To decrypt signed and encrypted messages openssl smime -in MailEncrypted.txt -decrypt -recip recipient.crt \ -inkey recipient.key > MailDecrypted.txt To verify signature openssl smime -in MailDecrypted.txt -verify -out Mail.txt \ -signer sender.crt -CAfile ca.crt Password on all certificates: 123456 ################################################################### If you gonna to run your own CA and/or create your own certificates here is some help. DONT ASK ME ANY SINGLE STUPID QUESTION please. 10x. DONT ASK ME ANY BUNCH OF STUPID QUESTIONS EITHER. Thanks. 1. Run CA.pl -newca it will create directory structure Look at misc directory which comes with openssl 2. You may hack defaults in openssl config file, or create your own config file. If so run export OPENSSL_CONFIG=`pwd`/openssl.cnf to force openssl to use YOUR config 3. ROOT CA KEY 4096 bits long openssl genrsa -des3 -out ca.key 4096 4. ROOT Self signed certificate for 4 years openssl req -new -x509 -days 1460 -key ca.key -out ca.crt 5. Key for user 4096 keys long openssl genrsa -des3 -out user.key 4096 6. Certificate signing request for user for 4 years openssl req -new -days 1460 -key user.key -out user.csr 7. Sign it with ROOT CA CERT openssl ca -in user.csr -out user.crt -cert ca.crt -keyfile ca.key -days 1460 8. To load into Outlook or Mozilla you will need PKCS12 file format. NOTE !!!!! NOTE !!!!! **** This format joins private key and certificate leaving private key unprotected. **** Make sure you provide export password and don't send this file **** via open link if you are really paranoid **** openssl pkcs12 -export -in user.crt -out user.p12 -inkey user.key -name "Dear User Personal Certificate" 9. To sign message openssl smime -sign -in /etc/passwd -signer user.crt -text -inkey user.key > signed.txt 10. To encrypt openssl smime -encrypt -out encrypted.txt -from user@test.com -to user@test.com -subject "puzzle" -des3 user.crt 11. Hope that helps to prevent III World War and to improve your brain ability. So finally it makes our life on this planet more peacefull and enjoyable. Dmitry Dorofeev. dima@yasp.com