CMS Signed or Encrypted Container
Certificates & KeysP7M is used for CMS-style signed/encrypted containers. Names such as document.pdf.p7m can indicate an original document, but not every payload is PDF. Distinguish extraction, signature verification and decryption.
- Main use
- Encapsulate signed or encrypted content
- Data type
- Binary data
All sections, questions and sources
Content reviewed： · Editor：Kai
Opening steps
Choose your environment or purpose to see its steps.
Menu labels and support vary by app, OS and version. Preserve the original before making changes.
Troubleshooting by symptom
- PDF reader rejects it: process the container with suitable tools first.
- Extraction works but verification fails: content extraction is separate from signature validity.
- Certificate error: inspect chain/time and relevant validation conditions.
- Cannot decrypt: inspect recipient keys/certificates and delivery conditions.
P7M → copy of encapsulated content
- Identify type and perform required verification/decryption before extracting separately.
- Verify payload type, signer, verification results and original-retention requirements.
The extracted document alone does not retain its original signed container; preserve P7M and verification records as required.
Readable content is not verified content
Extractable content need not pass signature/certificate validation. Bypassing verification is not evidence of validity; establish the recipient’s validation requirements.
Source for these steps：IETF · RFC 5652: Cryptographic Message Syntax / OpenSSL project · openssl-cms
Worked example: checks before handoff
Example: retain a PDF-bearing P7M, inspect signer/results and manage the extracted PDF as a derivative viewing copy.
Source for these steps：IETF · RFC 5652: Cryptographic Message Syntax / OpenSSL project · openssl-cms
Related-format differences
| Format / method | Purpose and preserved information |
|---|---|
| .p7m | Encapsulate signed or encrypted content |
| PDF / P7S | PDF is document content; P7S is used for signatures, with container conditions inspected separately. |
| P7M → copy of encapsulated content | The extracted document alone does not retain its original signed container; preserve P7M and verification records as required. |
Handling and security
Do not send private keys to conversion sites; preserve signed originals and use trusted tooling.
Questions and answers
How does P7S differ?
P7S often appears as detached signatures, but inspect actual structure rather than infer solely from the suffix.
Is every P7M a PDF?
No; inspect the actual encapsulated content type.
Can skipping verification establish validity?
Readable output with checks skipped is not verified validity; satisfy the required signature/certificate checks.
Format facts: name, steward and MIME type
- Formal name
- CMS Signed or Encrypted Container
- Steward / specification
- IETF
- MIME type
- Consult the producer or delivery system. The extension alone does not establish a MIME type.
Primary and official sources
- StandardRFC 5652: Cryptographic Message Syntax
CMS structures for signatures, encryption and encapsulated content.
IETF · Link checked： - Software documentationopenssl-cms
CMS inspection, signature verification and decryption requirements.
OpenSSL project · Link checked：