@riking All Discourse seems to require is a bucket name, correct? Upload and management can be done on AWS URL’s with their certificates, if HTTPS is even required. So far is there any reason we are talking about security certs?
OP then can separately look at what he needs to do to allow his CDN or caching solution to fetch the images from S3. Secure or not, doesn’t matter unless OP or the CDN have requirements, right? Does Discourse care about his setup between S3 and CDN?
Finally, OP needs to make sure the images are served from the CDN with a valid cert. Does this have anything to do with Discourse other than OP supplying the base URL for the images will ultimately reside? Once his CDN or cache fetches the images from S3, then AWS, buckets, blah blah blah are out of the picture completely.
I get that there are issues about a dot in S3 bucket names if you intend to serve your images from there but the OP does NOT. So it just comes down to OP picking any bucket name that Discourse will accept, as long as it doesn’t interfere with whatever setup he has with CDN.