### Server Binaries

filename | sha256 hash
-------- | -----------
[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.5.8/kubernetes-server-linux-amd64.tar.gz) | `7e17b17e967722546541fdaeead4dc40037ddce4107aa2b2a561ea577aa62101`

- `X-Amz-Server-Side-Encryption-Customer-Key`: Base64 encoded new key.
- `X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key`: Base64 encoded current key.

Such a special COPY request is also known as S3 SSE-C key rotation.

### Server-Side Encryption with a KMS

SSE-S3 allows an S3 client to en/decrypt an object at the MinIO server using a KMS. The MinIO
server only assumes that the KMS provides two services:

        // Note: Due to normalization, all multiple backslashes are reduced to single
        // so \\server\share becomes \server\share
        String path = "\\\\server\\share\\folder";
        String normalized = validator.validatePath(path);
        assertEquals("\\server\\share\\folder", normalized);
    }

    @Test
    public void testUncPathNotAllowed() throws Exception {

    HandshakeCertificates serverCertificates = new HandshakeCertificates.Builder()
        .heldCertificate(localhostCertificate)
        .build();
    MockWebServer server = new MockWebServer();
    server.useHttps(serverCertificates.sslSocketFactory(), false);
    server.enqueue(new MockResponse());

    HandshakeCertificates clientCertificates = new HandshakeCertificates.Builder()
        .addTrustedCertificate(localhostCertificate.certificate())

```

### TLS (FTP)

Unlike SFTP server, FTP server is insecure by default. To operate under TLS mode, you need to provide certificates via

```
--ftp="tls-private-key=path/to/private.key" --ftp="tls-public-cert=path/to/public.crt"
```

> NOTE: if MinIO distributed setup is already configured to run under TLS, FTP will automatically use the relevant

  private val nullHostnameVerifier = HostnameVerifier { _: String?, _: SSLSession? -> true }
  private val cookieManager = CookieManager()

  @StartStop
  private val server = MockWebServer()

  @BeforeEach
  fun setUp() {
    platform.assumeNotOpenJSSE()
    server.protocolNegotiationEnabled = false
    val loggingFileSystem = LoggingFilesystem(fileSystem)
    cache = buildCache("/cache/".toPath(), Int.MAX_VALUE.toLong(), loggingFileSystem)

        if (server.signaturesRequired || server.signaturesEnabled && SIGNPREF) {
            flags2 |= SmbConstants.FLAGS2_SECURITY_SIGNATURES;
        } else {
            flags2 &= 0xFFFF ^ SmbConstants.FLAGS2_SECURITY_SIGNATURES;
        }
        maxMpxCount = Math.min(maxMpxCount, server.maxMpxCount);
        if (maxMpxCount < 1) {
            maxMpxCount = 1;
        }
        snd_buf_size = Math.min(snd_buf_size, server.maxBufferSize);

 * <td>
 * This references only a server. The behavior of some methods is different
 * in this context(e.g. you cannot <code>delete</code> a server) however
 * as you might expect the <code>list</code> method will list the available
 * shares on this server.
 * </td>
 * </tr>
 *
 * <tr>
 * <td ><code>smb://angus.foo.net/d/jcifs/pipes.doc</code></td>
 * <td>

    # include /etc/nginx/conf.d/*.conf;

    upstream minio {
        server minio1:9000;
        server minio2:9000;
        server minio3:9000;
        server minio4:9000;
    }

    upstream console {
        ip_hash;
        server minio1:9001;
        server minio2:9001;
        server minio3:9001;
        server minio4:9001;
    }

    server {
        listen       9000;
        listen  [::]:9000;

      .Builder()
      .addPlatformTrustedCertificates()
      .addInsecureHost(server.hostName)
      .build()

  val client =
    OkHttpClient
      .Builder()
      .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager)
      .build()

  fun run() {
    try {
      val request = Request(server.url("/"))

      client.newCall(request).execute().use { response ->