OPENSSL-PKCS7(1ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💅 OPENSSL-PKCS7 💅

ok so this is the openssl pkcs7 page — the PKCS#7 command, in the 1ossl manual. yes bestie, we're doing crypto file formats today, grab a snack 🍓

✨ SYNOPSIS ✨

openssl pkcs7 [-help] [-inform DER|PEM] [-outform DER|PEM] [-in
filename] [-out filename] [-print] [-print_certs] [-quiet] [-text]
[-noout] [-engine id] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq]

🌸 DESCRIPTION 🌸

This command processes PKCS#7 files. literally its whole job 💖

ok but here's the vibe check: it only understands PKCS#7 v 1.5, as specified in IETF RFC 2315. and it cannot currently parse CMS as described in IETF RFC 2630 — like, not at all, don't even try, it's giving "not my era" 😭

🎀 OPTIONS 🎀

  • -help — prints out a usage message. classic, iconic, always there for u 🫶
  • -inform DER|PEM, -outform DER|PEM — the input and formats; the default is PEM. see openssl-format-options(1) for details. and for the record: the data is a PKCS#7 Version 1.5 structure. no cap.
  • -in filename — this specifies the input filename to read from, or standard input if this option is not specified. no filename? it just vibes with stdin 💅
  • -out filename — specifies the output filename to write to, or standard output by default.
  • -print — print out the full PKCS7 object. the whole thing. the full meal 🍓
  • -print_certs — prints out any certificates or CRLs contained in the file. they are preceded by their subject and issuer names in one line format. cute and compact ✨
  • -quiet — when used with -print_certs, prints out just the PEM-encoded certificates without any other output. lowkey, minimal, main character energy 👑
  • -text — prints out certificate details in full rather than just subject and issuer names. the director's cut 🎬
  • -noout — don't output the encoded version of the PKCS#7 structure (or certificates if -print_certs is set). like, hold the output. respectfully 🙈
  • -engine id — see "Engine Options" in openssl(1). ⚠️ heads up bestie: this option is deprecated. it's giving legacy.
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). provider lore goes deep, iykyk 🧚

🌈 EXAMPLES 🌈

convert a PKCS#7 file from PEM to DER:

openssl pkcs7 -in file.pem -outform DER -out file.der

output all certificates in a file:

openssl pkcs7 -in file.pem -print_certs -out certs.pem

slay. go off. 🔥

🦋 SEE ALSO 🦋

openssl(1), openssl-crl2pkcs7(1)

💜 HISTORY 💜

the -engine option was deprecated in OpenSSL 3.0. we remember. 😭

Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ok that's the whole page, no skips, no summaries, we ate and left no crumbs 💅

and finally, the lil sign-off: this is OpenSSL 3.5.9, dated 2026-09-29, and it lives in OPENSSL-PKCS7(1ossl) — stan. 🎀💖✨

📦 where this page comes from