Let's sign a file with

 $ openssl smime -sign -in file -out file.sign -outform DER -inkey private.pem -signer certificate.pem -nocerts

With the option -no certs no certificate is included in file.sign.

Now if you try to verify file.sign:

$ openssl smime -verify -in file.sign -inform DER -content file -noverify certificate.pem 

You get

Verification failure
139909488150168:error:2107C080:PKCS7 routines:PKCS7_get0_signers:signer certificate not found:pk7_smime.c:466:

The example works, if you sign without -nocerts of course.

But is there are way to tell openssl verify how to find the certificate ?

  • 1
    This isn't really about security concepts, but about how to use openssl. I'm voting to move to StackOverflow. – Mike Ounsworth Dec 29 '17 at 16:55
  • 1
    @MikeOunsworth: it isn't about programming or development either. Although superuser or perhaps serverfault would probably be better, I've seen plenty of how-to-use openssl (and keytool and certutil etc) here. – dave_thompson_085 Dec 30 '17 at 2:02

Aside: you mean openssl smime -verify (or the newer and slightly better openssl cms -verify). openssl verify is a quite different operation which verifies one or more cert(s) against a truststore and optionally a purpose.

From the man page which is on your system if Unixy, or on the web at https://www.openssl.org/docs/manmaster/man1/smime.html (emphasis added):

-certfile file

Allows additional certificates to be specified. When signing these will be included with the message. When verifying these will be searched for the signers certificates. The certificates should be in PEM format.

  • This even works with openssl smime. Thank you so much. I'm going to post the final commands as an answer. – user1511417 Dec 30 '17 at 10:44

For your interest, this works. (Credits to user dave_thompson_085)


openssl smime -sign -nocerts -in file -out file.sgn -inkey private.pem -signer certificate.pem


openssl smime -verify -in file.sgn -noverify -certfile certificate.pem 

Examine / visualize:

openssl cms -in file.sgn -noout -cmsout -print
  • Since this is not actually an alternative answer, it would be better to edit the accepted answer and add your findings there. – not2savvy Feb 21 '18 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.