SignatureDoesNotMatch with nginx_aws_auth

I’m trying to use nginx_aws_auth to serve a private space. I generated the signing key using its generate_signing_key script and configured nginx as per the example, but when I try to access it, I get a SignatureDoesNotMatch error.

Taking a look at the canonical request, everything seems to be correct as per the API docs. From the nginx logs:

canonical req is GET
/camera.html

host:<redacted>.nyc3.digitaloceanspaces.com
x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
x-amz-date:20200108T151703Z

host;x-amz-content-sha256;x-amz-date
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

I tried using a presigned GET url with s3cmd, and it worked, though I think it uses v2 instead of v4.

Any idea what might be missing / wrong?