```
您可以使用已簽署 URL，而不是使用已簽署 Cookie。如需詳細資訊，請參閱[使用 PHP 建立 URL 簽章](CreateURL_PHP.md)。
# 用於 Base64 編碼和加密的 Linux 命令和 OpenSSL
您可以使用以下 Linux 命令列命令和 OpenSSL 來雜湊和簽署政策聲明、base64 編碼簽章，並將 URL 查詢字串參數中無效的字元替換為有效的字元。
如需 OpenSSL 的詳細資訊，請前往 [https://www.openssl.org](https://www.openssl.org)。
SHA-1 （預設）：
```
cat policy | tr -d "\n" | tr -d " \t\n\r" | openssl sha1 -sign private_key.pem | openssl base64 -A | tr -- '+=/' '-_~'
```
SHA-256：
```
cat policy | tr -d "\n" | tr -d " \t\n\r" | openssl sha256 -sign private_key.pem | openssl base64 -A | tr -- '+=/' '-_~'
```
在上述命令中：
+ `cat` 會讀取 `policy` 檔案。
+ `tr -d "\n" | tr -d " \t\n\r"` 會移除 `cat` 所新增的空格和新行字元。
+ OpenSSL 會使用 SHA-1 （或 SHA-256) 雜湊檔案，並使用私有金鑰檔案 簽署該檔案`private_key.pem`。私有金鑰簽章可以是 RSA 2048 或 ECDSA 256。如果您使用 SHA-256，請在已簽章的 URL 中包含`Hash-Algorithm=SHA256`查詢參數，或在已簽章的 `CloudFront-Hash-Algorithm=SHA256` Cookie 中包含 Cookie。
+ 使用 OpenSSL base64 來將經過雜湊演算和簽署的政策陳述式編碼。
+ `tr` 以有效字元取代 URL 查詢字串參數中無效的字元。
如需示範建立簽章的更多程式碼範例，請參閱 [為已簽署 URL 建立簽章的程式碼範例](PrivateCFSignatureCodeAndExamples.md)。
# 為已簽署 URL 建立簽章的程式碼範例
本節包含可下載的應用程式範例，示範如何為已簽章的 URL 建立簽章。範例可在 Perl、PHP、C\$1 和 Java 中找到。您可以使用任何範例來建立簽章的 URL。Perl 指令碼在 Linux 和 macOS 平台上執行。PHP 範例可以在任何執行 PHP 的伺服器上執行。C\$1 範例使用 .NET 架構。
本節中的範例使用 SHA-1 來雜湊和簽署政策陳述式。您也可以使用 SHA-256。若要使用 SHA-256，請在簽署函數中更新雜湊演算法 （例如，在 OpenSSL 呼叫`sha256`中`sha1`將 取代為 ，或在語言的密碼編譯程式庫中使用同等的 SHA-256 常數）。當您使用 SHA-256 時，請在簽章的 URL 中包含`Hash-Algorithm=SHA256`查詢參數。
如需 JavaScript (Node.js) 中的範例程式碼，請參閱 AWS 開發人員部落格上的在 [Node.js 中建立 Amazon CloudFront 簽章 URLs](https://aws.amazon.com/blogs/developer/creating-amazon-cloudfront-signed-urls-in-node-js/)。
例如 Python 中的程式碼，請參閱《*適用於 Python (Boto3) 的AWS SDK API 參考》*中的[為 Amazon CloudFront 產生簽署的 URL](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudfront.html#examples)，以及 Boto3 GitHub 儲存庫中的[此範例程式碼](https://github.com/boto/boto3/blob/develop/boto3/examples/cloudfront.rst)。
**Topics**
+ [使用 Perl 建立 URL 簽章](CreateURLPerl.md)
+ [使用 PHP 建立 URL 簽章](CreateURL_PHP.md)
+ [使用 C\$1 和 .NET 架構建立 URL 簽章](CreateSignatureInCSharp.md)
+ [使用 Java 建立 URL 簽章](CFPrivateDistJavaDevelopment.md)
# 使用 Perl 建立 URL 簽章
本節包含適用於 Linux/Mac 平台的 Perl 指令碼，可用來建立私有內容的簽章。若要建立簽章，請使用命令列參數指定 CloudFront URL、簽署者的私有金鑰路徑、金鑰 ID 和 URL 的過期日期，來執行指令碼。此工具也可以解碼簽章的 URL。
**備註**
建立 URL 簽章只是私有內容提供服務的程序的一部分，以使用簽章 URL。如需端對端程序的詳細資訊，請參閱 [使用已簽署 URL](private-content-signed-urls.md)。
在簽署命令中，請注意 `sha1`可以在 `openssl dgst` 呼叫`sha256`中取代為 。
**Topics**
+ [用於建立已簽署 URL 的 Perl 指令碼來源](#CreateURLPerlScriptSource)
## 用於建立已簽署 URL 的 Perl 指令碼來源
以下 Perl 原始程式碼可用來建立適用於 CloudFront 簽章的 URL。程式碼中的註解包含有關命令列參數和工具功能的詳細資訊。
```
#!/usr/bin/perl -w
# Copyright 2008 Amazon Technologies, Inc. Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License. You may obtain a copy of the License at:
