Certificate download timeout - Amazon SageMaker AI
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Certificate download timeout

When deploying a SageMaker AI endpoint, the creation process fails due to the inability to download the certificate authority (CA) certificate in a VPC environment. For detailed configuration steps, refer to the Admin guide.

Error message:

The following error appears in the SageMaker AI endpoint CloudWatch logs: 

Error downloading CA certificate: Connect timeout on endpoint URL: "https://****.s3.<REGION>.amazonaws.com/****/***.pem"

Root cause:

  • This issue occurs when the inference operator cannot access the self-signed certificate in Amazon S3 within your VPC

  • Proper configuration of the Amazon S3 VPC endpoint is essential for certificate access

Resolution:

  1. If you don't have an Amazon S3 VPC endpoint:

    • Create an Amazon S3 VPC endpoint following the configuration in section 5.3 of the Admin guide.

  2. If you already have an Amazon S3 VPC endpoint:

    • Ensure that the subnet route table is configured to point to the VPC endpoint (if using gateway endpoint) or that private DNS is enabled for interface endpoint.

    • Amazon S3 VPC endpoint should be similar to the configuration mentioned in section 5.3 Endpoint creation step