diff --git a/.changes/nextrelease b/.changes/nextrelease
new file mode 100644
index 0000000000..f5abce2508
--- /dev/null
+++ b/.changes/nextrelease
@@ -0,0 +1,7 @@
+[
+    {
+        "type": "enhancement",
+        "category": "CloudFront",
+        "description": "Throw exception when an empty signature for signed url is generated."
+    }
+]
\ No newline at end of file
diff --git a/src/CloudFront/Signer.php b/src/CloudFront/Signer.php
index 22e55c2a44..c3b66d8c36 100644
--- a/src/CloudFront/Signer.php
+++ b/src/CloudFront/Signer.php
@@ -72,6 +72,7 @@ public function __destruct()
      * @return array The values needed to construct a signed URL or cookie
      * @throws \InvalidArgumentException  when not provided either a policy or a
      *                                    resource and a expires
+     * @throws \RuntimeException when generated signature is empty
      *
      * @link http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-cookies.html
      */
@@ -115,6 +116,14 @@ private function sign($policy)
         $signature = '';
         openssl_sign($policy, $signature, $this->pkHandle);
 
+        if(empty($signature)) {
+            $errorMessages = [];
+            while(($newMessage = openssl_error_string()) !== false){
+                $errorMessages[] = $newMessage;
+            }
+            throw new \RuntimeException(implode("\n",$errorMessages));
+        }
+
         return $signature;
     }