{"record":{"id":"74fa9a15e3469df7","repo":"benbjohnson/litestream","slug":"s3-sse-customer-algorithm-must-be-aes256-got-q","errorCode":null,"errorMessage":"s3: sse-customer-algorithm must be AES256, got %q","messagePattern":"s3: sse-customer-algorithm must be AES256, got %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"s3/replica_client.go","lineNumber":540,"sourceCode":"\t\t\t}\n\t\t})\n\t}\n}\n\n// validateSSEConfig validates server-side encryption configuration.\nfunc (c *ReplicaClient) validateSSEConfig() error {\n\t// Check mutual exclusivity: SSE-C and SSE-KMS cannot both be set\n\tif c.SSECustomerKey != \"\" && c.SSEKMSKeyID != \"\" {\n\t\treturn fmt.Errorf(\"s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive\")\n\t}\n\n\t// Validate SSE-C configuration\n\tif c.SSECustomerKey != \"\" {\n\t\t// Algorithm must be AES256 (or default to it)\n\t\tif c.SSECustomerAlgorithm == \"\" {\n\t\t\tc.SSECustomerAlgorithm = \"AES256\"\n\t\t} else if c.SSECustomerAlgorithm != \"AES256\" {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-algorithm must be AES256, got %q\", c.SSECustomerAlgorithm)\n\t\t}\n\n\t\t// Validate key is valid base64 and correct length (256 bits = 32 bytes)\n\t\tkeyBytes, err := base64.StdEncoding.DecodeString(c.SSECustomerKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-key must be valid base64: %w\", err)\n\t\t}\n\t\tif len(keyBytes) != 32 {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-key must be 256-bit (32 bytes) when decoded, got %d bytes\", len(keyBytes))\n\t\t}\n\n\t\t// Auto-compute MD5 if not provided\n\t\tif c.SSECustomerKeyMD5 == \"\" {\n\t\t\tsum := md5.Sum(keyBytes)\n\t\t\tc.SSECustomerKeyMD5 = base64.StdEncoding.EncodeToString(sum[:])\n\t\t}\n\n\t\t// SSE-C requires HTTPS (except for localhost/private networks for testing)","sourceCodeStart":522,"sourceCodeEnd":558,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/s3/replica_client.go#L522-L558","documentation":"SSE-C validation guard: sse-customer-algorithm was set to something other than AES256 (the only algorithm S3 SSE-C supports; empty defaults to AES256). The configured value is rejected before any request is made.","triggerScenarios":"Thrown at s3/replica_client.go:540 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set sse-customer-algorithm to AES256 or omit it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}