I have set a CNAME entry to redirect over Amazon S3 bucket, however there is something that doesnt works as supposed (by me of course) with CNAME I expect to redirect a fictional subdomain, say for example s3.example.com to the Amazon S3 bucket with the same name.

Now the problem is that example.com doesn't have a SSL while Amazon bucket does. For what I assumed, with a CNAME rule it should redirect the traffic before to ever reach my webserver and check for the presence of a certificate, notice that for this purpose the DNS is set to my domain provider and not my hosting provider.

Why is it ever checking for SSL when there is a CNAME rule and it is working? If for example I remove the s from the url it opens the relative file in the bucket without any certificate warning.

edit: the error returned is different, I'll try to translate and adapt it:

s3.mydomain.com is using a not valid certificate. the certificate is 
only valid for the following names: *.s3.eu-central-1.amazonaws.com, 
*.s3-eu-central-1.amazonaws.com, s3-eu-central-1.amazonaws.com, s3.eu-
central-1.amazonaws.com, s3.dualstack.eu-central-1.amazonaws.com, 
*.s3.dualstack.eu-central-1.amazonaws.com, *.s3.amazonaws.com 

it then seems that he is reading the CNAME rule and looking up the correct domain (amazon s3) then it confront this against my domain and see it is a different name, it then stops before redirecting. For this reason if I remove the s it will give no error. Now I'd try to install let's encrypt and see if having a certificate would help, but my guess it will still make this check ad give again a similar if not the same result.

  • Your post is unclear as to what you are trying to do (DNS is a public system - give us real data and we can look into it). You are correct that DNS and thus CNAME "redirects" take place before connections so traffic should not go to your server. Maybe you have a hosts file or local DNS server picking up hostnames interfering with the expected DNS process, or maybe an incorrect or cached DNS setup. – davidgo Apr 15 at 3:45

The CNAME in your DNS zone is working as you expect, but browsers check that the certificate presented by the remote web site is valid for the domain being visited.

The amazon s3 server where your data is stored does not have or present a valid certificate for s3.mydomain.com, so all visitors will see the certificate warning.

This is completely normal and is exactly how SSL certificates are supposed to work - otherwise any site could pretend to be any other SSL encrypted site. Certificates are used for authentication as well as just encryption, with the identity verification being done by the Certificate Authority (CA) when the certificate is purchased. If you're not who you say you are when you purchase the certificate, the CA should refuse to create it or issue it to you - if they don't do that verification step, they'll find themselves removed from the default trusted CA list distributed with web browsers like Firefox, Chromium, IE, Edge, etc.

The "normal" way to do what you want to run your own https server for your domain WITH a certificate signed by a certificate authority that is known and trusted by the browser. For private/intranet type web applications, you can run your own CA and distribute the CA's certificate to your users. For public web-sites, it's best/easiest to just buy a certificate from one of the well-known CAs.

The application code on your server should then fetch the required data from amazon and return it to the user, who never needs to know or care that amazon was involved.

  • there is no code on my website, it is a simple wordpress site to present my services, the subdomain s3 that I'm using doens't exist on the host, it is only a CNAME rule to redirect over to amazon, since it allow me to use a custom domain name. – Ritardi.Net Apr 15 at 15:05

A CNAME is not a redirect, it's an alias. What it does is tell a DNS resolver that your s3.example.com address should use the same DNS information as amazon's s3 domain.

This all happens at the DNS level, not the browser level. As far as the browser is concerned it is still connecting to s3.example.com so when it attempts to validate the SSL certificate it is expecting to find a certificate which matches that domain.

I'm not familiar with amazon's services but you will need a way for them to present a valid certificate to use your custom domain with HTTPS. If that's not possible, you'll have to either stick to plain HTTP or stop using your custom domain.

  • for now I set to use http, but would a 301 redirect work better for this purpose? – Ritardi.Net Apr 15 at 17:38
  • A 301 or 302 redirect would be better, though you will still need a certificate for s3.example.com if you want to use https for the initial url before the redirect. You'll also need a server setup for s3.example.com that will issue the appropriate redirect. – kicken Apr 15 at 19:15

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.