TL;DR: When hosting a static site on Linode Object Storage, your bucket name must exactly match the fully-qualified domain name you intend to serve (e.g., www.example.com). Using any other name causes Let’s Encrypt’s certbot to fail with a SAN/CN mismatch error because Linode issues its own certificate for the default *.website-*.linodeobjects.com endpoint.

Why bucket naming matters for SSL on Linode Object Storage

I learned this the hard way while moving my personal site to Linode Object Storage. The site rendered fine over HTTP, but every attempt to attach a custom SSL certificate via certbot produced the same cryptic error:

Certificate is not valid for the bucket name. Verify the bucket name is covered by the SANs and/or CN.

After nearly six hours across four days of head-scratching, the Linode documentation on custom domains finally clarified the requirement: the bucket must be named after the exact domain you plan to serve.

How to name your bucket correctly

  1. Decide on your canonical domain first (recommended: www.yourdomain.com).
  2. Create the bucket using that exact name — no deviations, no prefixes, no suffixes.
  3. Point your DNS A record (or CNAME alias) at the bucket’s regional endpoint.
  4. Run certbot (or your preferred ACME client) against that domain only.

Any other naming strategy will cause the certificate validation to fail because Linode’s object storage layer terminates TLS with its own wildcard certificate for the linodeobjects.com domain.

Why you cannot use certbot against the default endpoint

Linode maintains its own TLS certificate for the core object-storage URL pattern:

[bucket].website-[cluster].linodeobjects.com

Attempting to validate a certificate against this URL will always fail the domain-control checks. The solution is simple: stick to one domain name — the one you actually own and intend to serve — and name the bucket identically.

Key Takeaways

  • Bucket name = the exact FQDN you want to serve (including www. if that’s your choice).
  • Never target the *.linodeobjects.com URL with certbot.
  • DNS and bucket naming must align before certificate issuance.
  • This pattern applies to any S3-compatible object storage that issues its own regional certificates.