{"record":{"id":"0ee79e4095a5ffb6","repo":"benbjohnson/litestream","slug":"s3-sse-customer-key-must-be-256-bit-32-bytes-wh","errorCode":null,"errorMessage":"s3: sse-customer-key must be 256-bit (32 bytes) when decoded, got %d bytes","messagePattern":"s3: sse-customer-key must be 256-bit \\(32 bytes\\) when decoded, got (.+?) bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"s3/replica_client.go","lineNumber":549,"sourceCode":"\t\treturn fmt.Errorf(\"s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive\")\n\t}\n\n\t// Validate SSE-C configuration\n\tif c.SSECustomerKey != \"\" {\n\t\t// Algorithm must be AES256 (or default to it)\n\t\tif c.SSECustomerAlgorithm == \"\" {\n\t\t\tc.SSECustomerAlgorithm = \"AES256\"\n\t\t} else if c.SSECustomerAlgorithm != \"AES256\" {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-algorithm must be AES256, got %q\", c.SSECustomerAlgorithm)\n\t\t}\n\n\t\t// Validate key is valid base64 and correct length (256 bits = 32 bytes)\n\t\tkeyBytes, err := base64.StdEncoding.DecodeString(c.SSECustomerKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-key must be valid base64: %w\", err)\n\t\t}\n\t\tif len(keyBytes) != 32 {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-key must be 256-bit (32 bytes) when decoded, got %d bytes\", len(keyBytes))\n\t\t}\n\n\t\t// Auto-compute MD5 if not provided\n\t\tif c.SSECustomerKeyMD5 == \"\" {\n\t\t\tsum := md5.Sum(keyBytes)\n\t\t\tc.SSECustomerKeyMD5 = base64.StdEncoding.EncodeToString(sum[:])\n\t\t}\n\n\t\t// SSE-C requires HTTPS (except for localhost/private networks for testing)\n\t\tif c.Endpoint != \"\" {\n\t\t\tendpoint := c.Endpoint\n\t\t\tif !strings.HasPrefix(endpoint, \"http://\") && !strings.HasPrefix(endpoint, \"https://\") {\n\t\t\t\tendpoint = \"https://\" + endpoint\n\t\t\t}\n\t\t\tif strings.HasPrefix(endpoint, \"http://\") {\n\t\t\t\tu, err := url.Parse(endpoint)\n\t\t\t\tif err == nil {\n\t\t\t\t\thost := u.Hostname()","sourceCodeStart":531,"sourceCodeEnd":567,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/s3/replica_client.go#L531-L567","documentation":"SSE-C validation in the S3 client's validateSSEConfig: the base64-decoded sse-customer-key is not exactly 32 bytes (256 bits), the key length AES256 SSE-C requires. Fires when a decoded key of any other byte length is supplied.","triggerScenarios":"Thrown at s3/replica_client.go:549 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a 32-byte key, base64-encoded: openssl rand -base64 32"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}