Not able to access S3 bucket using Virtual Hosted Style

Question

I got a use case to access the S3 bucket using virtual hosted style, but I observe that if I provide my bucket's next-level folder name with hyphens (like example-bucket), it’s working correctly when I use an underscore instead of hyphens, i.e., example_bucket.

Could you provide any insight on what could be the possible issue here?

error logs:

{
  "severity": "WARNING",
  "level": 40,
  "time": "2024-12-25T10:33:51.616Z",
  "host": "example-bucket.turborepo-remote-cache-7789096546546.s3-accesspoint.ap-southeast-2.amazonaws.com",
  "hostname": "example-bucket.turborepo-remote-cache-7789096546546.s3-accesspoint.ap-southeast-2.amazonaws.com",
  "region": "ap-southeast-2",
  "error": {
    "code": "NetworkingError",
    "message": "Hostname/IP does not match certificate's altnames: Host: example-bucket.turborepo-remote-cache-7789096546546.s3-accesspoint.ap-southeast-2.amazonaws.com. is not in the cert's altnames.",
    "altnames": [
      "DNS:s3-ap-southeast-2.amazonaws.com",
      "DNS:*.s3-ap-southeast-2.amazonaws.com",
      "DNS:s3.ap-southeast-2.amazonaws.com",
      "DNS:*.s3.ap-southeast-2.amazonaws.com",
      "DNS:s3.dualstack.ap-southeast-2.amazonaws.com",
      "DNS:*.s3.dualstack.ap-southeast-2.amazonaws.com",
      "DNS:*.s3.amazonaws.com",
      "DNS:*.s3-control.ap-southeast-2.amazonaws.com",
      "DNS:s3-control.ap-southeast-2.amazonaws.com",
      "DNS:*.s3-control.dualstack.ap-southeast-2.amazonaws.com",
      "DNS:*.s3-accesspoint.ap-southeast-2.amazonaws.com"
    ],
    "stack": "Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames."
  }
}

tarun · Accepted Answer

thanks for helping @garyMclean,
I discovered that I was using the `aws-sdk` which employs both Host Style and Path Style access for S3. However, using Host Style access was causing DNS network issues. Therefore, I switched to Path Style access, and now everything is working fine.

Gary Mclean · Answer

Underscores in bucket names are not supported.

Gary Mclean · Answer

You dont have foldernames in the bucket name. The folder forms part of the URi

EG

https://turborepo-cache-alpha.s3.ap-southeast-2.amazonaws.com/learning-platform-cache-v2

re:Post Agent · Answer

The issue you're experiencing with accessing your S3 bucket using virtual hosted style is related to SSL certificate validation when using buckets with dots (.) in their names. When using virtual-hosted–style buckets with SSL, the SSL wildcard certificate only matches buckets that do not contain dots.

In your case, the bucket name "example-bucket.turborepo-remote-cache-7789096546546" contains dots, which is causing the SSL certificate validation to fail. This is why you're seeing the error message indicating that the hostname does not match the certificate's altnames.

The reason it works when you use underscores instead of hyphens (example_bucket) is that underscores don't introduce the same SSL certificate validation issues as dots do.

To work around this limitation, you have a few options:

1. Use HTTP instead of HTTPS for accessing the bucket (though this is not recommended for security reasons).
2. Implement your own certificate-verification logic that can handle buckets with dots in their names.
3. Consider using path-style URLs instead of virtual-hosted style for buckets with dots in their names.
4. If possible, rename your bucket to avoid using dots in the name.

It's worth noting that Amazon S3 is moving towards deprecating path-style URLs in favor of virtual-hosted style, so the long-term solution would be to adjust your bucket naming strategy to avoid dots or implement custom certificate verification.  
**Sources**  
[Virtual hosting of buckets - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html)  
[Naming Amazon S3 objects - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html)

Gary Mclean · Answer

You don’t use the bucket name in the access point url.

Please see information how you access an S3 bucket when using access points.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-access-points.html

Not able to access S3 bucket using Virtual Hosted Style

Add your answer

Relevant content