From b9291e4b5639102accae53a9b7b559a827466373 Mon Sep 17 00:00:00 2001
From: Gatefixer <313497061+lancedb-gatefixer[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 21:33:35 +0000
Subject: [PATCH] fix(python): preserve prefixed TLS option precedence

---
 python/python/lancedb/__init__.py |  8 +++++---
 python/python/tests/test_s3.py    | 10 +++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/python/python/lancedb/__init__.py b/python/python/lancedb/__init__.py
index 35d3661d0..e97df58e3 100644
--- a/python/python/lancedb/__init__.py
+++ b/python/python/lancedb/__init__.py
@@ -82,9 +82,11 @@ def _normalize_s3_storage_options(
 
     normalized = dict(storage_options)
     verify = normalized.pop(verify_key)
-    has_native_option = any(
-        key.casefold() == "allow_invalid_certificates" for key in normalized
-    )
+    native_option_keys = {
+        "allow_invalid_certificates",
+        "aws_allow_invalid_certificates",
+    }
+    has_native_option = any(key.casefold() in native_option_keys for key in normalized)
     if not has_native_option:
         verify_value = verify.casefold()
         if verify_value == "false":
diff --git a/python/python/tests/test_s3.py b/python/python/tests/test_s3.py
index fd9b4e3bd..c13463e9e 100644
--- a/python/python/tests/test_s3.py
+++ b/python/python/tests/test_s3.py
@@ -44,7 +44,11 @@ def test_s3_verify_false_is_normalized(monkeypatch):
 
 
 @pytest.mark.asyncio
-async def test_s3_native_tls_option_takes_precedence(monkeypatch):
+@pytest.mark.parametrize(
+    "native_key",
+    ["allow_invalid_certificates", "aws_allow_invalid_certificates"],
+)
+async def test_s3_native_tls_option_takes_precedence(monkeypatch, native_key):
     captured_options = None
 
     async def capture_connect(*args):
@@ -58,11 +62,11 @@ async def test_s3_native_tls_option_takes_precedence(monkeypatch):
         "s3://bucket/database",
         storage_options={
             "verify": "false",
-            "allow_invalid_certificates": "false",
+            native_key: "false",
         },
     )
 
-    assert captured_options == {"allow_invalid_certificates": "false"}
+    assert captured_options == {native_key: "false"}
 
 
 def get_boto3_client(*args, **kwargs):