It is a bit strange to me this isn't a commonly discussed topic yet but I am working with an AWS S3 storage server trying to implement server-side encryption using the option of a client provided key (SSE-C).

More Information Here: http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html

I have the encryption method working great when attempting to use the AWS Key Management Service (KMS). The issue I personally have is I want to hold the keys, thus leading me to want the SSE-C method.

Documentation for PHP (for whatever reason) is scarce under this subject but I have managed to get it working using the seemingly most recent composer build of version3 for S3.

My connection code and put object to the system is as follows. Files are properly uploaded to the system. Code is as follows:

//connect is successful
$client = Aws\S3\S3Client::factory([
    'version' => "2006-03-01",
    'region' => "us-west-1",
    'credentials' => [
        'key'    => "mykey",
        'secret' => "mysecret"

//upload is successful
$result = $client->putObject([
                'Bucket' => 'mybucketname',
                'Key'    => 'myfilename',
                'Body'   => 'some body of the file',
                'SSECustomerAlgorithm' => 'AES256',               
                'SSECustomerKey'       => $somerandom32bitkey,
                'SSECustomerKeyMD5'    => md5($somerandom32bitkey,true),

My issue arises when attempting to get a pre-signed url. I cannot seem to find any documentation on how to actually do this part which is pretty important. The code is as follows:

    $cmd = $client->getCommand('GetObject', array(
                    'Bucket' => 'mybucketname',
                    'Key'    => 'myfilename',
                    'SSECustomerAlgorithm' => 'AES256',               
                    'SSECustomerKey'       => $somerandom32bitkey,
                    'SSECustomerKeyMD5'    => md5($somerandom32bitkey,true),

    $request = $client->createPresignedRequest($cmd, '+10 minutes');
    $presignedUrl = (string) $request->getUri();

The link generated looks like this:


The result response via AWS is:

Requests specifying Server Side Encryption with Customer provided keys must provide an appropriate secret key.

The interesting part is it is looking for a parameter of: 'ServerSideEncryption' => 'AES256' but this is only a parameter required when using the AWS managed key system (SSE-KMS) http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html

Any ideas here?

1 Answer 1


As per official documentation there is three request header require for SSE with customer provided key:

  1. x-amz-server-side​-encryption​-customer-algorithm : AES256
  2. x-amz-server-side​-encryption​-customer-key : base64(secretkey)
  3. x-amz-server-side​-encryption​-customer-key-MD5 : base64(md5(secret key))

Please update code as per above

  1. 'SSECustomerAlgorithm' => 'AES256',
  2. 'SSECustomerKey' => base64($somerandom32bitkey)
  3. 'SSECustomerKeyMD5 => md5(base64($somerandom32bitkey))

Hope this will help.

  • The important item is that you have to included these headers when you use the Presigned URL. This also means that you have to provide the encryption key to the user / application that will be using the Presigned URL. Commented May 2, 2018 at 19:58
  • samuelabiodun.com/… Commented Sep 18, 2018 at 21:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .