virtual-host addressing style not working with custom tls verification

[MartinNowak]

Describe the bug

client = boto3.client('s3', verify=False, config=Config(s3=dict(addressing_style='virtual')))
client.list_objects_v2(Bucket='example.com', MaxKeys=1) # Endpoint provider result: https://s3.eu-central-1.amazonaws.com/example.com (path-style)

Subdomains are only allowed to use virtual-host addressing with http endpoints.

https://github.com/boto/botocore/blob/2091c2629f320c2dd16c9e29a0690d493375c8a7/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json#L5314-L5337

https://github.com/boto/botocore/blob/2091c2629f320c2dd16c9e29a0690d493375c8a7/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json#L2325-L2335

Expected Behavior

Should allow addressing subdomain buckets via virtual-host addressing style so one can properly filter egress.

Current Behavior

HTTPS endpoints are forced to use path-style addressing with subdomain buckets.

Reproduction Steps

See above.

Possible Solution

Allow virtual-host style addressing with disabled/manual TLS verification.
Possibly via an additional parameter.
Our workaround sets urllib3's assert_hostname to s3.amazonaws.com to still perform TLS verification. So maybe that would be a clearer parameter.
Could possibly be internalised to botocore as a boolean option even.

Additional Information/Context

Important
When you're using virtual-hosted–style buckets with SSL, the SSL wildcard certificate matches only buckets that do not contain dots (.). To work around this limitation, use HTTP or write your own certificate-verification logic. For more information, see Amazon S3 Path Deprecation Plan on the AWS News Blog.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html

SDK version used

botocore==1.29.105

Environment details (OS name and version, etc.)

na

[tim-finnigan]

Thanks for reaching out - as mentioned in the other issue you recently opened, there are still some outstanding questions on the intended functionality here. I will mark this issue for further review by the team.