title: Amazon Cloudfront signed URLs, missing Key-Pair-Id
body: <p>I am not being able to access a video stored in my Amazon s3 bucket through my Cloudfront distribution.</p>
  
  <p>I have set the distribution to require signed URLs or signed cookies(generated by "self" user) and configured everything according to the tutorials on Amazon website (generated the key pair for the "self" user, transformed it to .der format using openssl, etc).</p>
  
  <p>Then I followed the steps in this tutorial: <a href="http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CFPrivateDistJavaDevelopment.html" rel="nofollow noreferrer">http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CFPrivateDistJavaDevelopment.html</a></p>
  
  <p>I was then able to generate a "canned" signed URL to access the content and it worked, I pasted the URL in chrome and it started playing the video.
  Here is the code:</p>
  
  <pre><code>String signedUrlCanned = CloudFrontService.signUrlCanned(
  resourceURL,
  certificateId,
  derPrivateKey,
  ServiceUtils.parseIso8601Date("2018-11-14T22:20:00.000Z")
  );
  </code></pre>
  
  <p>But then I decided to create a custom policy signed URL, following the steps in the tutorial and even using the exact same values for the parameters as I used for the canned URL, and it is not working... Here is the code:</p>
  
  <pre><code>String policy = CloudFrontService.buildPolicyForSignedUrl(
  null,
  ServiceUtils.parseIso8601Date("2018-11-14T22:20:00.000Z"), 
  null, 
  null
  );
  
  String signedUrl = CloudFrontService.signUrl(
  resourceURL, 
  certificateId, 
  derPrivateKey, 
  policy 
  );
  </code></pre>
  
  <p>Keep in mind that "resourceURL", "certificateId" and "derPrivateKey" are the same parameters used for the canned URL, and they worked in that case.
  The parameters remain unchanged the entire time since I checked that at debug time, and the 3 Strings(signedUrlCanned, policy, signedUrl) share the same scope(they are generated consecutively inside the same method) and there is no other code in between that could change the values of the parameters.</p>
  
  <p>Here is the resulting URL for the custom policy signed URL:</p>
  
  <p><a href="http://d1eanqhguto8v8.cloudfront.net/Fox/Dexter.mp4?Policy=eyJTdGF0ZW1lbnQiOiBbeyJSZXNvdXJjZSI6IioiLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE1NDIyMzQwMDB9LCJJcEFkZHJlc3MiOnsiQVdTOlNvdXJjZUlwIjoiMC4wLjAuMC8wIn19fV19&amp;Signature=D9sHG6i9GTZRUGwKZYhmz3xKOQsjEWHJPQTCNywzdX9r~F0yEb58ljBAqRyXbHNgmmGuRppS6s0VkiRcyYi8q~DRDoXLtnp~MBbnnBKbF0Qy3xcx59LF6mXC6lXSou7jqz68y~d0VOoLvnFQl~OR5eSTWRHUO7X42~k3qdIiRH~eqzBwAaV9XnbJcLQ2DEDiW13~sfZJXnRsO6hENSk-aGcWeoF80KoccJ2-nFt0ZpndIFI3V~YXRv~Z3VKKS2ek1MW8SE2xdsOdqXAMkJC2X2maQn~MBzczXBuqEO4qKt42FmZI496TckMWzG-pVs~w-EjIWE2EEOzuXxopav8q~Q__&amp;Key-Pair-Id=APKAIS7ACQJH7KT4YWLQ" rel="nofollow noreferrer">http://d1eanqhguto8v8.cloudfront.net/Fox/Dexter.mp4?Policy=eyJTdGF0ZW1lbnQiOiBbeyJSZXNvdXJjZSI6IioiLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE1NDIyMzQwMDB9LCJJcEFkZHJlc3MiOnsiQVdTOlNvdXJjZUlwIjoiMC4wLjAuMC8wIn19fV19&amp;Signature=D9sHG6i9GTZRUGwKZYhmz3xKOQsjEWHJPQTCNywzdX9r~F0yEb58ljBAqRyXbHNgmmGuRppS6s0VkiRcyYi8q~DRDoXLtnp~MBbnnBKbF0Qy3xcx59LF6mXC6lXSou7jqz68y~d0VOoLvnFQl~OR5eSTWRHUO7X42~k3qdIiRH~eqzBwAaV9XnbJcLQ2DEDiW13~sfZJXnRsO6hENSk-aGcWeoF80KoccJ2-nFt0ZpndIFI3V~YXRv~Z3VKKS2ek1MW8SE2xdsOdqXAMkJC2X2maQn~MBzczXBuqEO4qKt42FmZI496TckMWzG-pVs~w-EjIWE2EEOzuXxopav8q~Q__&amp;Key-Pair-Id=APKAIS7ACQJH7KT4YWLQ</a></p>
  
  <p>You can access it and see the error message, it says that the Key-Pair-Id is missing, which is clearly not true since you can see it's there.</p>
  
  <p>Any suggestions?</p>
  
  <p>Edit: I just noticed that the error actually is a 403 "Access Denied" from Cloudfront. When I open the chrome console, under the Network tab I can see 2 GETs, one for the video that throws the 403 error and the other one tries to get something called "favicon.ico" that i've no idea what could be, and that one throws the "Key-Pair-Id is missing" error. One of my coworkers could access the video and still got the favicon.ico error, so I guess that error doesn't matter since it is not interfering with the video download.</p>