H2O Model Save to S3 Fails Due to SSL Certificate Hostname Mismatch

General
1

Issue

While saving an H2O model (MOJO) to an S3-compatible object store, the operation fails with the following exception:

org.apache.hadoop.fs.s3a.AWSClientIOException:
getFileStatus on s3a://...
com.amazonaws.SdkClientException:
Unable to execute HTTP request:
Certificate for <10.1.78.16> doesn't match any of the subject alternative names:
[*.xx.go.ug, xx.go.ug]

The H2O Sparkling Water save operation uses Hadoop’s S3AFileSystem to access S3. The S3A client connects to the endpoint configured for S3, but the SSL certificate presented by the server does not match the endpoint hostname (IP address vs. certificate hostname), causing the TLS handshake to fail before the model is written.

Resolution

Configure the S3 endpoint using Hadoop properties via Spark so they are propagated to S3AFileSystem.

If using HTTPS (recommended):

--conf spark.hadoop.fs.s3a.endpoint=<your-minio-hostname>
--conf spark.hadoop.fs.s3a.path.style.access=true

Ensure the endpoint uses the hostname covered by the SSL certificate instead of the IP address.

If using HTTP (SSL disabled):

--conf spark.hadoop.fs.s3a.endpoint=<your-minio-hostname>
--conf spark.hadoop.fs.s3a.path.style.access=true
--conf spark.hadoop.fs.s3a.connection.ssl.enabled=false

Note: Verify that fs.s3a.endpoint (or spark.hadoop.fs.s3a.endpoint) is not configured with an IP address when SSL is enabled. The configured endpoint must match the hostname specified in the server’s SSL certificate.