benbjohnson/litestream · error

s3: sse-customer-algorithm must be AES256, got %q

Error message

s3: sse-customer-algorithm must be AES256, got %q

What it means

SSE-C validation guard: sse-customer-algorithm was set to something other than AES256 (the only algorithm S3 SSE-C supports; empty defaults to AES256). The configured value is rejected before any request is made.

Source

Thrown at s3/replica_client.go:540

			}
		})
	}
}

// validateSSEConfig validates server-side encryption configuration.
func (c *ReplicaClient) validateSSEConfig() error {
	// Check mutual exclusivity: SSE-C and SSE-KMS cannot both be set
	if c.SSECustomerKey != "" && c.SSEKMSKeyID != "" {
		return fmt.Errorf("s3: cannot use both sse-customer-key and sse-kms-key-id; they are mutually exclusive")
	}

	// Validate SSE-C configuration
	if c.SSECustomerKey != "" {
		// Algorithm must be AES256 (or default to it)
		if c.SSECustomerAlgorithm == "" {
			c.SSECustomerAlgorithm = "AES256"
		} else if c.SSECustomerAlgorithm != "AES256" {
			return fmt.Errorf("s3: sse-customer-algorithm must be AES256, got %q", c.SSECustomerAlgorithm)
		}

		// Validate key is valid base64 and correct length (256 bits = 32 bytes)
		keyBytes, err := base64.StdEncoding.DecodeString(c.SSECustomerKey)
		if err != nil {
			return fmt.Errorf("s3: sse-customer-key must be valid base64: %w", err)
		}
		if len(keyBytes) != 32 {
			return fmt.Errorf("s3: sse-customer-key must be 256-bit (32 bytes) when decoded, got %d bytes", len(keyBytes))
		}

		// Auto-compute MD5 if not provided
		if c.SSECustomerKeyMD5 == "" {
			sum := md5.Sum(keyBytes)
			c.SSECustomerKeyMD5 = base64.StdEncoding.EncodeToString(sum[:])
		}

		// SSE-C requires HTTPS (except for localhost/private networks for testing)

View on GitHub (pinned to 4ed7a308f6)

Solutions

1. Set sse-customer-algorithm to AES256 or omit it

When it happens

Trigger: Thrown at s3/replica_client.go:540 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/74fa9a15e3469df7. Report an issue: GitHub.