Description of problem: We need the SAN of the created self-signed certificate to add *. to the hostname specified in RGW zonegroup spec option, So, for example, if you add in the spec: zonegroup_hostnames: - s3.cephlab.com By default, in the certificate's SAN, we will add *.s3.cephlab.com; this is a requirement for accessing buckets in virtual host mode, as the URL to access buckets will be https://BUCKETNAME.s3.cephlabs.com. With the SAN wildcard, you cover all the bucket names. At the moment, virtual host bucket access is not working because you get the following certificate verification error: # curl https://bucket1.s3.cephlab.com curl: (60) SSL: no alternative certificate subject name matches target host name 'bucket1.s3.cephlab.com' More details here: https://curl.se/docs/sslcerts.html
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2025:9775