Problem using s3 for file storage: ERR_TLS_CERT_ALTNAME_INVALID

Description:

When using s3 file storage against DigitalOcean, RocketChat is throwing a TLS error that doesn't make sense.

Steps to reproduce:

1. Set up a space DigitalOcean.
2. Set RocketChat to use s3 and configure it with the settings from DigitalOcean.
3. Attempt to upload a file to RocketChat.

Actual behavior:

You get an error in the banner saying:

NetworkingError [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: cdn.heyaaron.com.sfo3.digitaloceanspaces.com. is not in the cert's altnames: DNS:*.sfo3.digitaloceanspaces.com, DNS:sfo3.digitaloceanspaces.com [ufs: cannot upload file]

Expected behavior:

RocketChat would correctly recognize that cdn.heyaaron.com.sfo3.digitaloceanspaces.com is in the certs altname DNS:*.sfo3.digitaloceanspaces.com due to the wildcard.

Server Setup Information:

• Version of Rocket.Chat Server: 4.7.4
• Operating System: Linux/kubernetes
• Deployment Method: kubernetes rocketchat helm chart
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version: Whatever version is included in the official rocketchat docker image
• MongoDB Version: Whatever version is included in the official rocketchat helm chart

Client Setup Information

• Desktop App or Browser Version: RocketChat Debian package 3.8.7
• Operating System: Linux

Relevant logs:

