diff --git a/src/main/java/com/gxwebsoft/common/system/controller/AliOssController.java b/src/main/java/com/gxwebsoft/common/system/controller/AliOssController.java
index 5b3e1bc..3611f9e 100644
--- a/src/main/java/com/gxwebsoft/common/system/controller/AliOssController.java
+++ b/src/main/java/com/gxwebsoft/common/system/controller/AliOssController.java
@@ -125,6 +125,9 @@ public class AliOssController extends BaseController {
       // 必须显式指定（MinIO 默认 us-east-1），否则 OSSV4Signer.getRegion() 为 null 触发 NPE。
       minioConfig.setSignatureVersion(SignVersion.V4);
       minioConfig.setExtractSettingFromEndpoint(true);
+      // 关闭 CNAME：默认 true 会让 SDK 把自定义域名当 CNAME，走 bucket.endpoint 虚拟主机风格，
+      // 触发 *.minio-api.websoft.top 证书不匹配。关闭后强制 path-style（endpoint/bucket/key）。
+      minioConfig.setSupportCname(false);
       ossClient = OSSClientBuilder.create()
           .endpoint(endpoint)
           .credentialsProvider(credentialsProvider)
diff --git a/src/main/java/com/gxwebsoft/common/system/service/impl/FileRecordServiceImpl.java b/src/main/java/com/gxwebsoft/common/system/service/impl/FileRecordServiceImpl.java
index 8c915e5..2ed5bfb 100644
--- a/src/main/java/com/gxwebsoft/common/system/service/impl/FileRecordServiceImpl.java
+++ b/src/main/java/com/gxwebsoft/common/system/service/impl/FileRecordServiceImpl.java
@@ -105,6 +105,9 @@ public class FileRecordServiceImpl extends ServiceImpl<FileRecordMapper, FileRec
       // 必须显式指定（MinIO 默认 us-east-1），否则 OSSV4Signer.getRegion() 为 null 触发 NPE。
       minioConfig.setSignatureVersion(SignVersion.V4);
       minioConfig.setExtractSettingFromEndpoint(true);
+      // 关闭 CNAME：默认 true 会让 SDK 把自定义域名当 CNAME，走 bucket.endpoint 虚拟主机风格，
+      // 触发 *.minio-api.websoft.top 证书不匹配。关闭后强制 path-style（endpoint/bucket/key）。
+      minioConfig.setSupportCname(false);
       ossClient = OSSClientBuilder.create()
           .endpoint(endpoint)
           .credentialsProvider(credentialsProvider)