I am getting emails with smime.p7s attachments. when I look at my mail on my Linux box, I can see base64 encoded block in mail body. I can extract that block and open it on Windows using certmgr and everything looks ok.

I need to verify this certificate that I extracted to a file for

  • CA path
  • CRLs
  • expiration

I want to perform all the task on linux using a script. How can I use openssl or some other command to do this?

  • You could probably use a java .jar file that uses Bouncy Castle... and invoke from the command line – goodguys_activate Jan 4 '13 at 16:02

Openssl has all the command-line utilities you need.

It can work on x509 certificates and can also deal directly with S/MIME content. The verify utility is specifically for doing certificate chain validation, but that function is also built in to the S/MIME utility.

  • Thanks for reply. Yes I am planning to use openssl to perform the tasks. However, currently, openssl don't like the format that I extract from mail command. That's where I need help :-(, e.g. my file starts with MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIJNGTCCBcow ggOyoAMCAQICBACYlowwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCTkwxHjAcBgNVBAoMFVN0 Thanks S – user1231737 Jan 4 '13 at 17:12

You want to use the openssl cms command:

openssl cms -verify -in somemail.eml

Note that the verification is done on the .eml file — not the smime.p7s attachment (the file beginning with “MIAGCSqGSIb3DQEHAqC”).

For CRL checking, take a look at the -crl_check and -crl_check_all parameters.

To specify the CA certs to check against, use the -CApath or -CAfile parameters.

Finally, if you want to manually inspect the certificates yourself (like with certmgr) you could use the -certsout parameter:

openssl cms -verify -certsout chain.crt -in someemail.eml
openssl x509 -in chain.crt -text

If there is more than one cert in chain.crt, you can split them apart manually into separate files, so you can inspect each one individually with openssl x509.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.