SMIME(3pm)

💖 NAME 💖

okay bestie, welcome to the SMIME(3pm) page!! 💅 this whole thing is about Crypt::SMIME — S/MIME message signing, verification, encryption and decryption. no cap.

✨ SYNOPSIS ✨

use Crypt::SMIME;

my $plain = <<'EOF';
From: alice@example.org
To: bob@example.com
Subject: Crypt::SMIME test

This is a test mail. Please ignore...
EOF

my $smime = Crypt::SMIME->new();
$smime->setPrivateKey($privkey, $crt);
# $smime->setPublicKey([$icacert]); # if need be.

my $signed = $smime->sign($plain);
print $signed;

---

🦋 DESCRIPTION 🦋

This module provides a class for handling S/MIME messages. It can sign, verify, encrypt and decrypt messages. It requires libcrypto (http://www.openssl.org). periodt.

---

🎀 EXPORTS 🎀

No symbols are exported by default, bestie. But these symbols can optionally be exported:

• NO_CHECK_CERTIFICATE — see check().
• CRL_CHECK, CRL_CHECK_ALL — see setVerifyFlags().
• FORMAT_SMIME, FORMAT_ASN1, FORMAT_PEM — see extractCertificates().
• :constants — exports all of the above. the whole lil squad 💖

---

💅 METHODS 💅

🌸 new() 🌸

my $smime = Crypt::SMIME->new();

The constructor takes no arguments. zero, zilch, none — it's giving minimal queen energy.

🔥 setPrivateKey() 🔥

$smime->setPrivateKey($key, $crt);
$smime->setPrivateKey($key, $crt, $password);

Store a private key and its X.509 certificate into the instance. The private key will be used for signing and decryption. Note that this method takes a PEM string, not a name of a file which contains a key or a certificate. like, it wants the actual PEM string, not a filename, okay??

The private key and certificate must be encoded in PEM format. The method dies if it fails to load the key. it literally dies 😭

🦋 setPrivateKeyPkcs12() 🦋

$smime->setPrivateKeyPkcs12($key, $pkcs12);
$smime->setPrivateKeyPkcs12($key, $pkcs12, $password);

Load a private key and its X.509 certificate from PKCS#12 into the instance. The private key will be used for signing and decryption. The method dies if it fails to load PKCS12. tragic.

💜 setPublicKey() 💜

$smime->setPublicKey($crt);
$smime->setPublicKey([$crt1, $crt2, ...]);

Store one or more X.509 certificates into the instance. The public keys will be used for signing, verification and encryption.

The certificates must be encoded in PEM format. The method dies if it fails to load the certificates. sad but true.

✨ setPublicKeyStore() ✨

$smime->setPublicKeyStore($path, ...);

Set the paths of file or directory containing trusted certificates. The certificate stores will be used for verification.

The method dies if it fails to load the certificate stores. 💀

🌈 sign() 🌈

$signed_mime = $smime->sign($raw_mime);

Sign a MIME message and return an S/MIME message. The signature is always detached. always. no exceptions.

Any headers except Content-*, MIME-* and Subject will be moved to the top-level of the MIME message. Subject header will be copied to both of the plain text part and the top-level for mail clients which can't properly handle S/MIME messages. doing it for the girlies with old mail clients.

The resulting message will be tainted if any of the original MIME message, the private key or its certificate is tainted.

🍓 signonly() 🍓

$sign = $smime->signonly($prepared_mime);

Generate a signature from a MIME message. The resulting signature is encoded in Base64. The MIME message to be passed to this method should be preprocessed beforehand by the prepareSmimeMessage() method. You would rarely need to call this method directly. like, almost never, bestie.

The resulting signature will be tainted if any of the original MIME message, the private key or its certificate is tainted.

🧚 prepareSmimeMessage() 🧚

($prepared_mime, $outer_header)
    = $smime->prepareSmimeMessage($source_mime);

Preprocess a MIME message to be signed. $prepared_mime will be a string containing the processed MIME message, and $outer_header will be a string that is a list of headers to be moved to the top-level of MIME message. You would rarely need to call this method directly.

The entity body of $source_mime will be directly copied to $prepared_mime. Any headers of $source_mime except Content-*, MIME-* and Subject will be copied to $prepared_mime, and those excluded headers will be copied to $outer_header. Note that the Subject header will be copied to both side exceptionally. that's the special lil exception 💖

👑 check() 👑

use Crypt::SMIME qw(:constants);

$source_mime = $smime->check($signed_mime);
$source_mime = $smime->check($signed_mime, $flags);

Verify a signature of S/MIME message and return a MIME message. The method dies if it fails to verify it. oh she's strict.

