PKCS#7/CMS verify reports bad signature

Steffen steffenl.sw at
Mon Apr 1 13:46:43 UTC 2019


I am struggling with using OpenSSL 1.1.1 to verify a PKCS #7/CMS structure.
Verification succeeds when I use OpenSSL 1.0.2, but 1.1.0 and 1.1.1 fails
with "bad signature". I initially had this problem when using the OpenSSL
library but I see that the problem also applies to the OpenSSL CLI.

I am at loss and need some help with this issue. Please see the commands I
used below. Thank you for any assistance you can provide!


   - "-noverify" was used because the certificates expired.
   - Verification succeeds when specifying "-nosigs".
   - "openssl cms -verify [...]" behaves the same way.
   - Since the files I am working with (test.der and test-data.bin) are
   part of a private project, I am not ready to share these in public.
   - I do not know exactly how the message structure was created but I
   guess either with some OpenSSL 1.0.2, Java with or without BouncyCastle.

Commands used:

# Environment: macOS 10.14.3 / Homebrew

$ /usr/local/opt/openssl/bin/openssl version
OpenSSL 1.0.2r  26 Feb 2019

$ /usr/local/opt/openssl/bin/openssl smime -verify -inform der -in test.der
-content test-data.bin -noverify
Verification successful

$ /usr/local/opt/openssl\@1.1/bin/openssl version
OpenSSL 1.1.1b  26 Feb 2019

$ /usr/local/opt/openssl\@1.1/bin/openssl smime -verify -inform der -in
test.der -content test-data.bin -noverify
Verification failure
4563408320:error:04091068:rsa routines:int_rsa_verify:bad
4563408320:error:21071069:PKCS7 routines:PKCS7_signatureVerify:signature
4563408320:error:21075069:PKCS7 routines:PKCS7_verify:signature
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the openssl-users mailing list