openssl smime

用途：

S/MIME工具，用于处理S/MIME邮件，它能加密、解密、签名和验证S/MIME消息

语法：

openssl smime

[-encrypt] [-decrypt] [-sign] [-verify] [-pk7out] [-nointern] [-nosigs]

[-noverify] [-nocerts] [ -nodetach] [-noattr] [-binary] [- in file ]

[-inform SMIME|PEM|DER] [-certfile file ] [-signer file ] [-recip file ]

[-passin arg] [-inkey file ] [-keyform PEM |ENGINE] [-out file ]

[-outform SMIME|PEM|DER] [-content file ] [-to addr] [-from ad] [-subject s]

[-text] [-CApath directory] [-CAfile filename] [-crl_check] [-crl_check_all]

[-indef] [-noindef] [-stream] [-rand file (s)] [-md digest] [cert.pem…] [-des]

[-des3] [-rc2- 40 ] [-rc2- 64 ] [-rc2- 128 ]

参数说明：

-encrypt encrypt message

-decrypt decrypt encrypted message

-sign sign message

-verify verify signed message

-pk7out output PKCS#7 structure

-des3 encrypt with triple DES

-des encrypt with DES

-seed encrypt with SEED

-rc2-40 encrypt with RC2-40 (default)

-rc2-64 encrypt with RC2-64

-rc2-128 encrypt with RC2-128

-aes128, -aes192, -aes256

encrypt PEM output with cbc aes

-camellia128, -camellia192, -camellia256

encrypt PEM output with cbc camellia

-nointern don't search certificates in message for signer

-nosigs don't verify message signature

-noverify don't verify signers certificate

-nocerts don't include signers certificate when signing

-nodetach use opaque signing

-noattr don't include any signed attributes

-binary don't translate message to text

-certfile file other certificates file

-signer file signer certificate file

-recip file recipient certificate file for decryption

-in file input file

-inform arg input format SMIME (default), PEM or DER

-inkey file input private key (if not signer or recipient)

-keyform arg input private key format (PEM or ENGINE)

-out file output file

-outform arg output format SMIME (default), PEM or DER

-content file supply or override content for detached signature

-to addr to address

-from ad from address

-subject s subject

-text include or delete text MIME headers

-CApath dir trusted certificates directory

-CAfile file trusted certificates file

-trusted_first use trusted certificates first when building the trust chain

-crl_check check revocation status of signer's certificate using CRLs

-crl_check_all check revocation status of signer's certificate chain using CRLs

-engine e use engine e, possibly a hardware device.

-passin arg input file pass phrase source

-rand file:file:...

load the file (or the files in the directory) into

the random number generator

cert.pem recipient certificate(s) for encryption

例子：

1、进行数字签名

openssl smime -verify -CAfile certself.pem - in install_sign.msg -out install_verify.log

openssl smime -verify -noverify -CAfile certself.pem -signer certself.pem - in text_sign.msg -out text_verify.log

openssl smime -verify -nodetach -CAfile certself.pem -signer certself.pem - in text_sign.msg -out text_verify.log

2、进行签名验证

openssl smime -verify -CAfile certself.pem - in install_sign.msg -out install_verify.log

openssl smime -verify -noverify -CAfile certself.pem -signer certself.pem - in text_sign.msg -out text_verify.log

openssl smime -verify -nodetach -CAfile certself.pem -signer certself.pem - in text_sign.msg -out text_verify.log

3、进行数字信封加密

openssl smime -encrypt - in install .log -out install_evp.enc certself.pem

4、进行数字信封解密

openssl smime -decrypt - in install_evp.enc -out install_ope.log -inkey prikey.pem

5、smime格式与pkcs#7格式的互转

openssl smime - in text_sign.msg -pk7out -out test_pkcs.pem

openssl pkcs7 -in test_pkcs.pem -text

 

openssl系列命令大纲： http://www.cnblogs.com/aixiaoxiaoyu/p/8650180.html