blocks|key|929857|text|使用命令行工具，假设S/MIME消息本身在文件message中|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|929858|openssl+smime+-verify+-in+message+-noverify+-signer+cert.pem+-out+textdata|code-block|syntax|javascript|929859|这会将签名者证书(嵌入到签名blob中)写入cert.pem，并将消息文本数据写入textdata文件。|929860|或者，您可以将签名blob保存为独立的文件(它只是一种附件，因此任何邮件应用程序或库都应该能够做到这一点。然后，假设所述blob在一个名为smime.p7s的文件中，使用：|929861|openssl+pkcs7+-in+smime.p7s+-inform+DER+-print_certs|929862|它将打印出嵌入在PKCS#7签名中的所有证书。请注意，可以有几个:签名者的证书本身，以及签名者发现适合包含的任何额外证书(例如，有助于验证其证书的中间CA证书)。|929863|entityMap^0|N|7|0|0|M|8|15|8|0|1X|9|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|13|8|@$9|14|A|15|B|C]]|D|@]|E|$]]|$1|O|3|P|5|H|7|16|8|@]|D|@]|E|$I|J]]|$1|Q|3|R|5|6|7|17|8|@]|D|@]|E|$]]|$1|S|3|-4|5|6|7|18|8|@]|D|@]|E|$]]]|T|$]]

With the command-line tool, assuming the S/MIME message itself is in file <code>message</code>:

<pre><code>openssl smime -verify -in message -noverify -signer cert.pem -out textdata
</code></pre>

This writes the signer certificate (as embedded in the signature blob) into <code>cert.pem</code>, and the message text data in the <code>textdata</code> file.

Alternatively, you can save the signature blob as an independent file (it is just a kind of attachment, so any mailer application or library should be able to do that. Then, assuming that the said blob is in a file named <code>smime.p7s</code>, use:

<pre><code>openssl pkcs7 -in smime.p7s -inform DER -print_certs
</code></pre>

which will print out all certificates which are embedded in the PKCS#7 signature. Note that there can be several: the signer's certificate itself, and any extra certificates that the signer found fit to include (e.g. intermediate CA certificates which may help in validating his certificate).

blocks|key|929865|text|或者只是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|929866|cat+message.eml+%7C+openssl+smime+-pk7out+%7C+openssl+pkcs7+-print_certs+>+senders-cert.pem|code-block|syntax|javascript|929867|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Or just:

<pre><code>cat message.eml | openssl smime -pk7out | openssl pkcs7 -print_certs &gt; senders-cert.pem
</code></pre>

blocks|key|713980|text|如果您正在编写C/C%2B%2B，下面的代码片段将会有所帮助|type|unstyled|depth|inlineStyleRanges|entityRanges|data|713981|++++//...assuming+you+have+valid+pkcs7,+st1,+m_store+etc......

++++verifyResult+=+PKCS7_verify(+pkcs7,+st1,+m_store,+content,+out,+flags);
++++if(verifyResult+!=+1)+{
++++++++goto+exit_free;
++++}

++++//Obtain+the+signers+of+this+message.+Certificates+from+st1+as+well+as+any+found+included
++++//in+the+message+will+be+returned.
++++signers+=+PKCS7_get0_signers(pkcs7,+st1,+flags);
++++if+(!save_certs(env,+signerFilePath,+signers))+{
++++++++//Error+log
++++}

//This+method+will+write+the+signer+certificates+into+a+file+provided
int+save_certs(JNIEnv+*env,+jstring+signerFilePath,+STACK_OF(X509)+*signers)
{
++++int+result+=+0;
++++int+i;
++++BIO+*tmp;
++++int+num_certificates+=+0;

++++if+(signerFilePath+==+NULL)+{
++++++++return+0;
++++}

++++const+char+*signerfile+=+(const+char+*)env->GetStringUTFChars(signerFilePath,+0);
++++tmp+=+BIO_new_file(signerfile,+"w");
++++if+(!tmp)+{
++++++++//error.+return
++++}
++++num_certificates+=+sk_X509_num(signers);
++++for(i+=+0;+i+<+num_certificates;+i%2B%2B)+{
++++++++PEM_write_bio_X509(tmp,+sk_X509_value(signers,+i));
++++}
++++result+=+1;

++++exit_free:
++++BIO_free(tmp);
++++if+(signerfile)+{
++++++++env->ReleaseStringUTFChars(signerFilePath,+signerfile);
++++++++signerfile+=+0;
++++}
++++return+result;
}|code-block|syntax|javascript|713982|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If you are writing C/C++, this code snippet would help

<pre><code> //...assuming you have valid pkcs7, st1, m_store etc......

 verifyResult = PKCS7_verify( pkcs7, st1, m_store, content, out, flags);
 if(verifyResult != 1) {
 goto exit_free;
 }

 //Obtain the signers of this message. Certificates from st1 as well as any found included
 //in the message will be returned.
 signers = PKCS7_get0_signers(pkcs7, st1, flags);
 if (!save_certs(env, signerFilePath, signers)) {
 //Error log
 }

//This method will write the signer certificates into a file provided
int save_certs(JNIEnv *env, jstring signerFilePath, STACK_OF(X509) *signers)
{
 int result = 0;
 int i;
 BIO *tmp;
 int num_certificates = 0;

 if (signerFilePath == NULL) {
 return 0;
 }

 const char *signerfile = (const char *)env-&gt;GetStringUTFChars(signerFilePath, 0);
 tmp = BIO_new_file(signerfile, "w");
 if (!tmp) {
 //error. return
 }
 num_certificates = sk_X509_num(signers);
 for(i = 0; i &lt; num_certificates; i++) {
 PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
 }
 result = 1;

 exit_free:
 BIO_free(tmp);
 if (signerfile) {
 env-&gt;ReleaseStringUTFChars(signerFilePath, signerfile);
 signerfile = 0;
 }
 return result;
}
</code></pre>

How can i extract the public certificate from an smime message (pkcs7-signature) with OpenSSL?

Extract public Certificate from SMIME Message (pkcs7-signature) with OpenSSL

命令行工具

如何使用OpenSSL从smime消息(pkcs7-signature)中提取公共证书？

问使用OpenSSL从SMIME消息(pkcs7-signature)中提取公共证书
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用OpenSSL从SMIME消息(pkcs7-signature)中提取公共证书EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用OpenSSL从SMIME消息(pkcs7-signature)中提取公共证书
EN