title: AWS cannot signed CloudFront urls
body: <p><strong>Excepted</strong>: I want to get signed urls with my AWS CloudFront url.</p>
  
  <p><strong>What I have done</strong>: I have created a AWS CloudFront instence and enabled <em>Restrict Viewer Access</em> function, <em>Trusted Signers</em> is <em>Self</em>.</p>
  
  <p>Below is the php code I want to sign the url</p>
  
  <pre><code>function getSignedURL()
  {
      $resource = 'http://d2qui8qg6d31zk.cloudfront.net/richardcuicks3sample/140-140.bmp'; 
      $timeout = 300;       
  
      //This comes from key pair you generated for cloudfront
      $keyPairId = "YOUR_CLOUDFRONT_KEY_PAIR_ID";
  
      $expires = time() + $timeout; //Time out in seconds
      $json = '{"Statement":[{"Resource":"'.$resource.'","Condition":{"DateLessThan":{"AWS:EpochTime":'.$expires.'}}}]}';             
  
      //Read Cloudfront Private Key Pair
      $fp=fopen("private_key.pem","r"); 
      $priv_key=fread($fp,8192); 
      fclose($fp); 
  
      //Create the private key
      $key = openssl_get_privatekey($priv_key);
      if(!$key)
      {
              echo "&lt;p&gt;Failed to load private key!&lt;/p&gt;";
              return;
      }
  
      //Sign the policy with the private key
      if(!openssl_sign($json, $signed_policy, $key, OPENSSL_ALGO_SHA1))
      {
              echo '&lt;p&gt;Failed to sign policy: '.openssl_error_string().'&lt;/p&gt;';
              return;
      }
  
      //Create url safe signed policy
      $base64_signed_policy = base64_encode($signed_policy);
      $signature = str_replace(array('+','=','/'), array('-','_','~'), $base64_signed_policy);
  
      //Construct the URL
      $url = $resource.'?Expires='.$expires.'&amp;Signature='.$signature.'&amp;Key-Pair-Id='.$keyPairId;
  
      return $url;
  }
  </code></pre>
  
  <p>For <code>$keyPairId</code> and <code>private_key.pem</code>, I logged in my root account and generated this two variables in <em>Security Credentials->CloudFront Key Pairs</em> section.</p>
  
  <p>If I access <code>http://d2qui8qg6d31zk.cloudfront.net/richardcuicks3sample/140-140.bmp</code> on browser directly. It will response like</p>
  
  <pre><code>&lt;Error&gt;
    &lt;Code&gt;MissingKey&lt;/Code&gt;
    &lt;Message&gt;
      Missing Key-Pair-Id query parameter or cookie value
    &lt;/Message&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p>After I run the function, I got a long signed url, parse the url on chrome browser, it will response like</p>
  
  <pre><code>&lt;Error&gt;
    &lt;Code&gt;InvalidKey&lt;/Code&gt;
    &lt;Message&gt;Unknown Key&lt;/Message&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p><strong>Question</strong>: I have search AWS document and google much time about this, Could anyone tell me why this happened or if I miss something? Thanks in advance!</p>