I'm trying to manually verify the signature in an S/MIME signed email with openssl as part of a homework. While I have the mail and can extract the chain of certificates, I'm failing to extract the actual signature of the email and verify that it matches the mail content and senders certificate.
I have the public key of the signer (the last certificate) and I have the plaintext, which I got with
openssl smime -verify -in <mail> -noverify -out mail_body.txt
I also get the pk7 structure from the mail with
openssl smime pk7out -in <mail> -text -out certs.p7s
and dump the chain of certs
openssl pkcs7 -in certs.p7s -print_certs -text -out certs.pem
From this I get the certificate of the signer and his public key (Just copied the base64 begin/end certificate and
openssl x509 -pubkey -in signer.crt -out signer.key
If I understand correctly now I need the encrypted signed hash, decrypt it with the signer public key and check that with the hash of mail_body.txt but I can't find the signature in the mail.
-noverify
option which you do for unknown reason.openssl smime -verify -noverify
only suppresses validation (aka verification) of the signer's cert against its chain and the truststore; it still verifies the signature in SignerInfo against the message, and only-nosigs
suppresses the latter.