OPENSSL-PKCS7(1ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💅 NAME 💅

openssl-pkcs7 — the PKCS#7 command, bestie. That's the whole vibe.

This is the OpenSSL manual page for it, and yes I'm gonna walk you through every single flag because you deserve to know.

✨ SYNOPSIS ✨

openssl pkcs7 [-help] [-inform DER|PEM] [-outform DER|PEM] [-in
filename] [-out filename] [-print] [-print_certs] [-quiet] [-text]
[-noout] [-engine id] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq]

That's your whole toolkit right there, no cap. 🎀

🦋 DESCRIPTION 🦋

Okay so here's the tea: this command processes PKCS#7 files. That's its whole personality.

But lowkey important caveat — it only understands PKCS#7 v 1.5 as specified in IETF RFC 2315. And it cannot currently parse CMS as described in IETF RFC 2630. So don't come at it with CMS content and expect main character energy, because it will simply not. 😭

🌸 OPTIONS 🌸

  • -help — prints out a usage message. Your classic "wait what do I do" button, we stan. 🫶
  • -inform DER|PEM, -outform DER|PEM — the input and formats; the default is PEM. Peep openssl-format-options(1) for the details, bestie.

And the data here is a PKCS#7 Version 1.5 structure. That part's non-negotiable. 💅

  • -in filename — tells it which input filename to read from. If you don't specify it, it just pulls from standard input. Default behavior, slay.
  • -out filename — the output filename to write to. Don't set it and it goes to standard output by default. Easy.
  • -print — prints out the full PKCS7 object. Everything. The whole thing. Iconic.
  • -print_certs — prints out any certificates or CRLs contained in the file, and they're preceded by their subject and issuer names in one line format. Very organized, very demure. ✨
  • -quiet — when used with -print_certs, it prints out just the PEM-encoded certificates without any other output. Minimalist queen behavior, honestly. 🤫
  • -text — prints out certificate details in full rather than just subject and issuer names. So like, the deluxe version. 🔥
  • -noout — don't output the encoded version of the PKCS#7 structure (or certificates if -print_certs is set). Big "I saw it, I don't need to keep it" energy.
  • -engine id — see "Engine Options" in openssl(1).
Heads up bestie: this option is deprecated. It's giving legacy, and not in the cute vintage way. 💀
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq

All four of these? See "Provider Options" in openssl(1), provider(7), and property(7). They're the provider squad and they roll together. 🌈

🧚 EXAMPLES 🧚

Convert a PKCS#7 file from PEM to DER — the classic glow-up:

openssl pkcs7 -in file.pem -outform DER -out file.der

Output all certificates in a file — collect them all like it's a scavenger hunt:

openssl pkcs7 -in file.pem -print_certs -out certs.pem

Both of these ate, fr fr. 👑

👑 SEE ALSO 👑

openssl(1), openssl-crl2pkcs7(1)

Go read those too, iykyk. 📚

⭐ HISTORY ⭐

The -engine option was deprecated in OpenSSL 3.0. R.I.P. to a real one (affectionate). 🕯️

Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

✨ That's the whole page, bestie — version 3.5.6, dated 2026-04-07, OpenSSL manual page for OPENSSL-PKCS7(1ossl). Go forth and pkcs7 responsibly. 💜🎀🦋

📦 where this page comes from