#
# https://aws.amazon.com/apache2.0
#
# This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License.
=head1 cfsign.pl
cfsign.pl - A tool to generate and verify Amazon CloudFront signed URLs
=head1 SYNOPSIS
This script uses an existing RSA key pair to sign and verify Amazon CloudFront signed URLs
View the script source for details as to which CPAN packages are required beforehand.
For help, try:
cfsign.pl --help
URL signing examples:
cfsign.pl --action encode --url https://images.my-website.com/gallery1.zip --policy sample_policy.json --private-key privkey.pem --key-pair-id mykey
cfsign.pl --action encode --url https://images.my-website.com/gallery1.zip --expires 1257439868 --private-key privkey.pem --key-pair-id mykey
URL decode example:
cfsign.pl --action decode --url "http//mydist.cloudfront.net/?Signature=AGO-PgxkYo99MkJFHvjfGXjG1QDEXeaDb4Qtzmy85wqyJjK7eKojQWa4BCRcow__&Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cDovLypicmFkbS5qcGciLCJDb25kaXRpb24iOnsiSXBBZGRyZXNzIjp7IkFXUzpTb3VyY2VJcCI6IjEwLjUyLjE3LjkvMCJ9LCJEYXRlR3JlYXRlclRoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTI1MjUyMDgzMH19fV19Cg__&Key-Pair-Id=mykey"
To generate an RSA key pair, you can use openssl and the following commands:
# Generate a 2048 bit key pair
openssl genrsa -out private-key.pem 2048
openssl rsa -in private-key.pem -pubout -out public-key.pem
=head1 OPTIONS
=over 8
=item B<--help>
Print a help message and exits.
=item B<--action> [action]
The action to execute. action can be one of:
encode - Generate a signed URL (using a canned policy or a user policy)
decode - Decode a signed URL
=item B<--url>
The URL to en/decode
=item B<--stream>
The stream to en/decode
=item B<--private-key>
The path to your private key.
=item B<--key-pair-id>
The key pair identifier.
=item B<--policy>
The CloudFront policy document.
=item B<--expires>
The Unix epoch time when the URL is to expire. If both this option and
the --policy option are specified, --policy will be used. Otherwise, this
option alone will use a canned policy.
=back
=cut
use strict;
use warnings;
# you might need to use CPAN to get these modules.
# run perl -MCPAN -e "install " to get them.
# The openssl command line will also need to be in your $PATH.
use File::Temp qw/tempfile/;
use File::Slurp;
use Getopt::Long;
use IPC::Open2;
use MIME::Base64 qw(encode_base64 decode_base64);
use Pod::Usage;
use URI;
my $CANNED_POLICY
= '{"Statement":[{"Resource":"","Condition":{"DateLessThan":{"AWS:EpochTime":}}}]}';
my $POLICY_PARAM = "Policy";
my $EXPIRES_PARAM = "Expires";
my $SIGNATURE_PARAM = "Signature";
my $KEY_PAIR_ID_PARAM = "Key-Pair-Id";
my $verbose = 0;
my $policy_filename = "";
my $expires_epoch = 0;
my $action = "";
my $help = 0;
my $key_pair_id = "";
my $url = "";
my $stream = "";
my $private_key_filename = "";
my $result = GetOptions("action=s" => \$action,
"policy=s" => \$policy_filename,
"expires=i" => \$expires_epoch,
"private-key=s" => \$private_key_filename,
"key-pair-id=s" => \$key_pair_id,
"verbose" => \$verbose,
"help" => \$help,
"url=s" => \$url,
"stream=s" => \$stream,
);
if ($help or !$result) {
pod2usage(1);
exit;
}
if ($url eq "" and $stream eq "") {
print STDERR "Must include a stream or a URL to encode or decode with the --stream or --url option\n";
exit;
}
if ($url ne "" and $stream ne "") {
print STDERR "Only one of --url and --stream may be specified\n";
exit;
}
if ($url ne "" and !is_url_valid($url)) {
exit;
}
if ($stream ne "") {
exit unless is_stream_valid($stream);
# The signing mechanism is identical, so from here on just pretend we're
# dealing with a URL
$url = $stream;
}
if ($action eq "encode") {
# The encode action will generate a private content URL given a base URL,
# a policy file (or an expires timestamp) and a key pair id parameter
my $private_key;
my $public_key;
my $public_key_file;
my $policy;
if ($policy_filename eq "") {
if ($expires_epoch == 0) {
print STDERR "Must include policy filename with --policy argument or an expires" .
