Configuring S3 bucket for virtual-hosted style requests causing SSL error

Hi everyone! I have created S3 bucket named “http://sub.domain.com|sub.domain.com” to use as <https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html#virtual-hosted-style-access|Virtual-hosted–style requests>. I have mapped my “http://sub.domain.com|sub.domain.com” to “http://sub.domain.com.s3.region-code.amazonaws.com|sub.domain.com.s3.region-code.amazonaws.com” in DNS records.

Issue is When I used bucket image object in my web app in html img src tag like “https://sub.domain.com/image.jpg”, I got (failed)net::ERR_CERT_COMMON_NAME_INVALID error status.

My SSL certificate is wildcard certificate *.http://domain.com|domain.com

Bucket is public, Image is accessed by http, but not https.

To be able to use HTTPS you need to deploy and serve content through CloudFront. You can’t use your own certificate with S3 bucket.

If I use CloudFront, How can I restrict access to only my web app?

WAF Web ACL or Lambda@Edge. It depends what you mean by “restrict access”.

Mean to say that, my bucket images can only be access in my web app Html img tag. Not via browser url.

You can use CORS with CloudFront and S3.

I tried CORS with S3 but it didn’t work. Do we have CORS option in Cloudfront ?

I restrict access using “Condtions” section in Bucket policy in S3 like

“Condition”: {
“StringLike”: {
“aws:Referer”: [
https://my.domain.com/*
]
}
}

It worked and images can only be accessed by web app.

But as you said for Https , I need to use CloudFront. Thats why I am asking to have restrict option to only web app.

If you would like to rely on Referer header then you can use WAF or Lambda@Edge.

Yes I also know that its not secure to use Referer header.
okay Thank you!

Here is an example for User-agent: https://repost.aws/knowledge-center/waf-block-http-requests-no-user-agent
It will look very simiar for Referer header.