If I download a signed e-mail from thunderbird, it looks like this:

Content-Type: multipart/signed; protocol="application/pkcs7-signature";     
micalg=sha-256; boundary="------------ms030600030501030208070703"

This is a cryptographically signed message in MIME format.

Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature


My goal is to verify the signature of the actual message manually via openssl without the smime option. The actual signature must be in this large base64 code:

$ openssl enc -base64 -d -in smime.p7s

But this gives me a lot of unreadable code mixed with some readable informations about my CA and so on. How can I convert this to something readable, so that I can check the actual signature of the message-text. (After that, I want to verify it using openssl dgst -sha256 -verify ...)

1 Answer 1


You can save the decoded base64-code to a new file with

$ openssl enc -base64 -d < signature > signature.dec

and use der-ascii

$ ./der2ascii -i signature.dec

to get the desired output.

You can also check the plaintext-message-digest by hand.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.