Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

From the developer guide:

When using virtual hosted-style buckets with SSL, the SSL wild card certificate only matches buckets that do not contain periods. To work around this, use HTTP or write your own certificate verification logic.

What I'm trying to do is host static files at S3, and access them via https://app.mysite.com/filename.jpg

It seems Virtual Hosted style URLs may not play well with SSL. Any idea what "custom certificate verification" means in this context?

See also on Stack Overflow.

share|improve this question

closed as off topic by ripper234, MDMarra, Bart De Vos, rnxrx, HopelessN00b Aug 26 '12 at 22:06

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

Please move to webmasters.stackexchange.com –  ripper234 Oct 17 '11 at 11:47

1 Answer 1

up vote 3 down vote accepted

This is S3's SSL certificate:

subject=/C=US/ST=Washington/L=Seattle/O=Amazon.com Inc./CN=*.s3.amazonaws.com

The Common Name on the certificate is *.s3.amazonaws.com, which is not going to match app.mysite.com. Therefore you cannot use your own hostname (via a CNAME record) with S3 when using HTTPS (at least if you want it to validate), since S3's SSL certificate doesn't (and can't) include your hostname. You must use the <bucket>.s3.amazonaws.com hostname instead.

Now, technically a wildcard in SSL certificate hostname only matches a single part of the hostname, so the above certificate will match foo.s3.amazonaws.com, but not foo.bar.s3.amazonaws.com. This is why the documentation says that the bucket name cannot contain periods, since app.mysite.com.s3.amazonaws.com will not match the certificate, but app-mysite.s3.amazonaws.com will.

I assume that the custom certificate validation they are referring to is if you are writing your own client which accesses S3, which is not the case here.

Edit: As @ceejayoz points out, you can still use path-style access for buckets with periods in the name, however, you should use the correct region specific hostname since AWS can't select the correct endpoint when the DNS request is made.

share|improve this answer
Incidentally, if you run into this, you can always do s3.amazonaws.com/app.mysite.com instead. –  ceejayoz Jul 30 '12 at 0:26
@ceejayoz True, I've added that. –  mgorven Jul 30 '12 at 0:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.