Instructions for generating signed URLs are incorrect.

[ferminolr]

Hi
Following the guide of this url:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html
The generated private key did not work for me using
AmazonCloudFrontUrlSigner.GetCannedSignedURL(url, privateKeyReader, keyPair, expiresOn);
throw a exception Invalid Key

The solution is to add the -traditional parameter to the creation, it would look like this:
openssl genrsa -out private_key.pem -traditional 2048
So it works correctly in c#
If you already have the generated private key you can transform it to the correct format using:
openssl rsa -in private_key.pem -out private_key_traditional.pem -traditional
The step of generating the public key has worked correctly for me and the generated urls work correctly.
I use, on ubuntu in wsl
OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

Originally posted by @ferminolr in #3221 (comment)

[dscpinheiro]

What package are you using? As mentioned on the other issue AWSSDK.CloudFront doesn't support OpenSSL3, you need to use the new AWSSDK.Extensions.CloudFront.Signers package instead: https://www.nuget.org/packages/AWSSDK.Extensions.CloudFront.Signers

For example, this works for me:

$ openssl version
OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net8.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="AWSSDK.Extensions.CloudFront.Signers" Version="4.0.0-preview.4" />
  </ItemGroup>
</Project>

using Amazon.CloudFront;

// Key generated using the OpenSSL version above
var privateKeyReader = new StreamReader(@"private_key_openssl3.pem");
var url = AmazonCloudFrontUrlSigner.GetCannedSignedURL(
    "https://example.com/my-content", 
    privateKeyReader, 
    "my-key-id", 
    DateTime.UtcNow.AddHours(1)
);
Console.WriteLine(url);

[ferminolr]

I use
<PackageReference Include="AWSSDK.CloudFront" Version="3.7.403.3" />
But if using -traditional parameter in openssl, it work, because the generate file is compatible with openssl 1.x.x, then works with then api.

[joshbartley]

It would be wonderful if the documentation for this is updated.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html#private-content-reformatting-private-key

Took half a day debugging to land on this github issue that fixed it in 5 minutes.