diff --git a/weed/s3api/s3api_object_handlers_put.go b/weed/s3api/s3api_object_handlers_put.go
index d0c228b72..2625df8be 100644
--- a/weed/s3api/s3api_object_handlers_put.go
+++ b/weed/s3api/s3api_object_handlers_put.go
@@ -365,19 +365,15 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 			}
 		}
 
-		// If SSE-S3 was applied by bucket default, prepare metadata (if not already done)
+		// If bucket default encryption was applied, serialize the metadata (SSE-S3 and SSE-KMS are mutually exclusive)
+		var metaErr error
 		if sseS3Key != nil && len(sseS3Metadata) == 0 {
-			var metaErr error
 			sseS3Metadata, metaErr = SerializeSSES3Metadata(sseS3Key)
 			if metaErr != nil {
 				glog.Errorf("Failed to serialize SSE-S3 metadata for bucket default encryption: %v", metaErr)
 				return "", s3err.ErrInternalError, SSEResponseMetadata{}
 			}
-		}
-
-		// If SSE-KMS was applied by bucket default, prepare metadata (if not already done)
-		if sseKMSKey != nil && len(sseKMSMetadata) == 0 {
-			var metaErr error
+		} else if sseKMSKey != nil && len(sseKMSMetadata) == 0 {
 			sseKMSMetadata, metaErr = SerializeSSEKMSMetadata(sseKMSKey)
 			if metaErr != nil {
 				glog.Errorf("Failed to serialize SSE-KMS metadata for bucket default encryption: %v", metaErr)