"time using --expires\n";
}
$policy = $CANNED_POLICY;
$policy =~ s//$expires_epoch/g;
$policy =~ s//$url/g;
} else {
if (! -e $policy_filename) {
print STDERR "Policy file $policy_filename does not exist\n";
exit;
}
$expires_epoch = 0; # ignore if set
$policy = read_file($policy_filename);
}
if ($private_key_filename eq "") {
print STDERR "You must specific the path to your private key file with --private-key\n";
exit;
}
if (! -e $private_key_filename) {
print STDERR "Private key file $private_key_filename does not exist\n";
exit;
}
if ($key_pair_id eq "") {
print STDERR "You must specify a key pair id with --key-pair-id\n";
exit;
}
my $encoded_policy = url_safe_base64_encode($policy);
my $signature = rsa_sha1_sign($policy, $private_key_filename);
my $encoded_signature = url_safe_base64_encode($signature);
my $generated_url = create_url($url, $encoded_policy, $encoded_signature, $key_pair_id, $expires_epoch);
if ($stream ne "") {
print "Encoded stream (for use within a swf):\n" . $generated_url . "\n";
print "Encoded and escaped stream (for use on a webpage):\n" . escape_url_for_webpage($generated_url) . "\n";
} else {
print "Encoded URL:\n" . $generated_url . "\n";
}
} elsif ($action eq "decode") {
my $decoded = decode_url($url);
if (!$decoded) {
print STDERR "Improperly formed URL\n";
exit;
}
print_decoded_url($decoded);
} else {
# No action specified, print help. But only if this is run as a program (caller will be empty)
pod2usage(1) unless caller();
}
# Decode a private content URL into its component parts
sub decode_url {
my $url = shift;
if ($url =~ /(.*)\?(.*)/) {
my $base_url = $1;
my $params = $2;
my @unparsed_params = split(/&/, $params);
my %params = ();
foreach my $param (@unparsed_params) {
my ($key, $val) = split(/=/, $param);
$params{$key} = $val;
}
my $encoded_signature = "";
if (exists $params{$SIGNATURE_PARAM}) {
$encoded_signature = $params{"Signature"};
} else {
print STDERR "Missing Signature URL parameter\n";
return 0;
}
my $encoded_policy = "";
if (exists $params{$POLICY_PARAM}) {
$encoded_policy = $params{$POLICY_PARAM};
} else {
if (!exists $params{$EXPIRES_PARAM}) {
print STDERR "Either the Policy or Expires URL parameter needs to be specified\n";
return 0;
}
my $expires = $params{$EXPIRES_PARAM};
my $policy = $CANNED_POLICY;
$policy =~ s//$expires/g;
my $url_without_cf_params = $url;
$url_without_cf_params =~ s/$SIGNATURE_PARAM=[^&]*&?//g;
$url_without_cf_params =~ s/$POLICY_PARAM=[^&]*&?//g;
$url_without_cf_params =~ s/$EXPIRES_PARAM=[^&]*&?//g;
$url_without_cf_params =~ s/$KEY_PAIR_ID_PARAM=[^&]*&?//g;
if ($url_without_cf_params =~ /(.*)\?$/) {
$url_without_cf_params = $1;
}
$policy =~ s//$url_without_cf_params/g;
$encoded_policy = url_safe_base64_encode($policy);
}
my $key = "";
if (exists $params{$KEY_PAIR_ID_PARAM}) {
$key = $params{$KEY_PAIR_ID_PARAM};
} else {
print STDERR "Missing $KEY_PAIR_ID_PARAM parameter\n";
return 0;
}
my $policy = url_safe_base64_decode($encoded_policy);
my %ret = ();
$ret{"base_url"} = $base_url;
$ret{"policy"} = $policy;
$ret{"key"} = $key;
return \%ret;
} else {
return 0;
}
}
# Print a decoded URL out
sub print_decoded_url {
my $decoded = shift;
print "Base URL: \n" . $decoded->{"base_url"} . "\n";
print "Policy: \n" . $decoded->{"policy"} . "\n";
print "Key: \n" . $decoded->{"key"} . "\n";
}
# Encode a string with base 64 encoding and replace some invalid URL characters
sub url_safe_base64_encode {
my ($value) = @_;
my $result = encode_base64($value);
$result =~ tr|+=/|-_~|;
return $result;
