Check a signed email or .p7m file
Drop a signed .eml, a .p7m, or a smime.p7s with the file it signs. See whether it has changed, whose certificate signed it, and what it contains.
The signed email or file
Drop a signed .eml, a .p7m, or a .p7s with the file it signs
The file it signs
A .p7s on its own is only the signature. Choose the file it was made for, and the two are checked together.
What the signature says
What was signed
Who it is encrypted to
How it works
What smime.p7s and .p7m files are
An email signed with S/MIME carries an attachment called smime.p7s. It is not a document: it is the signature, and the certificate of the person who made it. A mail program that understands it shows a rosette or a tick; one that does not shows a mysterious attachment. A .p7m is the same kind of signature with the signed thing wrapped inside it: an email sent as smime.p7m, or a document signed as a file, like contract.pdf.p7m, which is the usual way signed documents are sent in Italy.
What is checked
- That nothing has changed. The signed part is hashed and compared with the digest the signer recorded, byte for byte, including every attachment inside it.
- That the signature is real. It is checked against the key in the signer's certificate with your browser's own cryptography: RSA, RSA-PSS and ECDSA, with SHA-1 to SHA-512.
- Whose certificate it is. The address in the certificate is compared with the address the email says it is from, because S/MIME signs the body and not the From line.
- Where the certificate comes from. Each certificate included is checked against the one that claims to have issued it, up to the root, and each is read the way CERTLENS reads certificates: dates, purpose, key.
- When it was signed, where that is proven. A signature can carry a timestamp from a timestamping service (RFC 3161), as long-term signatures do. It is checked the way STAMP checks one: the service's signature, its certificate, and that it is a timestamp of this signature. The signing time inside the signature is only the signer's own clock; a timestamp is proof.
- What was inside. The text and attachments the signature covers are listed, and the file inside a .p7m can be saved on its own, exactly as it was signed.
What it does not do
It does not decide whether the root at the top is trusted. That depends on the roots installed on the computer reading the mail, so it names the root and gives its fingerprint instead. It does not check revocation, which would mean asking the certificate authority over the network. Encrypted email cannot be opened without the recipient's private key, which this page never asks for; it says who the message was encrypted to. PGP signatures are a different format and are not read here, and neither are Ed25519 signatures or compressed CMS.
Doing this often? OBSCURA Case reviews whole mailboxes at once, with threads, near-duplicates and a who-wrote-to-whom view. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.