{"record":{"id":"e4baab9f1e53a27a","repo":"benbjohnson/litestream","slug":"s3-sse-customer-key-must-be-valid-base64-w","errorCode":null,"errorMessage":"s3: sse-customer-key must be valid base64: %w","messagePattern":"s3: sse-customer-key must be valid base64: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"s3/replica_client.go","lineNumber":546,"sourceCode":"func (c *ReplicaClient) validateSSEConfig() error {\n\t// Check mutual exclusivity: SSE-C and SSE-KMS cannot both be set\n\tif c.SSECustomerKey != \"\" && c.SSEKMSKeyID != \"\" {\n\t\treturn fmt.Errorf(\"s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive\")\n\t}\n\n\t// Validate SSE-C configuration\n\tif c.SSECustomerKey != \"\" {\n\t\t// Algorithm must be AES256 (or default to it)\n\t\tif c.SSECustomerAlgorithm == \"\" {\n\t\t\tc.SSECustomerAlgorithm = \"AES256\"\n\t\t} else if c.SSECustomerAlgorithm != \"AES256\" {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-algorithm must be AES256, got %q\", c.SSECustomerAlgorithm)\n\t\t}\n\n\t\t// Validate key is valid base64 and correct length (256 bits = 32 bytes)\n\t\tkeyBytes, err := base64.StdEncoding.DecodeString(c.SSECustomerKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-key must be valid base64: %w\", err)\n\t\t}\n\t\tif len(keyBytes) != 32 {\n\t\t\treturn fmt.Errorf(\"s3: sse-customer-key must be 256-bit (32 bytes) when decoded, got %d bytes\", len(keyBytes))\n\t\t}\n\n\t\t// Auto-compute MD5 if not provided\n\t\tif c.SSECustomerKeyMD5 == \"\" {\n\t\t\tsum := md5.Sum(keyBytes)\n\t\t\tc.SSECustomerKeyMD5 = base64.StdEncoding.EncodeToString(sum[:])\n\t\t}\n\n\t\t// SSE-C requires HTTPS (except for localhost/private networks for testing)\n\t\tif c.Endpoint != \"\" {\n\t\t\tendpoint := c.Endpoint\n\t\t\tif !strings.HasPrefix(endpoint, \"http://\") && !strings.HasPrefix(endpoint, \"https://\") {\n\t\t\t\tendpoint = \"https://\" + endpoint\n\t\t\t}\n\t\t\tif strings.HasPrefix(endpoint, \"http://\") {","sourceCodeStart":528,"sourceCodeEnd":564,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/s3/replica_client.go#L528-L564","documentation":"SSE-C validation in the S3 client's validateSSEConfig: the configured sse-customer-key is not valid base64. Fires during Init when the key string cannot be decoded with base64.StdEncoding; SSE-C keys must be provided base64-encoded.","triggerScenarios":"Thrown at s3/replica_client.go:546 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide the key as base64 of the raw 32 bytes","Regenerate with: openssl rand -base64 32"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}