s3_upload_checksum_algorithm
The checksum algorithm used when ClickHouse uploads data toS3. CRC32 and SHA256 are sent as flexible x-amz-checksum-* headers, while MD5 is sent as a Content-MD5 header.
By default the value is empty and ClickHouse lets the AWS SDK compute Content-MD5. In FIPS mode MD5 is unavailable, so the SDK silently omits it and the upload carries no checksum at all: set CRC32 or SHA256 to attach a flexible checksum instead. Where this setting applies, an explicit MD5 is then rejected.
It takes effect when the S3 client is created, so it applies to query-scoped uses such as the s3 table function and BACKUP ... TO S3; a later per-query SET does not reconfigure an already-created long-lived client such as an S3 disk.
S3Express buckets require a flexible checksum and do not accept Content-MD5: an explicit CRC32 or SHA256 is honored, an empty value uses CRC32, and an explicit MD5 is rejected.
GCS endpoints (storage.googleapis.com) ignore this setting entirely and keep the SDK’s Content-MD5 behavior, because GCS rejects SigV4-signed requests carrying the AWS x-amz-checksum-* headers.
Server-side copies ignore this setting.