Cli verification of digitally signed email

cryptographyopensslsignature

I am Alice and I've received signed email from Bob.

I use Web e-Mail client (e.g. GMail) and I see that one of attachements is smime.p7s.

I've found option "show original message" and saved contents into message.orig.

Assuming Bob signed email, how can I verify it from command line ?

(Let's assume Bob uses certified key signed by some of respected authorities – I do not know which, but I suppose that)

(Alice don't want to install email client with appropriate feature, just for just one message)

Best Answer

openssl smime -verify -in message.orig

Add a -CAfile or -CApath option to specify a different list of trusted certificates from the system's default.

You may obtain information from the certificate that was used to sign the email with:

openssl smime -noverify -in message.orig -pk7out |
  openssl pkcs7 -print_certs -text -noout

Or from the smime.p7s if you've already extracted it:

openssl pkcs7 -in smime.p7s -text -inform DER -print_certs -noout
Related Question