Why CNAME is not working as supposed?

Question

I have set a CNAME entry to redirect over Amazon S3 bucket, however there is something that doesnt works as supposed (by me of course) with CNAME I expect to redirect a fictional subdomain, say for example s3.example.com to the Amazon S3 bucket with the same name.

Now the problem is that example.com doesn't have a SSL while Amazon bucket does. For what I assumed, with a CNAME rule it should redirect the traffic before to ever reach my webserver and check for the presence of a certificate, notice that for this purpose the DNS is set to my domain provider and not my hosting provider.

Why is it ever checking for SSL when there is a CNAME rule and it is working? If for example I remove the s from the url it opens the relative file in the bucket without any certificate warning.

edit: the error returned is different, I'll try to translate and adapt it:

s3.mydomain.com is using a not valid certificate. the certificate is 
only valid for the following names: *.s3.eu-central-1.amazonaws.com, 
*.s3-eu-central-1.amazonaws.com, s3-eu-central-1.amazonaws.com, s3.eu-
central-1.amazonaws.com, s3.dualstack.eu-central-1.amazonaws.com, 
*.s3.dualstack.eu-central-1.amazonaws.com, *.s3.amazonaws.com 

it then seems that he is reading the CNAME rule and looking up the correct domain (amazon s3) then it confront this against my domain and see it is a different name, it then stops before redirecting. For this reason if I remove the s it will give no error. Now I'd try to install let's encrypt and see if having a certificate would help, but my guess it will still make this check ad give again a similar if not the same result.

Answer 1

The CNAME in your DNS zone is working as you expect, but browsers check that the certificate presented by the remote web site is valid for the domain being visited.

The amazon s3 server where your data is stored does not have or present a valid certificate for s3.mydomain.com, so all visitors will see the certificate warning.

This is completely normal and is exactly how SSL certificates are supposed to work - otherwise any site could pretend to be any other SSL encrypted site. Certificates are used for authentication as well as just encryption, with the identity verification being done by the Certificate Authority (CA) when the certificate is purchased. If you're not who you say you are when you purchase the certificate, the CA should refuse to create it or issue it to you - if they don't do that verification step, they'll find themselves removed from the default trusted CA list distributed with web browsers like Firefox, Chromium, IE, Edge, etc.

The "normal" way to do what you want to run your own https server for your domain WITH a certificate signed by a certificate authority that is known and trusted by the browser. For private/intranet type web applications, you can run your own CA and distribute the CA's certificate to your users. For public web-sites, it's best/easiest to just buy a certificate from one of the well-known CAs.

The application code on your server should then fetch the required data from amazon and return it to the user, who never needs to know or care that amazon was involved.

Answer 2

A CNAME is not a redirect, it's an alias. What it does is tell a DNS resolver that your s3.example.com address should use the same DNS information as amazon's s3 domain.

This all happens at the DNS level, not the browser level. As far as the browser is concerned it is still connecting to s3.example.com so when it attempts to validate the SSL certificate it is expecting to find a certificate which matches that domain.

I'm not familiar with amazon's services but you will need a way for them to present a valid certificate to use your custom domain with HTTPS. If that's not possible, you'll have to either stick to plain HTTP or stop using your custom domain.