I'm trying to sign a request from apex using RSA-SHA1 algorithm. I'm following the Amazon web service requirements to build the signature as i'm actually generating a cloudfront signed url. The signature generated seems to not match the one expected by AWS.

To build the signature i've used a PKC8 private key format (.pem file). I've stored the pem file in my salesforce org so i can read it from apex as a contentVersion object.

Below is a code snippet of my apex function to build the signature :

    private static String buildSignature(String stringToSign) {

    //Get the private key content

    ContentVersion base64Content = [SELECT Title, VersionData FROM 
    ContentVersion where Title='CDN-PRIVATE-KEY' ORDER BY Title LIMIT 1];
    String keyContents = base64Content.VersionData.tostring();

    keyContents = keyContents.replace('-----BEGIN RSA PRIVATE KEY-----', ''); //remove header
    keyContents = keyContents.replace('-----END RSA PRIVATE KEY-----', ''); //remove footer
    keyContents = keyContents.replace('\n', ''); //remove all carriage return

    Blob privateKey = EncodingUtil.base64Decode(keyContents);

   //Signing string to sign
   Blob mac  = Crypto.Sign('RSA-SHA1',
                           Blob.valueOf(stringToSign), //

   String signature = EncodingUtil.base64Encode(mac);

   return signature;

I'm not able to get my signature validated by cloudFront so i suspect my apex function not to use the right method to build this signature. Do you think i'm using the right approach? How can we change this to build a correct RSA/SHA1 signature?

Thanks a lot for your help!

  • just for reference purposes, you might want to check sfdcfox's answer to Not able to authenticate aws from apex
    – glls
    Aug 11, 2018 at 22:52
  • It's not about authenticating to aws, it's about signing a request to cloudfront which uses a different encryption mecanism from aws signv4.
    – Bryce
    Aug 12, 2018 at 7:59


You must log in to answer this question.

Browse other questions tagged .