}
# Decode a string with base 64 encoding. URL-decode the string first
# followed by reversing any special character ("+=/") translation.
sub url_safe_base64_decode {
my ($value) = @_;
$value =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
$value =~ tr|-_~|+=/|;
my $result = decode_base64($value);
return $result;
}
# Create a private content URL
sub create_url {
my ($path, $policy, $signature, $key_pair_id, $expires) = @_;
my $result;
my $separator = $path =~ /\?/ ? '&' : '?';
if ($expires) {
$result = "$path$separator$EXPIRES_PARAM=$expires&$SIGNATURE_PARAM=$signature&$KEY_PAIR_ID_PARAM=$key_pair_id";
} else {
$result = "$path$separator$POLICY_PARAM=$policy&$SIGNATURE_PARAM=$signature&$KEY_PAIR_ID_PARAM=$key_pair_id";
}
$result =~ s/\n//g;
return $result;
}
# Sign a document with given private key file.
# The first argument is the document to sign
# The second argument is the name of the private key file
sub rsa_sha1_sign {
my ($to_sign, $pvkFile) = @_;
print "openssl sha1 -sign $pvkFile $to_sign\n";
return write_to_program($pvkFile, $to_sign);
}
# Helper function to write data to a program
sub write_to_program {
my ($keyfile, $data) = @_;
unlink "temp_policy.dat" if (-e "temp_policy.dat");
unlink "temp_sign.dat" if (-e "temp_sign.dat");
write_file("temp_policy.dat", $data);
system("openssl dgst -sha1 -sign \"$keyfile\" -out temp_sign.dat temp_policy.dat");
my $output = read_file("temp_sign.dat");
return $output;
}
# Read a file into a string and return the string
sub read_file {
my ($file) = @_;
open(INFILE, "<$file") or die("Failed to open $file: $!");
my $str = join('', );
close INFILE;
return $str;
}
sub is_url_valid {
my ($url) = @_;
# HTTP distributions start with http[s]:// and are the correct thing to sign
if ($url =~ /^https?:\/\//) {
return 1;
} else {
print STDERR "CloudFront requires absolute URLs for HTTP distributions\n";
return 0;
}
}
sub is_stream_valid {
my ($stream) = @_;
if ($stream =~ /^rtmp:\/\// or $stream =~ /^\/?cfx\/st/) {
print STDERR "Streaming distributions require that only the stream name is signed.\n";
print STDERR "The stream name is everything after, but not including, cfx/st/\n";
return 0;
} else {
return 1;
}
}
# flash requires that the query parameters in the stream name are url
# encoded when passed in through javascript, etc. This sub handles the minimal
# required url encoding.
sub escape_url_for_webpage {
my ($url) = @_;
$url =~ s/\?/%3F/g;
$url =~ s/=/%3D/g;
$url =~ s/&/%26/g;
return $url;
}
1;
```
# 使用 PHP 建立 URL 簽章
任何執行 PHP 的 Web 伺服器都可以使用 PHP 範例程式碼為私有 CloudFront 分佈建立政策聲明和簽章。該完整範例以已簽署 URL 連結建立一個正常運作網頁，該連結使用 CloudFront 串流播放視訊串流。您可以從 [demo-php.zip](samples/demo-php.zip) 檔案下載完整範例。
**備註**
建立 URL 簽章只是私有內容提供服務的程序的一部分，以使用簽章 URL。如需有關整個程序的詳細資訊，請參閱 [使用已簽署 URL](private-content-signed-urls.md)。
您還可以使用 適用於 PHP 的 AWS SDK中的 `UrlSigner` 類別建立簽章的 URL。如需詳細資訊，請參閱 *適用於 PHP 的 AWS SDK API 參考*中的 [Class UrlSigner](https://docs.aws.amazon.com/aws-sdk-php/v3/api/class-Aws.CloudFront.UrlSigner.html)。
在`openssl_sign`呼叫中，請注意`OPENSSL_ALGO_SHA256`，做為第四個引數傳遞 會切換到 SHA-256。([使用 PHP 建立已簽署 Cookie](signed-cookies-PHP.md)如需完整範例，另請參閱 。)
**Topics**
+ [建立 RSA SHA-1 簽章](#sample-rsa-sign)
+ [建立標準政策](#sample-canned-policy)
+ [建立自訂政策](#sample-custom-policy)
+ [完整程式碼範例](#full-example)
下列各節將程式碼範例細分為個別部分。您可以在下面找到 [完整程式碼範例](#full-example)。
