SSL verification error when running yum update on an EC2 instance with amazon linux 2 using an S3 VPC interface endpoint

Question

We use CloudFormation to setup an EC2 instance with amazon linux 2 in a public subnet and an S3 interface endpoint in a private subnet. We had to disable Private DNS on the S3 interface endpoint, as otherwise CloudFormation also sets the "Enable private DNS only for inbound endpoint" flag to true and the deployment fails because there is no S3 Gateway endpoint. Instead we also set up private hosted zones to route the traffic for "s3.eu-central-1.amazonaws.com", "*.s3.eu-central-1.amazonaws.com", "s3.dualstack.eu-central-1.amazonaws.com" and "*.s3.dualstack.eu-central-1.amazonaws.com" to the S3 interface endpoint.

Accessing our own S3 buckets works perfectly fine, but when we try to run "sudo yum update" we get the following error message:
> Could not retrieve mirrorlist https://amazonlinux-2-repos-eu-central-1.s3.dualstack.eu-central-1.amazonaws.com/2/core/latest/x86_64/mirror.list error was
> 14: curl#60 - "SSL: no alternative certificate subject name matches target host name 'amazonlinux-2-repos-eu-central-1.s3.dualstack.eu-central-1.amazonaws.com'"

Is there a way to make yum work with an S3 interface endpoint?

Riku_Kobayashi · Answer

It is not very good from a security point of view, but try putting the following settings in "/etc/yum.conf".  
Adding the setting will not check for SSL certificates.  
```
sslverify=0
```
Once the settings are added, the settings file itself looks like this.  
```
[main]
cachedir=/var/cache/yum/$basearch/$releasever
keepcache=0
debuglevel=2
logfile=/var/log/yum.log
exactarch=1
obsoletes=1
gpgcheck=1
plugins=1
installonly_limit=3
distroverpkg=system-release
timeout=5
retries=7
sslverify=0

#  This is the default, if you make this bigger yum won't see if the metadata
# is newer on the remote and so you'll "gain" the bandwidth of not having to
# download the new metadata and "pay" for it by yum not having correct
# information.
#  It is esp. important, to have correct metadata, for distributions like
# Fedora which don't keep old packages around. If you don't like this checking
# interupting your command line usage, it's much better to have something
# manually check the metadata once an hour (yum-updatesd will do this).
# metadata_expire=90m

# PUT YOUR REPOS HERE OR IN separate files named file.repo
# in /etc/yum.repos.d
```

Riku_Kobayashi · Answer

For interface type VPC endpoints, private DNS cannot be enabled, so access to the S3 yum repository fails.  
As a countermeasure, configure "/etc/hosts" on EC2 to allow name resolution to "amazonlinux-2-repos-eu-central-1.s3.dualstack.eu-central-1.amazonaws.com".  
Check the private IP address of the interfaced VPC endpoint.  
172.16.1.1" is the private IP address of the ENI of the interfaced VPC endpoint.  
This IP address should be changed according to your environment.  
Try adding the following configuration to "/etc/hosts".  
```
172.16.1.1 amazonlinux-2-repos-eu-central-1.s3.dualstack.eu-central-1.amazonaws.com
```

SSL verification error when running yum update on an EC2 instance with amazon linux 2 using an S3 VPC interface endpoint

Relevant content