When the option Crypt::SMIME::NO_CHECK_CERTIFICATE is given as $flags, the signer's certificate chain is not verified. The default value for $flags is 0, which performs all the verifications.

The resulting message will be tainted if the original S/MIME message, the $flags, verification time (setAtTime()) or at least one of the provided public keys are tainted.

💖 encrypt() 💖

$encrypted_mime = $smime->encrypt($raw_mime);
$encrypted_mime = $smime->encrypt($raw_mime, $cipher);

Encrypt a MIME message and return a S/MIME message. You can pass any $cipher string your OpenSSL library understands. Default is AES-128-CBC.

Any headers except Content-*, MIME-* and Subject will be moved to the top-level of the MIME message. Subject header will be copied to both of the plain text part and the top-level for mail clients which can't properly handle S/MIME messages.

The resulting message will be tainted if the original MIME message or at least one public key is tainted.

🔐 decrypt() 🔐

$decrypted_mime = $smime->decrypt($encrypted_mime);

Decrypt an S/MIME and return a MIME message. This method dies if it fails to decrypt it. no thoughts, just death.

The resulting message will be tainted if any of the original S/MIME message, the private key or its certificate is tainted.

🕵️ isSigned() 🕵️

$is_signed = $smime->isSigned($mime);

Return true if the given string is a signed S/MIME message. Note that if the message was encrypted after signing, this method returns false because in that case the signature is hidden in the encrypted message. sneaky lil signature.

🕵️ isEncrypted() 🕵️

$is_encrypted = $smime->isEncrypted($mime);

Return true if the given string is an encrypted S/MIME message. Note that if the message was signed with non-detached signature after encryption, this method returns false because in that case the encrypted message is hidden in the signature. the plot twist.

⏰ setAtTime() ⏰

$yesterday = time - (60*60*24);
$smime->setAtTime($yesterday);

Set the time to use for verification. Default is to use the current time. Must be an unix epoch timestamp. no time zones, just epoch vibes.

🚩 setVerifyFlags() 🚩

$smime->setVerifyFlags(C<Crypt::SMIME::CRL_CHECK>);

Set flags used for verification. Crypt::SMIME::CRL_CHECK check CRL for signer certificates Crypt::SMIME::CRL_CHECK_ALL check CRL for whole certificate chain. Verification fails if a required CRL is not found. so if the CRL ghosted you, it's over.

---

🎁 FUNCTIONS 🎁

📜 extractCertificates() 📜

use Crypt::SMIME qw(:constants);

@certs = @{Crypt::SMIME::extractCertificates($data)};
@certs = @{Crypt::SMIME::extractCertificates($data, FORMAT_SMIME)};

Get all X.509 certificates (and CRLs, if any) included in S/MIME message or PKCS#7 object $data. Optional $type parameter may specify type of data: Crypt::SMIME::FORMAT_SMIME (default) for S/MIME message; Crypt::SMIME::FORMAT_ASN1 for binary format; Crypt::SMIME::FORMAT_PEM for PEM format.

🖊️ getSigners() 🖊️

@certs = @{Crypt::SMIME::getSigners($data)};
@certs = @{Crypt::SMIME::getSigners($data, $type)};

Get X.509 certificates of signers included in S/MIME message or PKCS#7 object. Optional $type parameter may specify type of data.

Note that any public keys returned by this function are not verified. check() should be executed to ensure public keys are valid. don't just trust, verify. 💅

🌟 getCapabilities() 🌟

@caps = @{Crypt::SMIME::getCapabilities($data)};
@caps = @{Crypt::SMIME::getCapabilities($data, $type)};

Get the S/MIME Capabilities included in S/MIME message or PKCS#7 object. Optional $type parameter may specify type of data.

This may include both, ciphers and hash algorithms. the whole menu.

---

💌 AUTHOR 💌

Copyright 2006-2014 YMIRLINK Inc. All Rights Reserved.

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

Bug reports and comments to: tl@tripletail.jp

---

and that's the whole page bestie!! this was SMIME(3pm), from perl v5.42.3, dated 2026-08-20. mwah 💋 go sign something iconic.