使用openssl smime进行数据验证失败(Data verification with openssl smime fails)

使用openssl smime进行数据验证失败(Data verification with openssl smime fails)

我使用openssl smime来签名和验证数据。

要使用openssl签署文本文件，请使用以下命令：

openssl smime -sign -in sample.txt -out mail.msg -signer cert.pem -inkey key.pem

然后我继续验证：

openssl smime -verify -in mail.msg -CAfile allCA.pem

验证成功。

我的问题是我有一个外部工具，使用以下命令执行验证：

openssl smime -verify -in mail.msg -inform DER -CAfile allCA.pem

如何签署我的txt文件，以便可以使用上一个命令进行验证？

到目前为止我尝试了什么：

openssl smime -sign -in sample.txt -out mail.msg -outform DER -signer cert.pem -inkey key.pem

但是在尝试验证邮件时出错：

Verification failure 140204331579208:error:2107507A:PKCS7 routines:PKCS7_verify:no content:pk7_smime.c:291:

I am using openssl smime to sign and verify data.

To sign text file using openssl I sue the following command:

openssl smime -sign -in sample.txt -out mail.msg -signer cert.pem -inkey key.pem

Then I proceed to verification:

openssl smime -verify -in mail.msg -CAfile allCA.pem

The verification succeed.

My problem is that I have an external tool that performs the verification using the following command:

openssl smime -verify -in mail.msg -inform DER -CAfile allCA.pem

How to sign my txt file so it can be verified with the previous command ?

What I've tried so far:

openssl smime -sign -in sample.txt -out mail.msg -outform DER -signer cert.pem -inkey key.pem

But I get an error when trying to verify my mail:

Verification failure 140204331579208:error:2107507A:PKCS7 routines:PKCS7_verify:no content:pk7_smime.c:291:

最满意答案

调用sign操作的方式会创建分离签名，因此您需要传递-content sample.txt来验证命令。 但是，可以创建将消息与签名（ -nodetach参数）一起封装的结构。

这是您要查找的sign命令：

openssl smime -sign -in data.dat -out mail.msg -signer cert.pem -inkey key.pem -outform DER -nodetach

The way you call sign operation creates detached signature so you would need to pass -content sample.txt to verify command. However, it is possible to create structure that encapsulates message together with signature (-nodetach parameter).

This is the sign command you are looking for:

openssl smime -sign -in data.dat -out mail.msg -signer cert.pem -inkey key.pem -outform DER -nodetach