benbjohnson/litestream · error

s3: sse-customer-key requires HTTPS endpoint (HTTP only allo

Error message

s3: sse-customer-key requires HTTPS endpoint (HTTP only allowed for localhost/private networks)

What it means

SSE-C validation guard: SSE-C sends the encryption key in the request, so a plain-HTTP custom endpoint is only tolerated for localhost/loopback/private addresses. The configured http:// endpoint resolves to a public host and is rejected to prevent leaking the key in cleartext.

Source

Thrown at s3/replica_client.go:574

		}

		// SSE-C requires HTTPS (except for localhost/private networks for testing)
		if c.Endpoint != "" {
			endpoint := c.Endpoint
			if !strings.HasPrefix(endpoint, "http://") && !strings.HasPrefix(endpoint, "https://") {
				endpoint = "https://" + endpoint
			}
			if strings.HasPrefix(endpoint, "http://") {
				u, err := url.Parse(endpoint)
				if err == nil {
					host := u.Hostname()
					// Allow localhost by name
					if host == "localhost" {
						// OK - localhost is allowed
					} else if ip := net.ParseIP(host); ip != nil && (ip.IsLoopback() || ip.IsPrivate()) {
						// OK - loopback (127.x.x.x) or private RFC1918 ranges (10.x, 172.16-31.x, 192.168.x)
					} else {
						return fmt.Errorf("s3: sse-customer-key requires HTTPS endpoint (HTTP only allowed for localhost/private networks)")
					}
				}
			}
		}
	}

	return nil
}

// transportRetryMaxAttempts caps total attempts per operation; exponential
// backoff between attempts still bounds request rate during outages.
const transportRetryMaxAttempts = 10

// newTransportRetryer returns a retryer that keeps retrying through sustained
// object-store transport flaps. The SDK's default token bucket (and the
// adaptive mode previously configured here) only refills retry quota on
// successful responses, so a sustained provider flap drains it to zero and
// every subsequent operation fails fast ("retry quota exceeded, 0 available")

View on GitHub (pinned to 4ed7a308f6)

Solutions

1. Use an https:// endpoint for the S3-compatible service
2. Or restrict endpoints to localhost/private IPs for testing

When it happens

Trigger: Thrown at s3/replica_client.go:574 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/3effbaa47626beb8. Report an issue: GitHub.