I am trying to send and encrypt mail using openssl.

So far, I figure I should use theese commands:

cat ${content} | \
    openssl smime -encrypt -inkey lib/me.crt  -aes256 -subject "$titre (cs)" -to someone@hotmail.com lib/MAQUETTE1-me.pem | \
    openssl smime -sign -inkey lib/myroot.key -signer lib/MAQUETTE1-myroot.pem -passin pass:myroot1 | \
    tee ~/tmp7/$T/mail-cs-$c |\
    sendmail -t someone@hotmail.com

another way without cat and tee

openssl smime -encrypt -in ${contents} -out tmp1 -inkey lib/me.crt  -aes256 -subject "$titre (cs)" -to someone@hotmail.com lib/MAQUETTE1-me.pem 
openssl smime -sign -in tmp2 -out tmp2 -inkey lib/myroot.key -signer lib/MAQUETTE1-myroot.pem -passin pass:myroot1 

sendmail -t someone@hotmail.com < tmp2

same result.

This work fine, except that I loose the first few line of ${content}, which is annoying for plain text content, and fatal when sending binary file.

Have I missed something ?

first lines of ~/tmp7/$T/mail-cs-$c (before being sent to sendmail)

    MIME-Version: 1.0
    Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boun

    This is an S/MIME signed message

    To: someone@hotmail.com
    Subject: contenu du tex 17 (cs)
    MIME-Version: 1.0
    Content-Disposition: attachment; filename="smime.p7m"
    Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
    Content-Transfer-Encoding: base64



  • I want to use command line, I already use thunderbird with proper plugin, and it works fine.
  • cat and tee are standard unix command, use very often, I don't believe they can p be part of the problem.
  • I edited body to remove cat and tee.
  • Why not use Thunderbird with the Enigmail plugin?
    – RoraΖ
    Oct 8, 2014 at 13:51
  • @raz I know how to do it with GUI tool, I just want to do it by shell/command line.
    – Archemar
    Oct 8, 2014 at 13:53
  • I think the encryption is fine. The main question is what is causing the first few lines to be removed. Is it the cat or tee?
    – RoraΖ
    Oct 8, 2014 at 13:58
  • Why not leaving cat out and just using openssl smime -encript .... < ${content} ?
    – ThoriumBR
    Oct 8, 2014 at 14:04
  • 1
    Do you have MIME (entity) headers, terminated by an empty line, in the $contents file? If not, either add them -- if you can't or don't want to change the file, you can do something like (echo Content-type: text/plain; echo; cat $contents) | openssl smime ... -- or add option -text which does that for you. For a 'binary file' the receiving MUA probably needs you to be specific, like image/png or whatever it is. Aside: smime -encrypt doesn't need or use -inkey (the only key it uses is the publickey in the recipient cert, which is a positional argument). Oct 9, 2014 at 8:32

1 Answer 1


as suggested by dave_thompson_085,

I change

 cat ${content} |\


 $(file --mime-type ${content} | awk '{printf "Content-type: %s\n",$2} ' ; echo ; cat ${content} ) |\

and it work fine, I juste have to figure out how to send binary document, but that shouldn't be a problem.

thanks every one for help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.