2

I have an Amazon S3 bucket set up for hosting static image files. I have set up subdomain redirection so that "static.example.com" points to my S3 bucket. The bucket is named "static.example.com" with an appropriate CNAME record.

http://static.example.com/someimage.jpg does load from the S3 bucket.

The problem arises when I enable SSL for the website. When I load https://www.example.com I get errors because I'm loading insecure content from a secure page as expected.

After changing image sources to load https://static.example.com/someimage.jpg, images do not load because the browser blocks them because the certificate doesn't match.

Amazon's certificate is good for *.s3.amazonaws.com, which would include "somebucket.s3.amazonaws.com" but does not match "static.example.com.s3.amazonaws.com" as I need it to.

So the question is, how do I implement SSL as recommended when using a custom subdomain?

Improve this question
2
  • Does the certificate you got for example.com include subdomains?
    – tobiv
    Oct 26, 2017 at 11:00
  • @tobiv It's not my certificate. It's Amazon's that is the problem.
    – Nilpo
    Oct 27, 2017 at 2:33

1 Answer 1

Reset to default
3

Rename to static-example-com.s3.amazonaws.com - this would work with the out of the box wildcard cert they supply. Take a look at what AWS recommends here.

Also, Id read through the answer here It looks like others have had the same issue you are having now.

Improve this answer
2
  • Although renaming the bucket (not actually possible -- you actually have to create a new bucket with the new name) will allow you to use https://example-bucket.s3.amazonaws.com, there's also another factor your advice will break -- if you point a domain name directly at a bucket, the bucket name must exactly match the bucket name. This precludes custom domain names for buckets if you want HTTPS. To do that does require CloudFront, as mentioned in the comments of the answer you linked... and if you use CloudFront, the bucket name no longer needs to match the custom domain name.
    – Michael - sqlbot
    Oct 26, 2017 at 22:32
  • Michael is correct. If you use a custom subdomain, the bucket name must be the FQDN with the subdomain. A single name bucket is now allowed. (Though that does resolve the SSL error.)
    – Nilpo
    Oct 27, 2017 at 2:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.