'Wildcard matching for *.s3.amazonaws.com and similar per region.
Per http://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html:
"We recommend that all bucket names comply with DNS naming conventions."
Per http://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html:
"When using virtual hosted-style buckets with SSL, the SSL
wild card certificate only matches buckets that do not contain
periods. To work around this, use HTTP or write your own
certificate verification logic."
Therefore, we need a custom validation routine that allows
mybucket.example.com.s3.amazonaws.com to be considered a valid
hostname for the *.s3.amazonaws.com wildcard cert, and for the
region-specific *.s3-[region].amazonaws.com wildcard cert.
We also forgive non-S3 wildcard certificates should the
hostname match, to allow compatibility with other S3
API-compatible storage providers.'

def forgive_wildcard_cert(self, cert, hostname):

    debug(u'checking    SSL    subjectAltName    as    forgiving    wildcard    cert')
    san = cert.get('subjectAltName', ())
    cleaned_host_bucket_config = urlparse(('https://' + Config.host_bucket)).hostname
    for (key, value) in san:
        if (key == 'DNS'):
            if ((value.startswith('*.s3') and (value.endswith('.amazonaws.com') and hostname.endswith('.amazonaws.com'))) or (value.endswith('.amazonaws.com.cn') and hostname.endswith('.amazonaws.com.cn'))):
                return True
            elif ((value == (cleaned_host_bucket_config % {'bucket': '*', 'location': Config.bucket_location})) and hostname.endswith((cleaned_host_bucket_config % {'bucket': '', 'location': Config.bucket_location}))):
                return True
    return False
