Signature validation failed on GetObject call?!

Help and Support
1

What is the problem you are having with rclone?

Hello!

I would greatly appreciate any help on my matter.

We have a need to mount an S3 Bucket in AWS on the laptop of colleagues from the support department. I want to make it the easiest way avoiding using any-third party tools, and I have used rclone for the mounting before. Important to know, that we have Cisco Umbrella installed on the workstations, and in order to get AWS CLI to work, I import the root CA to the CLI. How to achieve this with the rclone I didn’t found.

So, I am experiencing the next behaviour - rclone mounts the s3 bucket, it appears in the explorer, bucket is readable, and when I open the bucket - rclone console is full of token validation errors on GetObject (see below), but, I am able to browser folders and upload to S3. If I try to copy the file and paste it to the local drive, I get the error 0x8007045D.

If I do the copy through the console, file gets downloaded from the S3 with no issues… But I need it to be operational via the Explorer.

I took all the same stuff to my private PC that has just Avira installed - everything works as expected. Should I blame Cisco Umbrella and is there any configurations that I am missing out to get it work? S3 Browser works correctly on the same host.

What I tried:

  • play around with the cache settings
  • force v2 signing
  • change cache directories
  • checked credentials and region a few times
  • some extra settings I forgot about

So, is there anything I am missing out on the rclone side since S3 Browser works, or should I blame Cisco setup?

Thank you!

Run the command 'rclone version' and share the full output of the command.

I tried two:
Release v1.70.3
rclone v1.71.0-beta.9011.dd3fff6ea

  • os/version: Microsoft Windows 11 Enterprise 23H2 23H2 (64 bit)
  • os/kernel: 10.0.22631.5624 (x86_64)
  • os/type: windows
  • os/arch: amd64
  • go/version: go1.25.0
  • go/linking: static
  • go/tags: cmount

Which cloud storage system are you using? (eg Google Drive)

AWS S3

The command you were trying to run (eg rclone copy /tmp remote:tmp)

rclone mount s3:mys3bucket S: --vfs-cache-mode full

Please run 'rclone config redacted' and share the full output. If you get command not found, please make sure to update rclone.

[mys3]
type = s3
provider = AWS
env_auth = false
access_key_id = XXX
secret_access_key = XXX
region = eu-west-1
endpoint = https://s3.eu-west-1.amazonaws.com
location_constraint = eu-west-1
force_path_style = true

[s3]
type = s3
provider = AWS
env_auth = true
access_key_id = XXX
secret_access_key = XXX
region = eu-west-1
location_constraint = eu-west-1
### Double check the config for sensitive info before posting publicly

A log from the command that you were trying to run with the -vv flag

PS C:\Users\Dmytro.Hlotenko> rclone mount s3:dpwviennasync S: --vfs-cache-mode full
2025/08/22 10:32:00 ERROR : symlinks not supported without the --links flag: /
The service rclone has been started.
2025/08/22 10:32:15 ERROR : Progress DB Migration.pdf: vfs cache: failed to download: vfs reader: failed to write to cache file: operation error S3: GetObject, https response error StatusCode: 403, RequestID: VP914QDRAPXRJHW0, HostID: ouszpEr1q0YuEmnWm+Trq3S5R889lh5Zj8+mOV8foDf6FYVLwtI08BHch/JFdN5eUYEt833eJCMtWW8ohOSJlc68QabnZS0W, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
2025/08/22 10:32:15 ERROR : Progress DB Migration.pdf: vfs cache: failed to download: vfs reader: failed to write to cache file: operation error S3: GetObject, https response error StatusCode: 403, RequestID: VP92M7QS804FPBMV, HostID: VPj9ZgDR5X8TU7r8QU/N3rul0J3NdhjLmZ2qI5+1VfW4OikhhtzsZCRygFso/1fgcM7SDGdOidqTVreNSmiZaNV81uW2m8HW, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
2025/08/22 10:32:15 ERROR : Progress DB Migration.pdf: vfs cache: failed to download: vfs reader: failed to write to cache file: operation error S3: GetObject, https response error StatusCode: 403, RequestID: VP9741AA7A4PCVG8, HostID: C0XMsrdJ+I8wM8wdMHcLaKXY6faX2C1i47e3juh2aNUe92CpNDo1RxWrW04g16jwfObbPCQmtNtcYaVOhpVrgzKceHvCBS7w, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
2025/08/22 10:32:16 ERROR : Progress DB Migration.pdf: vfs cache: failed to download: vfs reader: failed to write to cache file: operation error S3: GetObject, https response error StatusCode: 403, RequestID: RAVA7KTT1C7DTGZ1, HostID: 6DY4u2AcJxubHHF6//HXRkJpK0b6dWafuqM6Vi3UE+vfEyme8TSiiQ/u90sh2BSkBP8G6JhN5imHaVjVJx7micumLJKkDDUT, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
2

welcome to the forum,

that is usally a permissions issue.

that does not look correct.
use env_auth or access_key_id + secret_access_key but not both in the same config

best to test on a simple command instead of complex rclone mount

download just one single file and post the full debug log. something like
rclone copy "s3:dpwviennasync/Progress DB Migration.pdf" C:\Users\Dmytro.Hlotenko -vv --retries=1

3

You can use the CA with the --ca-cert /path/to/ca.pem flag and with the new v1.71 you can put this in the config file with override.ca_cert = /path/to/ca.pem.

api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.

It is unusual to have this error and have some things working. I wonder if different things are happening for GET vs PUT or small vs large.

Try the --ca-cert first to see if that helps.

4

Hello,

Yes, this is the most weird thing that it is half working :slight_smile:

Actually, we resolved it by whitelisting the S3 Endpoint at our Cisco Umbrella as expected, then, it started to work :slight_smile:

In any case, I am still confused why do S3 Browser work, but rclone doesn’t.

1 Like
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.