title: How to get aws sever-side encrypted object
body: <p>I am trying to store object at S3 and retrieve it for that I am doing following </p>
  
  <pre><code>$key = 'myverykey';
  $hash = hash_hmac('sha256',$key,true);
  
  $SSECustomerKey = substr($hash,0,32);
  
   $params = [
          'Bucket' =&gt; 'somebucketname',
          'Key' =&gt; 'abc.png',
          'Body' =&gt; "resource",
          'ACL' =&gt; 'private',
          'SSECustomerAlgorithm' =&gt; 'AES256',
          'SSECustomerKey' =&gt; $SSECustomerKey,
          'SSECustomerKeyMD5' =&gt; md5($SSECustomerKey, true),
      ];
       s3-&gt;putObject($params);
  </code></pre>
  
  <p>And then I am creating signed url like </p>
  
  <pre><code>echo el_s3_getTemporaryLink(id, 'mysecretkey', 'cloudfront-config', 'ab.png');
  
  
  function el_crypto_hmacSHA1($key, $data, $blocksize = 64) {
      if (strlen($key) &gt; $blocksize) $key = pack('H*', sha1($key));
      $key = str_pad($key, $blocksize, chr(0x00));
      $ipad = str_repeat(chr(0x36), $blocksize);
      $opad = str_repeat(chr(0x5c), $blocksize);
      $hmac = pack( 'H*', sha1(
          ($key ^ $opad) . pack( 'H*', sha1(
              ($key ^ $ipad) . $data
          ))
      ));
      return base64_encode($hmac);
  }
  
  
  function el_s3_getTemporaryLink($accessKey, $secretKey, $bucket, $path, $expires = 1) {
      $expires = time() + intval(floatval($expires) * 60);
      $path = str_replace('%2F', '/', rawurlencode($path = ltrim($path, '/')));
      $signpath = '/'. $bucket .'/'. $path;
      $signsz = implode("\n", $pieces = array('GET', null, null, $expires, $signpath));
      $signature = el_crypto_hmacSHA1($secretKey, $signsz);
      $url = sprintf('http://%s.s3.amazonaws.com/%s', $bucket, $path);
      $qs = http_build_query($pieces = array(
          'AWSAccessKeyId' =&gt; $accessKey,
          'Expires' =&gt; $expires,
          'Signature' =&gt; $signature,
      ));
      return $url.'?'.$qs;
  }
  </code></pre>
  
  <p>it works perfectly fine I am getting url like </p>
  
  <blockquote>
    <p><code>http://demobucketname.s3.amazonaws.com/ab.png?AWSAccessKeyId=AKIAJUZQHGRTYNOLEUXQ&amp;Expires=1445855704&amp;Signature=3y6eAq1fe5PVASma5DPFmjV7BB3dY%3D</code></p>
  </blockquote>
  
  <p>I can access private object with that if I don't add </p>
  
  <pre><code>'SSECustomerAlgorithm' =&gt; 'AES256',
  'SSECustomerKey' =&gt; $SSECustomerKey,
  'SSECustomerKeyMD5' =&gt; md5($SSECustomerKey, true),
  </code></pre>
  
  <p>while putting object to bucket and now I am getting following error </p>
  
  <pre><code>&lt;Error&gt;
       &lt;Code&gt;InvalidRequest&lt;/Code&gt;
       &lt;Message&gt;
            The object was stored using a form of Server Side Encryption. The correct parameters must be provided to retrieve the object.
       &lt;/Message&gt;
       &lt;RequestId&gt;E19B53C0EE2A6E7C&lt;/RequestId&gt;
       &lt;HostId&gt;
         WOwzj29NBh49uE5Lmtut96PFY8pf3UD8bBWGLXdAFHryNT94WD7qJbqMbu7fKCfROKEIWKwPPX4=
       &lt;/HostId&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p>now how to create signed url which works in this case too? </p>