Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to verify the sender and 'addressee' certificate information of an encrypted/signed file. So far, I came up with the following set of arguments to openssl:

openssl cms -inform DER -cmsout -print -recip my.crt -in cms_file

This returns the following information:

  contentType: pkcs7-envelopedData (1.2.840.113549.1.7.3)
    version: 2
            issuer: O=TheirCompany, CN=TheirCA
            subject: O=TheirCompany, CN=TheirEndpoint
          issuer: O=TheirCompany, CN=TheirCA

So I've got most of the information I'm looking for, except the subject of the recipient. How do I extract this information?

share|improve this question
up vote 0 down vote accepted

I'm not sure you can do this, since the recipientInfos structure is not defined, e.g. per RFC 5652, to contain a certificate. Keys, yes...but not certificates.

RFC 5652, Section 6.1 "EnvelopedData Type" specifies the structure of OriginatorInfo, which may contain a set of certificates. Section 6.2 "ReicipientInfo Type" and subsections describe the structure of the possible RecipientInfo types; none of those types' structures contain certificates. Thus it may not be possible, given the current structures, to achieve what you are looking for.

share|improve this answer
Thanks for clarifying! – Willem Feb 19 at 13:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.