the main question of this message is how to get the true ciphertext from S/MIME file?

I created RSA keys and encrypted a message with S/MIME as follow :

1) generate private key : openssl genrsa -out maCle.pem 1024

2) create certificate(public key) : openssl req -new -x509 -key privkey.pem -out certif.pem -days 1095

3) encrypt using smime : openssl smime -encrypt -in plaintext -text -out mail.msg certif.pem

mail.msg looks like:

MIME-Version: 1.0
Content-Disposition: attachment; filename="smime.p7m"
Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
Content-Transfer-Encoding: base64


when I decode the base64 from mail.msg I can see informations that are in my certificate (certif.pem). So it seems mail.msg contains a certificate which is NOT encrypted (is that right?) So how can I extract this certificate and how can I extract the true ciphertext that matches with my plaintext?

I thought the certificate in mail.msg was the same in certif.pem but the beginning doesn't match except the first three characters :

certif.pem : MIIC3DCCAkWgAwI...
mail.msg   : MIIBnQYJKoZIhvc...

so what is this certificate?

  • $\begingroup$ It doesn't contain the cert, it contains the IssuerAndSerialNumber to identify the cert so a recipient with multiple keys knows which to use and for a message with multiple recipients each recipient knows which one to use. See 6.2.1 in ietf.org/rfc/rfc3369.txt . IssuerSN is only part of RecipInfo which is only part of the overall message; there are lots of other pieces in there. $\endgroup$ Nov 17, 2014 at 7:41

1 Answer 1


the following command do what I want :

openssl smime -in msg -pk7out -out msg.pk7
openssl asn1parse -in msg.pk7

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.