Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From the developer guide:

When using virtual hosted-style buckets with SSL, the SSL wild card certificate only matches buckets that do not contain periods. To work around this, use HTTP or write your own certificate verification logic.

What I'm trying to do is host static files at S3, and access them via

It seems Virtual Hosted style URLs may not play well with SSL. Any idea what "custom certificate verification" means in this context?

See also on Stack Overflow.

share|improve this question

closed as off topic by ripper234, MDMarra, Bart De Vos, rnxrx, HopelessN00b Aug 26 '12 at 22:06

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Please move to – ripper234 Oct 17 '11 at 11:47
up vote 3 down vote accepted

This is S3's SSL certificate:

subject=/C=US/ST=Washington/L=Seattle/ Inc./CN=*

The Common Name on the certificate is *, which is not going to match Therefore you cannot use your own hostname (via a CNAME record) with S3 when using HTTPS (at least if you want it to validate), since S3's SSL certificate doesn't (and can't) include your hostname. You must use the <bucket> hostname instead.

Now, technically a wildcard in SSL certificate hostname only matches a single part of the hostname, so the above certificate will match, but not This is why the documentation says that the bucket name cannot contain periods, since will not match the certificate, but will.

I assume that the custom certificate validation they are referring to is if you are writing your own client which accesses S3, which is not the case here.

Edit: As @ceejayoz points out, you can still use path-style access for buckets with periods in the name, however, you should use the correct region specific hostname since AWS can't select the correct endpoint when the DNS request is made.
share|improve this answer
Incidentally, if you run into this, you can always do instead. – ceejayoz Jul 30 '12 at 0:26
@ceejayoz True, I've added that. – mgorven Jul 30 '12 at 0:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.