CLSMIME(1)

💖 CLSMIME 💖 (the manual, section 1)

okay bestie, welcome to CLSMIME(1) — it ships with Cryptlib Tools, and it's literally the S/MIME public key encryption tool that plays nice with Thunderbird, Evolution, Outlook and OpenSSL. yes, all of them. she's versatile. 💅

---

🎀 NAME 🎀

clsmime — the S/MIME public key encryption tool that interoperates with Thunderbird, Evolution, Outlook and OpenSSL. no cap, she talks to everybody. 💖

---

✨ SYNOPSIS ✨

here's the shape of her, five whole moods:

clsmime [OPTIONS] encrypt messagefile certificate

clsmime [OPTIONS] decrypt encrypted_message KeysetName

clsmime [OPTIONS] sign messagefile KeysetName

clsmime [OPTIONS] verify signed_message [CArootCertificate]

clsmime [OPTIONS] list [<NumLines>] MessageFile

---

🦋 DESCRIPTION 🦋

okay so here's the tea. 🍵

clsmime encrypt takes text or binary data and locks it up with a RSA public key that lives inside the recipient's certificate file. it's giving "sealed envelope, but make it cryptography". 💌

clsmime decrypt and clsmime sign work with S/MIME data using a RSA private key that's stored in a *.p15 keyset file. and guess what — those RSA public and private keys hanging out in your *.p15 keyset file can be generated and managed with clkeys. teamwork, honestly. 🫶

clsmime verify checks S/MIME signatures that come with enclosed certificates. the signer's certificate gets checked against an optional issuer CA certificate, and that CA certificate is treated as a trusted CA root certificate. very official, very demure.

and the best part? those encrypted and/or signed S/MIME message files you make can be swapped with either OpenSSL or any email client that knows how to process S/MIME messages — think Thunderbird, Evolution or MS Outlook. ✨

---

👑 OPTIONS 👑

• -help — shows you this help and dips out. bye! 👋
• -version — spits out version information and exits.
• -debug — prints debugging information to stderr. detective mode, activate. 🔍
• -detach — generates a detached signature in S/MIME format as multipart/signed. (the default is a signature that includes the enclosed text message, jsyk.)
• -integritycheck — forces integrity protection while encrypting data. the cryptogram gets enveloped in an authEnvelopedData object that cannot be decrypted with OpenSSL. 😭 use this option when the output data is going to be processed with clsmime itself. iykyk.
• -binary — do not change the input bytes (the default is text mode).

okay so in text mode, all '\n' get replaced by '\r\n', and a Content-Type header gets added in front of the input bytes before the message is signed. then when clsmime verifies a signed message, that Content-Type header and the extra '\r' characters get removed after verification. so the verification bytes that get stored into the file system match the original text message. 💖 balance restored.

• -certchain — writes the certificate chain to the file system while verifying a S/MIME signature. 💅

---

🌈 INTEROPERABILITY 🌈

📧 S/MIME capable E-mail clients (Thunderbird, Evolution, Outlook)

• Thunderbird or Evolution: import the CA certificate (into the CA section) before you import a user's certificate (into the person section). order matters, bestie, don't skip steps. 🙈
• Microsoft Outlook: use the contacts tab to enter the Common Name and the email address, then finally click on the 'certificate button' to import the contact's certificate stored in a *.cer file. slay.

🔐 OpenSSL

these OpenSSL commands can be used to exchange message files with clsmime:

Encryption   :
openssl smime -encrypt -aes-256-cbc -in message -binary -out message.smime certfile

Decryption   :
openssl smime -decrypt -in message  -out message.clear -recip cert -inkey RSAkey

Signing      :
openssl smime -sign -in message -text -signer cert -inkey RSAkey -out message.sig

Verification :
openssl smime -verify -in message -out message.verified -inkey certfile -CAfile CAcert

CertChains can be examined with:

sed -i ´s/CERTIFICATE CHAIN/PKCS7/´ certchain ; openssl pkcs7 -in certchain -text -print_certs

---

📝 NOTES 📝

• full documentation lives at https://senderek.ie/cryptlib/tools ✨
• this program depends on two packages: the one providing the cryptlib shared object library, and the python3-bindings to that library.
• you can download both packages in RPM or DEB format at https://senderek.ie/cryptlib/
• using FEDORA, you can install the packages cryptlib and cryptlib-python3 directly from the repository. convenient much? 💅
• in addition, the program /bin/systemd-ask-password is needed to read sensible data from stdin. that program is part of the systemd package. 🫶

---

🗂️ FILES 🗂️

• /usr/bin/systemd-ask-password — this program is used to provide the passphrase based on a user's input. 🔑
• /usr/bin/dumpasn1 — this program is used to list the ASN1 structure of output files.
• /lib64/libcl.so.3.4.9 — the cryptlib library. the icon herself. 👑
• /usr/lib/python3.1x/site-packages/cryptlib_py.so — bindings to the cryptlib library used by python3.

---

💀 BUGS 💀

please report bugs to innovation@senderek.ie — be nice, they're doing their best. 🙈

---

🧚 AUTHORS 🧚

• clsmime is written by Ralf Senderek <innovation@senderek.ie>. 🎀
• Cryptlib is written and maintained by Peter Gutmann <pgut001@cs.auckland.ac.nz>. legends, both of them. 👑

---

💜 COPYRIGHT 💜

Copyright © 2024 - 2026 Ralf Senderek. All rights reserved.

License BSD-3-Clause: https://senderek.ie/cryptlib/bsd.html. this is free software: you are free to change and redistribute it. there is NO WARRANTY, to the extent permitted by law. (yes, all caps. they mean it. 😭)

---

👀 SEE ALSO 👀

cryptlib, clkeys, claes, clrsa

---

and that's the whole page, bestie — CLSMIME(1), straight out of Cryptlib Tools, dated February 2026. go encrypt something. 💖✨🦋