OPENSSL-SMIME(1ssl) OpenSSL OPENSSL-SMIME(1ssl) (NAME) openssl-smime - S/MIME (SYNOPSIS) openssl smime [-help] [-encrypt] [-decrypt] [-sign] [-resign] [-verify] [-pk7out] [-binary] [-crlfeol] [-cipher] [-in file] [-certfile file] [-signer file] [-nointern] [-noverify] [-nochain] [-nosigs] [-nocerts] [-noattr] [-nodetach] [-nosmimecap] [-recip file] [-inform DER|PEM|SMIME] [-outform DER|PEM|SMIME] [-keyform DER|PEM|P12|ENGINE] [-passin arg] [-inkey filename|uri] [-out file] [-content file] [-to addr] [-from ad] [-subject s] [-text] [-indef] [-noindef] [-stream] [-md digest] [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath] [-CAstore uri] [-no-CAstore] [-engine id] [-rand files] [-writerand file] [-allow_proxy_certs] [-attime timestamp] [-no_check_time] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-issuer_checks] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] [-config configfile] recipcert ... (DESCRIPTION) S/MIME RFC 2311 ( ) CMS . S/MIME 2.0 . CMS OpenSSL . (OPTIONS) : -encrypt -decrypt -sign -resign -verify -pk7out. . . -help . -encrypt . . MIME . . -decrypt . MIME . . -sign . . MIME . -resign : . -verify . . (clear text) (opaque) . -pk7out PKCS#7 PEM . -in filename MIME . -out filename MIME . -inform DER|PEM|SMIME PKCS#7 ( S/MIME) SMIME . openssl-format-options(1) . -outform DER|PEM|SMIME PKCS#7 ( S/MIME) SMIME . openssl-format-options(1) . -keyform DER|PEM|P12|ENGINE . openssl-format-options(1) . -stream, -indef -stream -indef / (streaming I/O) . . S/MIME (detached) SMIME . -noindef I/O . . . -content filename (detached content) -verify . PKCS#7 . S/MIME MIME multipart/signed . -text MIME (text/plain) . : MIME text/plain . -md digest (digest) . ( SHA1). -cipher . DES ( ) - -des Triple DES ( ) - -des3 AES ( ) - -aes256. ( EVP_get_cipherbyname() ) -aes-128-cbc. OpenSSL openssl-enc(1) . AES-256-CBC . -encrypt . -nointern ( ) . -certfile . CA . -noverify . -nochain CA . -nosigs . -nocerts . . ( -certfile ). -noattr . . -nodetach (opaque) . (mail relays) S/MIME . MIME multipart/signed . -nosmimecap SMIMECapabilities . -binary (canonical) CR LF ( S/MIME). . MIME . -crlfeol LF . CRLF . -certfile file . . . PEM DER PKCS#12 . -signer file . . -recip file . . -inkey filename|uri . . -recip -signer . . -passin arg . arg openssl-passphrase-options(1) . -to, -from, -subject . . S/MIME From: . -allow_proxy_certs, -attime, -no_check_time, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict -issuer_checks . << >> openssl-verification-options(1) . . -CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore << >> openssl-verification-options(1) . -engine id << >> openssl(1) . . -rand files, -writerand file << >> openssl(1) . -provider name -provider-path path -provparam [name:]key=value -propquery propq << >> openssl(1) provider(7) property(7) . -config configfile << >> openssl(1) . recipcert ... . (NOTES) MIME . . (pipe) sendmail . MIME S/MIME ( ). -text . << >> . . . S/MIME . <<>> . -encrypt -decrypt S/MIME . (enveloped data) PKCS#7 PKCS#7 . -resign . . -stream -indef / (streaming I/O) . BER DER . -encrypt -sign . -sign PKCS#7 DER . (EXIT CODES) 0 . 1 . 2 . 3 PKCS#7 MIME . 4 . 5 . (EXAMPLES) : openssl smime -sign -in message.txt -text -out mail.msg \ -signer mycert.pem (opaque): openssl smime -sign -in message.txt -text -out mail.msg -nodetach \ -signer mycert.pem : openssl smime -sign -in in.txt -text -out mail.msg \ -signer mycert.pem -inkey mykey.pem -certfile mycerts.pem : openssl smime -sign -in message.txt -text -out mail.msg \ -signer mycert.pem -signer othercert.pem sendmail : openssl smime -sign -in in.txt -text -signer mycert.pem \ -from steve@openssl.org -to someone@somewhere \ -subject "Signed message" | sendmail someone@somewhere : openssl smime -verify -in mail.msg -signer user.pem -out signedtext.txt Triple DES: openssl smime -encrypt -in in.txt -out mail.msg -from steve@openssl.org \ -to someone@somewhere -subject "Encrypted message" \ -des3 user.pem : openssl smime -sign -in ml.txt -signer my.pem -text \ | openssl smime -encrypt -out mail.msg \ -from steve@openssl.org -to someone@somewhere \ -subject "Signed and Encrypted message" -des3 user.pem : -text MIME . : openssl smime -decrypt -in mail.msg -recip mycert.pem -inkey key.pem (Netscape) PKCS#7 (detached) . Base64 : -----BEGIN PKCS7----- -----END PKCS7----- : openssl smime -verify -inform PEM -in signature.pem -content content.txt Base64 : openssl smime -verify -inform DER -in signature.der -content content.txt Camellia : openssl smime -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem : openssl smime -resign -in mail.msg -signer newsign.pem -out mail2.msg (BUGS) MIME : . : . (heuristic) . . SMIMECapabilities . . . . S/MIME S/MIME . (SEE ALSO) ossl_store-file(7) (HISTORY) OpenSSL 3.5 3DES AES-256 . -signer -resign OpenSSL 1.0.0 . -no_alt_chains OpenSSL 1.1.0 . -engine OpenSSL 3.0 . (COPYRIGHT) - OpenSSL . . . ("") . . LICENSE : 3.6.4 2026-08-25 OPENSSL-SMIME(1ssl)