title: Amazon S3: using DNS alias to bucket + HTTPS at the same time
body: <p>I want to create an S3 bucket in the Frankfurt zone, and make the files accessible with the URL: <code>https://files.stample.co/filename</code></p>
  
  <p>So I want both HTTPS, and a custom DNS alias (CNAME) at the same time.</p>
  
  <p>According to what I understand, Amazon has a wildcard certificate for URL <code>https://*.s3.amazonaws.com</code>. </p>
  
  <h1>HTTPS / SSL</h1>
  
  <p>So this wildcard will:</p>
  
  <ul>
  <li>Work for <code>https://stample-files.s3.amazonaws.com</code> </li>
  <li>Not work for <code>https://files.stample.co.s3.amazonaws.com</code></li>
  </ul>
  
  <p>So what I understand and confirmed by other StackOverflow <a href="https://stackoverflow.com/a/11203685/82609">posts</a> is that if I want SSL to work I have to use a bucket name with no dot otherwise the Amazon certificat with wildcard won't match the bucket domain.</p>
  
  <h1>Using DNS alias / CNAME</h1>
  
  <p>On this <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html" rel="nofollow noreferrer">S3 documentation</a>, under <code>Customizing Amazon S3 URLs with CNAMEs</code> section:</p>
  
  <blockquote>
    <p>Depending on your needs, you might not want "s3.amazonaws.com" to appear on your website or service. For example, if you host your website images on Amazon S3, you might prefer <a href="http://images.johnsmith.net/" rel="nofollow noreferrer">http://images.johnsmith.net/</a> instead of <a href="http://johnsmith-images.s3.amazonaws.com/" rel="nofollow noreferrer">http://johnsmith-images.s3.amazonaws.com/</a>.</p>
    
    <p>The bucket name must be the same as the CNAME. So <a href="http://images.johnsmith.net/filename" rel="nofollow noreferrer">http://images.johnsmith.net/filename</a> would be the same as <a href="http://images.johnsmith.net.s3.amazonaws.com/filename" rel="nofollow noreferrer">http://images.johnsmith.net.s3.amazonaws.com/filename</a> if a CNAME were created to map images.johnsmith.net to images.johnsmith.net.s3.amazonaws.com.</p>
  </blockquote>
  
  <p>This seems to be for technical reasons because otherwise Amazon can't know the bucket we try to target:</p>
  
  <blockquote>
    <p>Because Amazon S3 sees only the original host name www.example.com and is unaware of the CNAME mapping used to resolve the request, the CNAME and the bucket name must be the same.</p>
  </blockquote>
  
  <p>So what I understand here is that for CNAME to work, we have to use dots in the bucketname. </p>
  
  <h1>Both together ?</h1>
  
  <p>If I use dots in bucket name:</p>
  
  <ul>
  <li>SSL won't work </li>
  <li>CNAME will work</li>
  </ul>
  
  <p>If I don't use dots in bucket name:</p>
  
  <ul>
  <li>SSL will work </li>
  <li>CNAME won't work</li>
  </ul>
  
  <p>I've tested both cases and could not make SSL and CNAME work fine together.</p>
  
  <p><strong>What can I do to make both work?</strong> It seems to me that what I want to achieve is not very fancy...</p>