How to fix InvalidSignatureException in my Amazon SES SendRawEmail PHP code - php

Question

I read the Amazon SES documentation several times and came up with the below PHP code to send an email via Amazon SES using what they called as HTTPS Query API approach to send emails without using the Amazon AWS SDK for PHP. However I am stuck with InvalidSignatureException and am unable to get past it. It seems like I am making a mistake somewhere probably in (1) creating the request signature or in (2) selecting right data to generate the request signature from. Any help to fix my code is greatly appreciated. My code is available below. It is important that I do this approach without including the Amazon AWS SDK into my PHP code. Thank you.
define("EMAIL_TO", <Amazon SES configured & verified from email id>);
define("EMAIL_FROM", <Amazon SES configured & verified from email id>);
define("SMTP_USERNAME", <AWS ACCESS KEY>);
define("SMTP_PASSWORD", <AWS SECRET ACCESS KEY>);
function amazonsesrawmailcurlpost($strToEmailId, $strEmailSubject, $strEmailBody)
{
$strDateRFC2822 = date("r", time());
$strRawEmailData = "From: ".EMAIL_FROM."\n";
$strRawEmailData.= "Subject: $strEmailSubject\n";
$strRawEmailData.= "\n";
$strRawEmailData.= $strEmailBody;
$strRequestContentPart = "Action=SendRawEmail";
$strRequestContentPart.= "&Destinations.member.1=$strToEmailId";
$strRequestContentPart.= "&RawMessage.Data=".base64_encode($strRawEmailData);
$strRequestContentPart = urlencode($strRequestContentPart);
$nRequestContentPartLength = strlen($strRequestContentPart);
$strSignature = base64_encode(hash_hmac(
"sha256",
$strDateRFC2822,
SMTP_PASSWORD,
TRUE
));
$rCurlToMailer = curl_init();
curl_setopt($rCurlToMailer, CURLOPT_URL, "https://email.us-west-2.amazonaws.com/");
curl_setopt($rCurlToMailer, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($rCurlToMailer,
CURLOPT_HTTPHEADER,
array(
"POST / HTTP/1.1",
"Host: email.us-west-2.amazonaws.com",
"Date: $strDateRFC2822",
"Content-Type: application/x-www-form-urlencoded",
"Content-Length: $nRequestContentPartLength",
"X-Amzn-Authorization: AWS3-HTTPS AWSAccessKeyId=".SMTP_USERNAME.", Algorithm=HmacSHA256, Signature=$strSignature"
)
);
curl_setopt($rCurlToMailer, CURLOPT_POST, TRUE);
curl_setopt($rCurlToMailer, CURLOPT_POSTFIELDS, $strRequestContentPart);
$strMailerResponse = curl_exec($rCurlToMailer);
echo $strMailerResponse;
curl_close($rCurlToMailer);
}
amazonsesrawmailcurlpost(EMAIL_TO, "amazonses test mail", date("Y-m-d H:i:s"));

Answer 1

Signature Version 3 with HTTPS, used by SES, is starkly different than V2 or V4 commonly seen with other AWS services, in that the only thing you sign is the date value.
To create the string to sign, calculate an RFC 2104-compliant HMAC hash with the Date header value, your secret access key as the key, and SHA256 or SHA1 as the hash algorithm.
— http://docs.aws.amazon.com/ses/latest/DeveloperGuide/query-interface-authentication.html
Note also that all the keys and values in a POST with Content-Type: application/x-www-form-urlencoded need to actually be... urlencoded. I don't see this in your code. It isn't going to be related to the error but may cause additional issues later.