# Allow self-signed certificate TLS-URL in endpointUrl for S3-Backups **URL:** \ **Category:** Percona Operator for MySQL\ **Created:** [May 12, 2021, 5:58am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424 "2021-05-12T05:58:10Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![mygov](https://avatars.discourse-cdn.com/v4/letter/m/8dc957/32.png) [@mygov](https://forums.percona.com/u/mygov)\ **Post date:** [May 12, 2021, 5:58am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/1 "2021-05-12T05:58:10Z")
If I’m using a custom endpointUrl within the Percona XtraDB Cluster Operator for S3-Backups in “PerconaXtraDBClusterBackups” ([Custom Resource options](https://www.percona.com/doc/kubernetes-operator-for-pxc/operator.html#backup-storages-s3-endpointurl)), I receive the following error: 2021-05-12 09:07:10.455 INFO: [SST script] mc: Unable to initialize new alias from the provided credentials. Get “[https://custom-domain.com/probe-bucket-sign-oythtghtc3vy/?location=](https://custom-domain.com/probe-bucket-sign-oythtghtc3vy/?location=)”: x509: certificate signed by unknown authority. How can I accept self signed TLS certificates? We are hosting our own S3 with our own self signed certificate from our own Root-CA. Is there any way to allow “insecure” certificates or add some custom truststore? ---
**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\ **Post date:** [May 12, 2021, 2:40pm UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/2 "2021-05-12T14:40:02Z")
Hello @mygov , thank you for submitting it. Yeah, it is a good one 🙂 To make it work there are two options: 1. add --insecure flag to minio client (mc). Right now it is not possible to pass it through the Operator. I captured it in this improvement ticket in JIRA: [[K8SPXC-752] Allow disabling TLS when taking backups - Percona JIRA](https://jira.percona.com/browse/K8SPXC-752). 2. Copy your CA cert to trust it to .mc/certs/CAs. Also manual step. ---
**Author:** ![rtanner](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@rtanner](https://forums.percona.com/u/rtanner)\ **Post date:** [September 23, 2021, 3:31pm UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/3 "2021-09-23T15:31:43Z")
@Sergey_Pronin - I am now having the same issue as the OP. Can you elaborate on how you add the above two manual changes? Which running container can I make the changes to? Thanks ---
**Author:** ![frank2b](https://avatars.discourse-cdn.com/v4/letter/f/c0e974/32.png) [@frank2b](https://forums.percona.com/u/frank2b)\ **Post date:** [October 30, 2021, 3:50pm UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/4 "2021-10-30T15:50:50Z")
@Sergey_Pronin You mentioned to add the CA cert to .minio/certs/CAs. But the config written by run\_backup.sh creates it dynamically in /tmp. So no way to add it there, unfortunately. To add --insecure the script has to be changed, too. ---
**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\ **Post date:** [November 1, 2021, 8:09am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/5 "2021-11-01T08:09:53Z")
Ah, good catch. Yeah, probably we need to wait for insecure flag then. It is going to be shipped in 1.11.0 somewhere in Q1 (we are shipping 1.10 release in Q4, but this feature is not there). ---
**Author:** ![rtanner](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@rtanner](https://forums.percona.com/u/rtanner)\ **Post date:** [November 1, 2021, 12:26pm UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/6 "2021-11-01T12:26:48Z")
@Sergey_Pronin I ended up creating a new image and imported the self signed cert into it. Not a huge effort, but still a pain. While I appreciate the idea of an insecure flag, will you also provide a way to import certs as well? ---
**Author:** ![wenjian](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@wenjian](https://forums.percona.com/u/wenjian)\ **Post date:** [November 18, 2021, 6:14am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/7 "2021-11-18T06:14:44Z")
any workaround for percona backup mongodb in operator? same issue when use self-signed TLS of S3 storage server. ---
**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\ **Post date:** [November 18, 2021, 7:17am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/8 "2021-11-18T07:17:10Z")
@wenjian in MongoDB we use PBM, which does not support this yet - it is either http or https with valid certificate. We have this feature in our roadmap: [[PBM-680] Skip TLS verification for object storage - Percona JIRA](https://jira.percona.com/browse/PBM-680) Once PBM has this, it will be quite easy to add it into the Operator. ---
**Author:** ![azam](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@azam](https://forums.percona.com/u/azam)\ **Post date:** [April 15, 2022, 10:38am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/9 "2022-04-15T10:38:16Z")
@Sergey_Pronin Any idea when we can expect PBM-680 to be completed and version 1.12 of the operator to be delivered? We are eagerly waiting on this so that we can use our on-premises S3 storage for MongoDB backups (using HTTPS). ---
**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\ **Post date:** [April 15, 2022, 1:52pm UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/10 "2022-04-15T13:52:51Z")
@azam corresponding functionality was already merged into main branch of the operator: [[K8SPSMDB-473] Allow to skip TLS verification for backup storage - Percona JIRA](https://jira.percona.com/browse/K8SPSMDB-473) 1.12 should come out this month. ---
**Author:** ![azam](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@azam](https://forums.percona.com/u/azam)\ **Post date:** [May 5, 2022, 11:13am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/11 "2022-05-05T11:13:27Z")
@Sergey_Pronin Thanks for your reply, I see that PBM 1.7 (including the implementation of PBM-680) was indeed released last month 🙂 Any update on the expected release of v1.12 of the operator? ---
**Author:** ![Slava\_Sarzhan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/slava_sarzhan/32/3196_2.png) [@Slava\_Sarzhan](https://forums.percona.com/u/Slava_Sarzhan)\ **Post date:** [May 5, 2022, 11:26am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/12 "2022-05-05T11:26:05Z")
@azam If we are talking about PSMDB operator release 🙂. We will have it today. ---
**Author:** ![azam](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@azam](https://forums.percona.com/u/azam)\ **Post date:** [May 5, 2022, 11:28am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/13 "2022-05-05T11:28:21Z")
That’s the one indeed, thanks for the prompt reply! 😃 ---
**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\ **Post date:** [May 9, 2022, 9:14am UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/14 "2022-05-09T09:14:57Z")
@azam not sure if you saw - it is out: [Percona Operator for MongoDB 1.12.0 Released](https://forums.percona.com/t/percona-operator-for-mongodb-1-12-0-released/15581) Would appreciate your feedback. ---
**Author:** ![azam](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@azam](https://forums.percona.com/u/azam)\ **Post date:** [May 9, 2022, 1:49pm UTC](https://forums.percona.com/t/allow-self-signed-certificate-tls-url-in-endpointurl-for-s3-backups/10424/15 "2022-05-09T13:49:37Z")
Yes I saw it indeed, thanks for the heads-up 🙂