I want to use the Cryptographic Message Syntax (CMS) of OpenSSL as documented on https://www.openssl.org/docs/apps/cms.html on OS X.

When I try to run openssl cms I get the following error:

$ openssl cms
openssl:Error: 'cms' is an invalid command.

Standard commands
asn1parse      ca             ciphers        crl            crl2pkcs7

How do I enable support for CMS on OS X?


Answering my own question, as I can't find this documented anywhere.

The problem here is that the OpenSSL build bundled with OS X doesn't come compiled with CMS supported. In order to enable CMS support you will have to compile your own version of OpenSSL.

First, clone the OpenSSL Github mirror:

git clone git@github.com:openssl/openssl.git

Checkout a stable version, for example 1.0.2:

cd openssl
git checkout OpenSSL_1_0_2

Configure the compiled to enable CMS support:

./Configure darwin64-x86_64-cc enable-cms

Then make and install openssl:

make install

If everything goes well you should now have your selected version of OpenSSL installed at /usr/local/ssl/bin/openssl. When running /usr/local/ssl/bin/openssl cms you should see the following:

/usr/local/ssl/bin/openssl cms
Usage cms [options] cert.pem ...
where options are
-encrypt       encrypt message
-decrypt       decrypt encrypted message

Note that this will not override your bundled openssl installation, so you will either need to modify your path or use the binary directly.

  • 1
    Thanks for your question and answer, I was having exactly the same problem and this really helped. I also edited your answer to include the Homebrew alternative. – Sergio Acosta Dec 12 '16 at 19:15
  • FWIW I'm on Sierra and after following the above steps my openssl ended up elsewhere: /usr/local/bin/openssl cms worked for me. – Crummy May 9 '17 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.