anchor.diff:      };
       testScript = ''
         machine.wait_for_unit("cfssl.service")
  -      machine.wait_until_succeeds("ls /tmp/decl.example.org-ca.pem")
  -      machine.wait_until_succeeds("ls /tmp/decl.example.org-key.pem")
  -      machine.wait_until_succeeds("ls /tmp/decl.example.org-cert.pem")
  -      machine.wait_until_succeeds("ls /tmp/imp.example.org-ca.pem")
  -      machine.wait_until_succeeds("ls /tmp/imp.example.org-key.pem")
  -      machine.wait_until_succeeds("ls /tmp/imp.example.org-cert.pem")
  +      machine.wait_until_succeeds("ls /var/ssl/decl.example.org-ca.pem")
  +      machine.wait_until_succeeds("ls /var/ssl/decl.example.org-key.pem")
  +      machine.wait_until_succeeds("ls /var/ssl/decl.example.org-cert.pem")
  +      machine.wait_until_succeeds("ls /var/ssl/imp.example.org-ca.pem")
  +      machine.wait_until_succeeds("ls /var/ssl/imp.example.org-key.pem")
  +      machine.wait_until_succeeds("ls /var/ssl/imp.example.org-cert.pem")
         machine.wait_for_unit("nginx.service")
         assert 1 < int(machine.succeed('journalctl -u nginx | grep "Starting Nginx" | wc -l'))
  -      machine.succeed("curl --cacert /tmp/imp.example.org-ca.pem https://imp.example.org")
  -      machine.succeed("curl --cacert /tmp/decl.example.org-ca.pem https://decl.example.org")
  +      machine.succeed("curl --cacert /var/ssl/imp.example.org-ca.pem https://imp.example.org")
  +      machine.succeed(
  +          "curl --cacert /var/ssl/decl.example.org-ca.pem https://decl.example.org"
  +      )
       '';
     };
   
  
positive.code:       file = {
          group = "nginx";
          owner = "nginx";
          path = "/tmp/${host}-ca.pem";
        };
        label = "www_ca";
        profile = "three-month";
  
negative.code: 
          services.cfssl.enable = true;
          systemd.services.cfssl.after = [ "cfssl-init.service" "networking.target" ];
  
          systemd.tmpfiles.rules = [ "d /var/ssl 777 root root" ];
  
          systemd.services.cfssl-init = {
            description = "Initialize the cfssl CA";
  