<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">On 26 Jan 2018, at 18:55, Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" class="">openssl-users@dukhovni.org</a>> wrote:<br class=""><div><blockquote type="cite" class=""><br class="Apple-interchange-newline"><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">This requires a pipeline of two cms(1) commands, one to sign and other</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">to encrypt (S/MIME is generally a sign-then-encrypt encapsulation).</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">The inner signed content would be the just the payload no mail headers.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote></div><br class=""><div class="">openssl cms -sign \<br class=""> -in msg.txt \<br class=""> -inkey key.pem \<br class=""> -signer pub.pem \<br class=""> -text \<br class=""> | \<br class="">openssl cms -encrypt \<br class=""> -recip pub.pem \<br class=""> -subject 'openssl signed and encrypt' \<br class=""> -to email \<br class=""> -from email \<br class=""> | \<br class=""> sendmail email</div><div class=""><br class=""></div><div class="">With this I still get the same result, an smime.p7m attachment which can not be opened.</div><div class=""><br class=""></div><div class="">Please note, using the same certificate/key in OSX mail app for sign and encrypt works perfect.</div><div class=""><br class=""></div><div class="">Any help is very much appreciate as I already spent 3 evening with reading/&fiddling around with the different parameters :-)</div><div class=""><br class=""></div><div class="">Thanks so much!</div></body></html>