1-ru","key":"/data/tls/certbot/live/newfi-staging-gram1-ru/privkey.pem","metadata":"subject=CN=newfi-staging.gram1.ru\nissuer=C=US, O=Let's Encrypt, CN=YE2\nnotBefore=Sep  8 05:18:03 2026 GMT\nnotAfter=Dec  7 05:18:02 2026 GMT\nserial=06CD3AC17EB3DB6B6C24F569FDF654155013","renewal":"/data/tls/certbot/renewal/newfi-staging-gram1-ru.conf","renewal_credential_host":"/opt/npmplus/secure/.newfi-staging-NEWFI-260908-A-STAGINGEDGE-APPLY8.ini","renewal_credential_inside":"/data/secure/.newfi-staging-NEWFI-260908-A-STAGINGEDGE-APPLY8.ini","server":"https://acme-v02.api.letsencrypt.org/directory"}
CF_TOKEN_GATE={"source_path":"/root/cert38-narrow-migration-20260904T074428Z/credentials-38.before","valid_count":1,"zone_id_sha256":"5a88f12ebe16612b4e42f11ee57b4b95ca4a13c4abb8f0009f09babfbec927e7"}
INGRESS_PREFLIGHT={"git_direct_https":"200","ip":"185.225.35.6"}
PREFLIGHT_COMPLETE_NO_MUTATION={"acme_txt_empty":true,"backend_http":"503","existing_cert_name":"newfi-staging-gram1-ru","existing_cert_valid":true,"ingress_ip":"185.225.35.6","renewal_authenticator":"dns-cloudflare","renewal_credential_inside":"/data/secure/.newfi-staging-NEWFI-260908-A-STAGINGEDGE-APPLY8.ini","renewal_server":"production_letsencrypt","route_absent":true,"strict_qga_timeout_zero":true,"target_dns_empty":true}
RENEWAL_CREDENTIAL_GATE={"created_now":true,"host_path":"/opt/npmplus/secure/.newfi-staging-NEWFI-260908-A-STAGINGEDGE-APPLY8.ini","inside_path":"/data/secure/.newfi-staging-NEWFI-260908-A-STAGINGEDGE-APPLY8.ini","mode":"0600","zone_access":"PASS"}
ROUTE_WRITTEN={"bytes":881,"path":"/opt/npmplus/nginx/proxy_host/newfi-staging-gram1-ru.manual.conf","proof_header":"NEWFI-260908-A-STAGINGEDGE-APPLY13","sha256":"5536ada122f3a0196d4eeb9aab593ee5960f87899df4427677db92622a7d6765"}
NGINX_TEST_AFTER_ROUTE=PASS
NGINX_RELOAD=PASS
NGINX_POSTRELOAD_TEST=PASS
LOCAL_TLS_503_PROOF=CURL_RC=0 HTTP=503 PROOF_RC=0 BYTES=23820
APPLY13_FAILURE=ChangeError:PUBLIC_TLS_503_PROOF_FAIL:60:000:False:curl: (60) SSL: no alternative certificate subject name matches target hostname 'newfi-staging.gram1.ru'\nMore details here: https://curl.se/docs/sslcerts.html\n\ncurl failed to verify the legitimacy of the server and therefore could not\nestablish a secure connection to it. To learn more about this situation and\nhow to fix it, please visit the webpage mentioned above.\n
ROLLBACK_ROUTE=PASS
ROLLBACK_CREATED_RENEWAL_CREDENTIAL=PASS
FINAL_DECISION=FAIL_NEWFI_STAGING_APPLY13_ROLLBACK_RESTORED
HOMELAB_RESULT_CONTRACT={"changes_made":true,"command_id":"NEWFI-260908-A-STAGINGEDGE-APPLY13","rollback_restored":true,"rollback_started":true,"status":"FAIL","version":1}

OUTPUT_END
CHAT_OUTPUT_END
