<p>My Elasticsearch7.8.0 is running in OCI OKE (Kubernetes running in Oracle Cloud). I want to setup Elasticsearch backup snapshot with OCI Object store using OCI Amazon S3 Compatibility API. Added repository-s3 plugin and configured ACCESS_KEY and SECRET_KEY in the PODs. While repository, I am getting &quot;s_s_l_peer_unverified_exception&quot;</p>
<pre><code>PUT /_snapshot/s3-repository

{
  &quot;type&quot;: &quot;s3&quot;,
  &quot;settings&quot;: {
    &quot;client&quot;: &quot;default&quot;,
    &quot;region&quot;: &quot;OCI_REGION&quot;,
    &quot;endpoint&quot;: &quot;OCI_TENANCY.compat.objectstorage.OCI_REGION.oraclecloud.com&quot;,
     &quot;bucket&quot;: &quot;es-backup&quot;    
  }
}
</code></pre>
<p>Respose :</p>
<pre><code>{
  &quot;error&quot; : {
    &quot;root_cause&quot; : [
      {
        &quot;type&quot; : &quot;repository_verification_exception&quot;,
        &quot;reason&quot; : &quot;[s3-repository] path  is not accessible on master node&quot;
      }
    ],
    &quot;type&quot; : &quot;repository_verification_exception&quot;,
    &quot;reason&quot; : &quot;[s3-repository] path  is not accessible on master node&quot;,
    &quot;caused_by&quot; : {
      &quot;type&quot; : &quot;i_o_exception&quot;,
      &quot;reason&quot; : &quot;Unable to upload object [tests-0J3NChNRT9WIQJknHAssKg/master.dat] using a single upload&quot;,
      &quot;caused_by&quot; : {
        &quot;type&quot; : &quot;sdk_client_exception&quot;,
        &quot;reason&quot; : &quot;Unable to execute HTTP request: Certificate for &lt;es-backup.OCI_TENANCY.compat.objectstorage.OCI_REGION.oraclecloud.com&gt; doesn't match any of the subject alternative names: [swiftobjectstorage.us-ashburn-1.oraclecloud.com]&quot;,
        &quot;caused_by&quot; : {
          &quot;type&quot; : &quot;s_s_l_peer_unverified_exception&quot;,
          &quot;reason&quot; : &quot;Certificate for &lt;es-backup.OCI_TENANCY.compat.objectstorage.OCI_REGION.oraclecloud.com&gt; doesn't match any of the subject alternative names: [swiftobjectstorage.us-ashburn-1.oraclecloud.com]&quot;
        }
      }
    }
  },
  &quot;status&quot; : 500
}
</code></pre>

<p>Well you shouldn't be talking to es-backup.OCI_TENANCY.compat.objectstorage.OCI_REGION.oraclecloud.com where your bucket name is part of the domain. You can try it in your browser and you'll get a similar security warning about certs.</p>
<p>If you look at <a href="https://docs.cloud.oracle.com/en-us/iaas/Content/Object/Tasks/s3compatibleapi.htm#usingAPI" rel="nofollow noreferrer">https://docs.cloud.oracle.com/en-us/iaas/Content/Object/Tasks/s3compatibleapi.htm#usingAPI</a> you'll see a mention of:</p>
<blockquote>
<p>The application must use path -based access. Virtual host-style access (accessing a bucket as bucketname.namespace.compat.objectstorage.region.oraclecloud.com) is not supported.</p>
</blockquote>
<p>AWS is migrating from path based to sub-domain based URLs for S3 (<a href="https://aws.amazon.com/blogs/aws/amazon-s3-path-deprecation-plan-the-rest-of-the-story/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/aws/amazon-s3-path-deprecation-plan-the-rest-of-the-story/</a>) so the ES S3 plugin is probably defaulting to doing things the new AWS way.</p>
<p>Does it make a difference if you use an https:// URL for the endpoint value? Looking at my 6.8 config I have something like:</p>
<pre><code>{
  &quot;s3-repository&quot;: {
    &quot;type&quot;: &quot;s3&quot;,
    &quot;settings&quot;: {
      &quot;bucket&quot;: &quot;es-backup&quot;,
      &quot;client&quot;: &quot;default&quot;,
      &quot;endpoint&quot;: &quot;https://{namespace}.compat.objectstorage.us-ashburn-1.oraclecloud.com/&quot;,
      &quot;region&quot;: &quot;us-ashburn-1&quot;
    }
  }
}
</code></pre>
<p>What I'm guessing is that having a full URL for the endpoint probably sets the <strong>protocol</strong> and <strong>path_style_access</strong> or 6.8 didn't require you to set <strong>path_style_access</strong> to <strong>true</strong> but 7.8 might. Either way, try a full URL or setting <strong>path_style_access</strong> to <strong>true</strong>. Relevant docs at <a href="https://www.elastic.co/guide/en/elasticsearch/plugins/master/repository-s3-client.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/elasticsearch/plugins/master/repository-s3-client.html</a></p>