FileStream {
  _readableState: ReadableState {
    objectMode: false,
    highWaterMark: 16384,
    buffer: BufferList { head: null, tail: null, length: 0 },
    length: 0,
    pipes: [],
    flowing: null,
    ended: false,
    endEmitted: false,
    reading: false,
    sync: true,
    needReadable: false,
    emittedReadable: false,
    readableListening: false,
    resumeScheduled: false,
    errorEmitted: false,
    emitClose: true,
    autoDestroy: true,
    destroyed: false,
    errored: null,
    closed: false,
    closeEmitted: false,
    defaultEncoding: 'utf8',
    awaitDrainWriters: null,
    multiAwaitDrain: false,
    readingMore: false,
    dataEmitted: false,
    decoder: null,
    encoding: null,
    [Symbol(kPaused)]: null
  },
  _events: [Object: null prototype] {
    end: [Function: bound onceWrapper] { listener: [Function (anonymous)] }
  },
  _eventsCount: 1,
  _maxListeners: undefined,
  truncated: false,
  _readcb: null,
  [Symbol(kCapture)]: false
}
{"level":50,"time":"2022-07-26T23:15:12.896Z","pid":1,"hostname":"rocketchat-rocketchat-66b9d75c68-v8hx6","name":"System","err":{"cert":{"bits":2048,"exponent":"0x10001","ext_key_usage":["1.3.6.1.5.5.7.3.1","1.3.6.1.5.5.7.3.2"],"fingerprint":"A2:C9:FA:F3:65:8B:AE:51:3D:C3:E9:55:A4:49:8E:D5:BD:1E:E9:9E","fingerprint256":"5D:2D:3C:29:74:23:4C:AE:0B:B1:59:0A:C5:76:F0:C7:97:35:04:8D:82:E8:0C:18:45:1D:90:A8:A8:E3:DF:A2","infoAccess":{"CA Issuers - URI":["http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt"],"OCSP - URI":["http://ocsp.digicert.com"]},"issuer":{"C":"US","CN":"DigiCert TLS RSA SHA256 2020 CA1","O":"DigiCert Inc"},"issuerCertificate":{"bits":2048,"exponent":"0x10001","ext_key_usage":["1.3.6.1.5.5.7.3.1","1.3.6.1.5.5.7.3.2"],"fingerprint":"1C:58:A3:A8:51:8E:87:59:BF:07:5B:76:B7:50:D4:F2:DF:26:4F:CD","fingerprint256":"52:27:4C:57:CE:4D:EE:3B:49:DB:7A:7F:F7:08:C0:40:F7:71:89:8B:3B:E8:87:25:A8:6F:B4:43:01:82:FE:14","infoAccess":{"CA Issuers - URI":["http://cacerts.digicert.com/DigiCertGlobalRootCA.crt"],"OCSP - URI":["http://ocsp.digicert.com"]},"issuer":{"C":"US","CN":"DigiCert Global Root CA","O":"DigiCert Inc","OU":"www.digicert.com"},"issuerCertificate":{"bits":2048,"exponent":"0x10001","fingerprint":"A8:98:5D:3A:65:E5:E5:C4:B2:D7:D6:6D:40:C6:DD:2F:B1:9C:54:36","fingerprint256":"43:48:A0:E9:44:4C:78:CB:26:5E:05:8D:5E:89:44:B4:D8:4F:96:62:BD:26:DB:25:7F:89:34:A4:43:C7:01:61","issuer":{"C":"US","CN":"DigiCert Global Root CA","O":"DigiCert Inc","OU":"www.digicert.com"},"issuerCertificate":"[Circular]","modulus":"E23BE11172DEA8A4D3A357AA50A28F0B7790C9A2A5EE12CE965B010920CC0193A74E30B753F743C46900579DE28D22DD870640008109CECE1B83BFDFCD3B7146E2D666C705B37627168F7B9E1E957DEEB748A308DAD6AF7A0C3906657F4A5D1FBC17F8ABBEEE28D7747F7A78995985686E5C23324BBF4EC0E85A6DE370BF7710BFFC01F685D9A844105832A97518D5D1A2BE47E2276AF49A33F84908608BD45FB43A84BFA1AA4A4C7D3ECF4F5F6C765EA04B37919EDC22E66DCE141A8E6ACBFECDB3146417C75B299E32BFF2EEFAD30B42D4ABB74132DA0CD4EFF881D5BB8D583FB51BE84928A270DA3104DDF7B216F24C0A4E07A8ED4A3D5EB57FA390C3AF27","pubkey":{"data":"[Array]","type":"Buffer"},"raw":{"data":"[Array]","type":"Buffer"},"serialNumber":"083BE056904246B1A1756AC95991C74A","subject":{"C":"US","CN":"DigiCert Global Root CA","O":"DigiCert Inc","OU":"www.digicert.com"},"valid_from":"Nov 10 00:00:00 2006 GMT","valid_to":"Nov 10 00:00:00 2031 GMT"},"modulus":"C14BB3654770BCDD4F58DBEC9CEDC366E51F311354AD4A66461F2C0AEC6407E52EDCDCB90A20EDDFE3C4D09E9AA97A1D8288E51156DB1E9F58C251E72C340D2ED292E156CBF1795FB3BB87CA25037B9A52416610604F571349F0E8376783DFE7D34B674C2251A6DF0E9910ED57517426E27DC7CA622E131B7F238825536FC13458008B84FFF8BEA75849227B96ADA2889B15BCA07CDFE951A8D5B0ED37E236B4824B62B5499AECC767D6E33EF5E3D6125E44F1BF71427D58840380B18101FAF9CA32BBB48E278727C52B74D4A8D697DEC364F9CACE53A256BC78178E490329AEFB494FA415B9CEF25C19576D6B79A72BA2272013B5D03D40D321300793EA99F5","pubkey":{"data":[48,130,1,34,48,13,6,9,42,134,72,134,247,13,1,1,1,5,0,3,130,1,15,0,48,130,1,10,2,130,1,1,0,193,75,179,101,71,112,188,221,79,88,219,236,156,237,195,102,229,31,49,19,84,173,74,102,70,31,44,10,236,100,7,229,46,220,220,185,10,32,237,223,227,196,208,158,154,169,122,29,130,136,229,17,86,219,30,159,88,194,81,231,44,52,13,46,210,146,225,"... 