anchor.diff:      basicConstraints = CA:FALSE
       keyUsage = digitalSignature, keyEncipherment
       extendedKeyUsage = clientAuth
  -    EOF
  -
  -    openssl genrsa -out $out/etcd-client-key.pem 2048
  -    openssl req -new -key $out/etcd-client-key.pem -out etcd-client.csr -subj "/CN=etcd-client" -config client-openssl.cnf
  -    openssl x509 -req -in etcd-client.csr -CA $out/ca.pem -CAkey $out/ca-key.pem -CAcreateserial -out $out/etcd-client.pem -days 365 -extensions v3_req -extfile client-openssl.cnf
     '';
   
     nodeConfig = {
       services = {
         etcd = {
           enable = true;
  -        keyFile = "${certs}/etcd-key.pem";
  -        certFile = "${certs}/etcd.pem";
  -        trustedCaFile = "${certs}/ca.pem";
  +        keyFile = etcd_key;
  +        certFile = etcd_cert;
  +        trustedCaFile = ca_pem;
           peerClientCertAuth = true;
           listenClientUrls = ["https://127.0.0.1:2379"];
           listenPeerUrls = ["https://0.0.0.0:2380"];
  
positive.code: # This test runs simple etcd cluster
  
  import ./make-test.nix ({ pkgs, ... } : let
    certs = pkgs.runCommand "certs" {
      buildInputs = [pkgs.openssl];
    } ''
      mkdir -p $out
      openssl genrsa -out $out/ca-key.pem 2048
      openssl req -x509 -new -nodes -key $out/ca-key.pem -days 10000 -out $out/ca.pem -subj "/CN=etcd-ca"
  
      cat << EOF > openssl.cnf
      ions = v3_req
      distinguished_name = req_distinguished_name
      [req_distinguished_name]
  
negative.code:     DNS.2 = node2
      DNS.3 = node3
      IP.1 = 127.0.0.1
    '';
  
    client_openssl_cnf = pkgs.writeText "client-openssl.cnf" ''
      ions = v3_req
      distinguished_name = req_distinguished_name
      [req_distinguished_name]
  