Messages in this thread | | | From | David Howells <> | Subject | Re: sign-file and detached PKCS#7 firmware signatures | Date | Tue, 19 May 2015 17:48:57 +0100 |
| |
Luis R. Rodriguez <mcgrof@suse.com> wrote:
> > Something like: > > > > openssl smime -verify \ > > -in $PKCS7_MESSAGE_FILE_IN_DER_FORM \ > > -inform DER \ > > -content $FIRMWARE_BLOB_NAME \ > > -inkey $PRIVATE_KEY_FILE_IN_PEM_FORM \ > > -signer $X509_CERT_FILE_IN_PEM_FORM > > > > I would guess. > > I tried a few things and no luck with that.
Try this:
openssl smime -verify \ -in $PKCS7_MESSAGE_FILE_IN_DER_FORM \ -inform DER \ -certfile $X509_CERT_FILE_IN_PEM_FORM \ -content $FIRMWARE_BLOB_NAME \ -binary \ -noverify \ >/dev/null
Seems using -signer with -verify isn't a good idea as -signer refers to an output file during verification just for the surprise factor.
David
| |