## 建立 RSA SHA-1 簽章
此程式碼會執行下列操作：
+ `rsa_sha1_sign` 函數會雜湊並簽署政策陳述式。所需的引數為政策陳述式，以及與您分佈之信任金鑰群組中公有金鑰對應的私有金鑰。
+ 接著，該 `url_safe_base64_encode` 函數會建立已簽章的 URL 安全版本。
```
function rsa_sha1_sign($policy, $private_key_filename) {
$signature = "";
// load the private key
$fp = fopen($private_key_filename, "r");
$priv_key = fread($fp, 8192);
fclose($fp);
$pkeyid = openssl_get_privatekey($priv_key);
// compute signature
openssl_sign($policy, $signature, $pkeyid);
// free the key from memory
openssl_free_key($pkeyid);
return $signature;
}
function url_safe_base64_encode($value) {
$encoded = base64_encode($value);
// replace unsafe characters +, = and / with
// the safe characters -, _ and ~
return str_replace(
array('+', '=', '/'),
array('-', '_', '~'),
$encoded);
}
```
下列程式碼片段使用 `get_canned_policy_stream_name()` 和 `get_custom_policy_stream_name()` 函數來建立標準和自訂政策。CloudFront 使用政策來建立串流影片的 URL，包括指定過期時間。
然後，您可以使用標準政策或自訂政策來決定如何管理對內容的存取。如需選擇哪個項目的詳細資訊，請參閱 [決定對已簽署 URL 使用標準或自訂政策](private-content-signed-urls.md#private-content-choosing-canned-custom-policy) 一節。
## 建立標準政策
下列範例程式碼會建構簽章的*標準*政策陳述式。
**注意**
`$expires` 變數是日期/時間戳記，必須整數，而不是字串。
```
function get_canned_policy_stream_name($video_path, $private_key_filename, $key_pair_id, $expires) {
// this policy is well known by CloudFront, but you still need to sign it, since it contains your parameters
$canned_policy = '{"Statement":[{"Resource":"' . $video_path . '","Condition":{"DateLessThan":{"AWS:EpochTime":'. $expires . '}}}]}';
// the policy contains characters that cannot be part of a URL, so we base64 encode it
$encoded_policy = url_safe_base64_encode($canned_policy);
// sign the original policy, not the encoded version
$signature = rsa_sha1_sign($canned_policy, $private_key_filename);
// make the signature safe to be included in a URL
$encoded_signature = url_safe_base64_encode($signature);
// combine the above into a stream name
$stream_name = create_stream_name($video_path, null, $encoded_signature, $key_pair_id, $expires);
// URL-encode the query string characters
return $stream_name;
}
```
如需有關標準政策的詳細資訊，請參閱 [使用標準政策建立已簽署 URL](private-content-creating-signed-url-canned-policy.md)。
## 建立自訂政策
下列範例程式碼會建構簽章的*自訂*政策陳述式。
```
function get_custom_policy_stream_name($video_path, $private_key_filename, $key_pair_id, $policy) {
// the policy contains characters that cannot be part of a URL, so we base64 encode it
$encoded_policy = url_safe_base64_encode($policy);
// sign the original policy, not the encoded version
$signature = rsa_sha1_sign($policy, $private_key_filename);
// make the signature safe to be included in a URL
$encoded_signature = url_safe_base64_encode($signature);
// combine the above into a stream name
$stream_name = create_stream_name($video_path, $encoded_policy, $encoded_signature, $key_pair_id, null);
// URL-encode the query string characters
return $stream_name;
}
```
如需有關自訂政策的詳細資訊，請參閱 [使用自訂政策建立已簽署 URL](private-content-creating-signed-url-custom-policy.md)。
## 完整程式碼範例
下面的範例程式碼提供了使用 PHP 建立 CloudFront 簽章 URL 的完整示範。您可以從 [demo-php.zip](samples/demo-php.zip) 檔案下載完整範例。
您可以在下列範例中修改 `$policy` `Condition` 元素，以允許 IPv4 與 IPv6 位址範圍。如需範例，請參閱《*Amazon Simple Storage Service 使用者指南*》中的[在 IAM 政策中使用 IPv6 位址](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ipv6-access.html#ipv6-access-iam)。
```
CloudFront