GnuPG supports creating trust signatures using the tsign sub-command. (The documentation is not really verbose about this.) By using this option it is possible to create a certificate hierarchy similar to the CA-hierarchy in S/MIME.

Is it possible to convert GnuPG trust signatures to S/MIME signatures.

1 Answer 1


GnuPG implements the OpenPGP specification, which is not compatible to X.509 and S/MIME. Not only the format in which keys, certifications, signatures and messages are stored are different and OpenPGP implements a variety of the CFB mode for encryption, also the trust model differs heavily (web of trust/network in the case of OpenPGP, and a hierarchical trust system for X.509): while you can map the X.509 certificate hierarchy into an OpenPGP trust network, the other way is not generally possible (for example, OpenPGP allows loops, which cannot be mapped to a tree). Furthermore, the metadata stored in keys is different.

While you could theoretically export the eg. RSA primes and convert a key from one format into the other, those would still not be compatible. Similarly, there is no way to convert certificates from one system to the other in a compatible way. An example why this will not work out is that the certificate is issued on a hash sum of the key, which is not reversible and calculated on different input for each of the systems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .