OPENSSL-CMS(1ssl) OpenSSL OPENSSL-CMS(1ssl) (NAME) openssl-cms - CMS S/MIME (SYNOPSIS) openssl cms [-help] : [-in filename] [-out filename] [-config configfile] : [-encrypt] [-decrypt] [-sign] [-verify] [-resign] [-sign_receipt] [-verify_receipt receipt] [-digest digest] [-digest_create] [-digest_verify] [-compress] [-uncompress] [-EncryptedData_encrypt] [-EncryptedData_decrypt] [-data_create] [-data_out] [-cmsout] : [-inform DER|PEM|SMIME] [-outform DER|PEM|SMIME] [-rctform DER|PEM|SMIME] [-stream] [-indef] [-noindef] [-binary] [-crlfeol] [-asciicrlf] : [-pwri_password password] [-secretkey key] [-secretkeyid id] [-inkey filename|uri] [-passin arg] [-keyopt name:parameter] [-keyform DER|PEM|P12|ENGINE] [-engine id] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] [-rand files] [-writerand file] : [-originator file] [-recip file] [recipient-cert ...] [-cipher] [-kekcipher cipher] [-wrap cipher] [-aes128-wrap] [-aes192-wrap] [-aes256-wrap] [-des3-wrap] [-debug_decrypt] [-recip_kdf kdf] [-recip_ukm ukm] : [-md digest] [-signer file] [-certfile file] [-cades] [-nodetach] [-nocerts] [-noattr] [-nosmimecap] [-no_signing_time] [-receipt_request_all] [-receipt_request_first] [-receipt_request_from emailaddress] [-receipt_request_to emailaddress] : [-signer file] [-content filename] [-no_content_verify] [-no_attr_verify] [-nosigs] [-noverify] [-nointern] [-cades] [-verify_retcode] [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath] [-CAstore uri] [-no-CAstore] : [-keyid] [-econtent_type type] [-text] [-certsout file] [-to addr] [-from addr] [-subject subj] : [-noout] [-print] [-nameopt option] [-receipt_request_print] : [-allow_proxy_certs] [-attime timestamp] [-no_check_time] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-issuer_checks] (DESCRIPTION) CMS S/MIME . . . (OPTIONS) : encrypt decrypt sign verify resign sign_receipt verify_receipt digest_create digest_verify compress uncompress EncryptedData_encrypt EncryptedData_decrypt data_create data_out cmsout. . -help . (General options) -in filename . -out filename MIME . -config configfile << >> openssl(1) . (Operation options) -encrypt . . MIME . CMS EnvelopedData . . -decrypt . MIME . . -sign . . MIME . -verify . . (clear text) (opaque) . S/MIME ("smimesign") . << >> openssl-verification-options(1) . -resign : . -sign_receipt . . -sign . -verify_receipt receipt receipt. . -verify . -digest digest -sign (digest) . -in -nodetach . CMS openssl-pkeyutl(1) . . -digest_create CMS DigestedData. -digest_verify CMS DigestedData . -compress CMS CompressedData. OpenSSL zlib . -uncompress CMS CompressedData . OpenSSL zlib . -EncryptedData_encrypt CMS EncryptedData . -EncryptedData_decrypt CMS EncryptedData . -data_create CMS Data. -data_out Data . -cmsout CMS PEM . (File format options) -inform DER|PEM|SMIME CMS ( ) SMIME . openssl-format-options(1) . -outform DER|PEM|SMIME CMS ( ) SMIME . openssl-format-options(1) . -rctform DER|PEM|SMIME -receipt_verify SMIME . openssl-format-options(1) . -stream, -indef -stream -indef / . . S/MIME SMIME . -noindef / . . . -binary <<>> (Canonical) CR LF S/MIME . . MIME . -crlfeol LF . CRLF . -asciicrlf ASCII CRLF . (EOF) . DER . . (Keys and password options) -pwri_password password . -secretkey key . . -EncryptedData_encrypt -EncryptedData_decrypt -encrypt -decrypt . -encrypt -decrypt AES KEKRecipientInfo . -secretkeyid id KEKRecipientInfo. -secretkey -encrypt . -decrypt id KEKRecipientInfo . -inkey filename|uri . . -recip -signer . . -passin arg . arg openssl-passphrase-options(1) . -keyopt name:parameter . RSA-PSS RSA-OAEP ECDH . -keyform DER|PEM|P12|ENGINE . openssl-format-options(1) . -engine id << (Engine Options)>> openssl(1) . . -provider name -provider-path path -provparam [name:]key=value -propquery propq << (Provider Options)>> openssl(1) provider(7) property(7) . -rand files, -writerand file << (Random State Options)>> openssl(1) . (Encryption and decryption options) -originator file . (Key Agreement) . . -recip file . . . ( RSA-OAEP) . RSA - (Diffie-Hellman) EC . recipient-cert ... -recip . . -cipher . AES ( ) - -aes256 DES ( ) - -des3. ( EVP_get_cipherbyname() ) -aes-128-cbc. OpenSSL openssl-enc(1) . AES GCM AEAD . AES-256-CBC . -encrypt -EncryptedData_encrypt . -kekcipher cipher . -pwri_password AEAD . -AEAD . -wrap cipher (Key Wrap) . . -aes128-wrap, -aes192-wrap, -aes256-wrap, -des3-wrap AES128 AES192 AES256 3DES-EDE . OpenSSL -des3-wrap . -debug_decrypt CMS_DEBUG_DECRYPT . : . -recip_kdf KDF KEMRecipientInfo . KDF OSSL_KDF_PARAM_KEY OSSL_KDF_PARAM_INFO OID HKDF-SHA256. -recip_ukm (UKM) KEMRecipientInfo . UKM OSSL_KDF_PARAM_INFO KDF KEMRecipientInfo . (Signing options) -md digest (digest) . ( SHA-256). -signer file . . -certfile file . . . PEM DER PKCS#12 . -cades -sign ESS signingCertificate ESS signingCertificateV2 SignerInfo CAdES (CAdES-BES) . -nodetach (opaque signing) S/MIME . (cleartext) multipart/signed . -nocerts . ( -certfile ). -noattr . . -nosmimecap ( ) . -no_signing_time . -receipt_request_all, -receipt_request_first -sign . ( ) . -receipt_request_from . -receipt_request_from emailaddress -sign . . -receipt_request_to emailaddress . . (Verification options) -signer file () . -content filename (detached content) S/MIME ( -verify) . CMS . S/MIME MIME multipart/signed . -no_content_verify . -no_attr_verify . -nosigs . -noverify . -nointern ( ) . -certfile . CA . -cades -verify . << (NOTES)>> . -verify_retcode . -CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore " (Trusted Certificate Options)" openssl-verification-options(1) . (Output options) -keyid (subject key identifier) . . -sign -encrypt . -econtent_type type type. Data . type OID . -text MIME (text/plain) . : MIME text/plain . -certsout file file . -to, -from, -subject . . S/MIME From: . (Printing options) -noout -cmsout CMS . (syntax) CMS . -print -cmsout CMS . -noout . -nameopt option -cmsout -print . utf8 . openssl-namedisplay-options(1) . -receipt_request_print -verify (signed receipt requests) . (Validation options) -allow_proxy_certs, -attime, -no_check_time, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict -issuer_checks . << >> openssl-verification-options(1) . . (NOTES) MIME . . sendmail . MIME S/MIME ( ) . -text . << >> . : . . S/MIME . << >> . -encrypt -decrypt S/MIME . (enveloped data) CMS CMS . -resign . . -stream -indef / (streaming