193 items not stringified"],"type":"Buffer"},"raw":{"data":[48,130,4,190,48,130,3,166,160,3,2,1,2,2,16,6,216,217,4,213,88,67,70,246,138,47,167,84,34,126,196,48,13,6,9,42,134,72,134,247,13,1,1,11,5,0,48,97,49,11,48,9,6,3,85,4,6,19,2,85,83,49,21,48,19,6,3,85,4,10,19,12,68,105,103,105,67,101,114,116,32,73,110,99,49,25,48,23,6,3,85,4,11,19,16,119,119,119,46,100,"... 1117 items not stringified"],"type":"Buffer"},"serialNumber":"06D8D904D5584346F68A2FA754227EC4","subject":{"C":"US","CN":"DigiCert TLS RSA SHA256 2020 CA1","O":"DigiCert Inc"},"valid_from":"Apr 14 00:00:00 2021 GMT","valid_to":"Apr 13 23:59:59 2031 GMT"},"modulus":"BA76560D6BBEFEB05E5A5BC0683025E036F090516BA43A8F0238D137B9B0E7EA912956A403D5AF8E58467099976806E1558A73E2F718C4CF9D31680F8AA8450D5D60C1B53CD5AB772144EF59D5D465B7E98516E7CBB33071B437C3AA028A31B85C455513C52943A87DB063E7BCEB92A0ED2F6BFE6008BB9BD2352B6C815988BF13ADDFFA64AFD9986305CCB8D6317D4930E5574462C0555BFCE826FE990700881CE5FF8EAF39931170FB20CEB62DD9A58187DB6E276EF3000F741434798749E00B00F54258D3963B8FBFA213B3343C7C79CBE8A76F8B4804C95706B71ECEFA7D7E57FC368AA94789A4DF01702DB721D9B52474CD50B9C9F3CA878B21B33F5C2F","pubkey":{"data":[48,130,1,34,48,13,6,9,42,134,72,134,247,13,1,1,1,5,0,3,130,1,15,0,48,130,1,10,2,130,1,1,0,186,118,86,13,107,190,254,176,94,90,91,192,104,48,37,224,54,240,144,81,107,164,58,143,2,56,209,55,185,176,231,234,145,41,86,164,3,213,175,142,88,70,112,153,151,104,6,225,85,138,115,226,247,24,196,207,157,49,104,15,138,168,69,13,93,96,193,"... 193 items not stringified"],"type":"Buffer"},"raw":{"data":[48,130,6,239,48,130,5,215,160,3,2,1,2,2,16,4,184,36,187,51,243,56,17,36,169,159,168,10,158,47,76,48,13,6,9,42,134,72,134,247,13,1,1,11,5,0,48,79,49,11,48,9,6,3,85,4,6,19,2,85,83,49,21,48,19,6,3,85,4,10,19,12,68,105,103,105,67,101,114,116,32,73,110,99,49,41,48,39,6,3,85,4,3,19,32,68,105,103,105,67,"... 1678 items not stringified"],"type":"Buffer"},"serialNumber":"04B824BB33F3381124A99FA80A9E2F4C","subject":{"C":"US","CN":"*.sfo3.digitaloceanspaces.com","L":"New York","O":"DigitalOcean, LLC","ST":"New York"},"subjectaltname":"DNS:*.sfo3.digitaloceanspaces.com, DNS:sfo3.digitaloceanspaces.com","valid_from":"Dec  7 00:00:00 2021 GMT","valid_to":"Dec 23 23:59:59 2022 GMT"},"code":"NetworkingError","host":"cdn.heyaaron.com.sfo3.digitaloceanspaces.com","hostname":"cdn.heyaaron.com.sfo3.digitaloceanspaces.com","message":"Hostname/IP does not match certificate's altnames: Host: cdn.heyaaron.com.sfo3.digitaloceanspaces.com. is not in the cert's altnames: DNS:*.sfo3.digitaloceanspaces.com, DNS:sfo3.digitaloceanspaces.com","reason":"Host: cdn.heyaaron.com.sfo3.digitaloceanspaces.com. is not in the cert's altnames: DNS:*.sfo3.digitaloceanspaces.com, DNS:sfo3.digitaloceanspaces.com","region":"sfo3","retryable":true,"stack":"Error [ERR_TLS_CERT_ALTNAME_INVALID] [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: cdn.heyaaron.com.sfo3.digitaloceanspaces.com. is not in the cert's altnames: DNS:*.sfo3.digitaloceanspaces.com, DNS:sfo3.digitaloceanspaces.com\n    at new NodeError (internal/errors.js:322:7)\n    at Object.checkServerIdentity (tls.js:347:12)\n    at TLSSocket.onConnectSecure (_tls_wrap.js:1525:27)\n    at TLSSocket.emit (events.js:400:28)\n    at TLSSocket.emit (domain.js:475:12)\n    at TLSSocket._finishInit (_tls_wrap.js:937:8)\n    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:709:12)\n    at TLSWrap.callbackTrampoline (internal/async_hooks.js:130:17)","time":"2022-07-26T23:15:12.896Z","type":"NodeError"},"msg":"Hostname/IP does not match certificate's altnames: Host: cdn.heyaaron.com.sfo3.digitaloceanspaces.com. is not in the cert's altnames: DNS:*.sfo3.digitaloceanspaces.com, DNS:sfo3.digitaloceanspaces.com"}

No source files or tests are named. Start by reproducing the S3 file upload with the reported DigitalOcean endpoint and inspect the S3 storage configuration and upload entry point; done means the upload completes without the reported TLS hostname error or the expected behavior is clarified.