Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For S/MIME, I now know I can verify PKCS#7 detached signatures with:

openssl smime -verify -in detachedsign.pem -content content.txt

But what about non-MIME messages?
So if I sign the message Hello, World! with openssl smime -sign -text.... it will actually be signing

Content-Type: plain/text

Hello, World!

Is it possible to use openssl to sign a normal text file (as it is)? When -sign outputs a PKCS#7 detached signature and -verify accepts a PKCS#7 detached signature and content

share|improve this question
up vote 4 down vote accepted

Yes, you can use OpenSSL to create and sign a message digest of the plain text file and later use that signed digest to confirm the validity of the text.

openssl sha1 -sign rsaprivate.pem -out rsasign.bin file.txt

and later verify the validity of the text message using

openssl sha1 -verify rsapublic.pem -signature rsasign.bin file.txt

Check out the O'Reilly book Network Security with OpenSSL for a good documentation source for these functions. The example above came from that book.

share|improve this answer
Thanks Zedman, but I meant signing into a PKCS#7 object just like smime option does (and verifying from a PKCS#7 public key certificate as well). I'll add this to the question to become more explicit. – Filipe Pina Nov 17 '11 at 10:44
One other question, on pure terminology, you say "sign a message digest", but it is "encrypt message digest" or "sign message" right? As signing is basically encrypting an hash, as far I as understand. – Filipe Pina Nov 17 '11 at 10:49
@Filipe by 'sign a message digest’ I mean encrypt a message digest (with the author's private key) which is how a message is signed using PKI. Sorry if I confused the issue. The message itself can also be encrypted but that is a different subject. By definition, the public key certificate is checked for trust since that is the foundation requirement of PKI functionality. The syntax of the example commands should work for any keypair OpenSSL supports. – zedman9991 Nov 17 '11 at 14:19
Right, so you agree with what I said in previous comment: it's not "sign message digest" as you used in your answer, it's just "sign message" as "sign message digest" would imply "encrypt digest of message digest" :) anyway, the above commands do not output PKCS7 objects, just plain signature. I was hoping command line openssl tool would be able to the PKCS7_sign that the (openssl) library provides but it seems it can't... – Filipe Pina Nov 17 '11 at 15:29
Very late now, but in case anyone searches: openssl smime does support plain CMS signing and enveloping in either DER (standard) or PEM (semistandard) format as well as S/MIME. Specify -outform der|pem to create and -inform der|pem to read (actually just d or p is enough). For signature detached is the default, but you can specify -nodetach for embedded. – dave_thompson_085 Jun 23 '15 at 10:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.