I/O) . BER DER . -encrypt -sign . -sign (detached) CMS DER . -decrypt . MMA ( PKCS #1 v1.5 RSA) <<>> . -debug_decrypt MMA . CMS_decrypt(3) . CADES (CADES BASIC ELECTRONIC SIGNATURE - CADES-BES) CAdES (CAdES-BES) ETSI EN 319 122-1 V1.1.1 : o CMS (RFC 3852) o (Content-type) EncapsulatedContentInfo o (Message-digest) eContent encapContentInfo o ESS signingCertificate ESS signingCertificateV2 (ESS) RFC 2634 RFC 5035 . ESS signingCertificate SHA-1 . ESS signingCertificateV2 . o . -cades -sign -verify . -verify signingCertificate . (EXIT CODES) 0 . 1 . 2 . 3 CMS MIME . 4 . 5 . PKCS#7 (COMPATIBILITY WITH PKCS#7 FORMAT) openssl-smime(1) PKCS#7 . openssl cms (Cryptographic Message Syntax) . . . -keyid -sign -encrypt. -outform PEM . -compress. -secretkey -encrypt . PSS -sign. OAEP RSA -encrypt. -EncryptedData_encrypt -data_create openssl-smime(1) . (EXAMPLES) (cleartext): openssl cms -sign -in message.txt -text -out mail.msg \ -signer mycert.pem (opaque): openssl cms -sign -in message.txt -text -out mail.msg -nodetach \ -signer mycert.pem : openssl cms -sign -in in.txt -text -out mail.msg \ -signer mycert.pem -inkey mykey.pem -certfile mycerts.pem : openssl cms -sign -in message.txt -text -out mail.msg \ -signer mycert.pem -signer othercert.pem -keyid sendmail : openssl cms -sign -in in.txt -text -signer mycert.pem \ -from steve@openssl.org -to someone@somewhere \ -subject "Signed message" | sendmail someone@somewhere : openssl cms -verify -in mail.msg -signer user.pem -out signedtext.txt Triple DES: openssl cms -encrypt -in in.txt -from steve@openssl.org \ -to someone@somewhere -subject "Encrypted message" \ -des3 user.pem -out mail.msg : openssl cms -sign -in ml.txt -signer my.pem -text \ | openssl cms -encrypt -out mail.msg \ -from steve@openssl.org -to someone@somewhere \ -subject "Signed and Encrypted message" -des3 user.pem : -text MIME . : openssl cms -decrypt -in mail.msg -recip mycert.pem -inkey key.pem Netscape PKCS#7 (detached) . base64 : -----BEGIN PKCS7----- -----END PKCS7----- : openssl cms -verify -inform PEM -in signature.pem -content content.txt base64 : openssl cms -verify -inform DER -in signature.der -content content.txt Camellia : openssl cms -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem : openssl cms -resign -in mail.msg -signer newsign.pem -out mail2.msg RSA-PSS: openssl cms -sign -in message.txt -text -out mail.msg \ -signer mycert.pem -keyopt rsa_padding_mode:pss RSA-OAEP: openssl cms -encrypt -in plain.txt -out mail.msg \ -recip cert.pem -keyopt rsa_padding_mode:oaep SHA256 KDF ECDH: openssl cms -encrypt -in plain.txt -out mail.msg \ -recip ecdhcert.pem -keyopt ecdh_kdf_md:sha256 CMS : openssl cms -in signed.cms -binary -inform DER -cmsout -print (BUGS) MIME : . : . . . SMIMECapabilities . . . . (SEE ALSO) ossl_store-file(7) (HISTORY) OpenSSL 3.5 3DES AES-256 . -signer -resign OpenSSL 1.0.0 . -keyopt OpenSSL 1.0.2 . RSA-OAEP RSA-PSS OpenSSL 1.0.2 . RSA -encrypt -decrypt OpenSSL 1.0.2 . -no_alt_chains OpenSSL 1.0.2b . -nameopt OpenSSL 3.0.0 . -engine OpenSSL 3.0 . -digest OpenSSL 3.2 . -recip_kdf -recip_ukm OpenSSL 3.6 . (COPYRIGHT) - OpenSSL . . . ("") . . LICENSE : 3.6.4 2026-08-25 OPENSSL-CMS(1ssl)