Hey there! Have you ever gotten an email with a strange attachment called S/MIME.p7s? If so, you‘re not alone – and don‘t worry, it‘s nothing malicious. These cryptic .p7s files are actually quite harmless.
In this guide, I‘ll explain exactly what S/MIME.p7s files are, why they get attached to emails, and how you can open them. I‘ll also dig deeper into how S/MIME email encryption works, who uses it, and alternatives like PGP.
By the end, you‘ll understand everything about these mysterious .p7s files and even be able to decode them yourself. So let‘s get started!
What is a S/MIME.p7s File?
First things first – a S/MIME.p7s file contains the digital signature of an email message that was signed using the S/MIME standard.
S/MIME stands for Secure/Multipurpose Internet Mail Extensions. It‘s an encryption method used to digitally sign and/or encrypt MIME data.
MIME (Multipurpose Internet Mail Extensions) is the standard format for email content like text, images, audio, video, and attachments. It allows non-textual data to be included in email messages.
So in simple terms, S/MIME provides a way to cryptographically sign and encrypt MIME-formatted emails and data using public key encryption.
The .p7s extension stands for PKCS #7, which is the standard format for cryptographic messages like digital signatures and encrypted data.
What Does a S/MIME.p7s File Contain?
When you open a S/MIME.p7s file, you‘ll see plain text including:
- The email subject line
- Name of the sender
- The sender‘s digital signature (usually their email address)
- A note saying the signed email content is authentic
So in summary, a .p7s file provides proof that the associated email came from the stated sender and has not been altered in any way during transmission.
According to a 2022 survey by DataGrail, over 72% of security professionals say email is the top source of data breaches. S/MIME signatures help mitigate this risk by verifying authenticity.
Why Are S/MIME.p7s Files Attached to Emails?
Ideally, S/MIME digital signatures should be seamlessly integrated into the encrypted email message. However, this only works if both the sender‘s and recipient‘s email clients fully support S/MIME.
If your email app doesn‘t support S/MIME signatures, the sending server has to detach the signature and send it as a .p7s file attachment instead.
Common cases where you might receive an attached S/MIME.p7s file include:
-
Your email service does not have native S/MIME support. This includes most free consumer email providers.
-
You are communicating with someone outside your company who uses S/MIME-signed emails. Their signature gets detached when sent to your unsupported account.
-
You switched email providers or clients, and lost S/MIME support in the process.
According to a 2022 report by Terranova Security, only 28% of organizations use S/MIME email encryption, down from 40% in 2020. As S/MIME usage declines, more detached .p7s files are likely to show up unintentionally.
How S/MIME Email Signing Works
To really understand why these .p7s files get attached, it helps to know how S/MIME digitally signs emails in the first place.
S/MIME uses asymmetric cryptography, also known as public key cryptography. This involves a pair of keys – a private key and a public key.
Here‘s how it works when sending a signed email:
-
The sending email client uses a hash algorithm to create a unique fingerprint of the message content called a message digest.
-
This message digest is then encrypted with the sender‘s private key to create the digital signature.
-
The digital signature is attached to the email message.
-
The email is transmitted.
Once received, the recipient can verify the signature to validate the email‘s authenticity:
-
The digital signature is decrypted using the sender‘s public key.
-
A new message digest is generated from the received email content.
-
The decrypted digest is compared to the newly calculated one.
-
If they match, the signature is valid!
This proves the email truly came from the expected sender and was not modified. If the message had changed in any way, the digests would not match.
How to Open & Read a S/MIME.p7s File
Now that you understand what S/MIME.p7s files contain and why you may get them, let‘s look at a few ways to open and view the information inside them.
Double Click the .p7s File
The easiest approach is to simply save the .p7s attachment from your email to your computer, then double click to open it.
On Windows, it will typically open in Notepad or Wordpad. On a Mac, it may open in TextEdit.
You‘ll then see the plain text digital signature data, including the sender‘s email address and other details.
Use OpenSSL
One of the most common tools for examining S/MIME files is OpenSSL, an open source cryptographic toolkit.
To view a .p7s file in OpenSSL:
-
Save the .p7s attachment from your email to your computer.
-
Open the OpenSSL command prompt on your machine.
-
Type the following command:
openssl pkcs7 -in [S/MIME.p7s file] -print_certs -text -noout- OpenSSL will parse and print out the contents of the .p7s digital signature for you to examine!
Import into GPG
GPG (GNU Privacy Guard) is another encryption app that can handle S/MIME files.
To view a .p7s file in GPG:
-
Save the .p7s attachment from your email.
-
Import it into GPG:
gpg --import [S/MIME.p7s file]- View signature info:
gpg --list-packets [S/MIME.p7s file]This will display details like the signature timestamp, encryption algorithm used, signer‘s name, and more.
Use a S/MIME Viewer Tool
There are various utility apps designed specifically for parsing and displaying S/MIME certificates and signatures.
For example, Portecle is a handy open source Java tool that can open, verify, and visually inspect .p7s and other S/MIME file types.
So in summary, you have several options for decoding those cryptic .p7s files – no advanced IT skills required!
Which Emails Clients Support S/MIME?
For the smoothest S/MIME experience, it helps to use an email service with built-in support. Here are some of the most popular platforms and their S/MIME capabilities:
-
Microsoft Outlook – Outlook has native S/MIME support and seamlessly handles signing/encryption when communicating with other Outlook users. But signatures get detached to .p7s files when emailing non-Outlook recipients.
-
Gmail – S/MIME must be manually enabled by G Suite admins and only works fully when emailing other S/MIME-enabled Gmail accounts.
-
Apple Mail – Has built-in S/MIME capabilities, but can only sign/encrypt mails between Apple Mail users who also have it configured.
-
Mozilla Thunderbird – Requires installing an add-on to activate S/MIME functionality.
-
Mobile Apps – Native email apps on iOS and Android do not support S/MIME.
-
Webmail Services – Besides Gmail, most other webmail providers like Outlook.com and Yahoo Mail do not offer integrated S/MIME features.
So in general, smoothly handling S/MIME emails requires using a large enterprise email client like Outlook or G Suite Gmail. Consumer services will often detach signatures as .p7s files instead.
According to a study by 1010data, Outlook dominates the enterprise email market with over 80% market share as of 2021.
Who Uses S/MIME Security?
Given the client support limitations, S/MIME is used mainly by large government and corporate entities to secure sensitive communications:
-
Governments – Government departments use S/MIME to encrypt confidential emails in compliance with regulations. A 2020 survey of US federal government cybersecurity found that 68% use S/MIME certification for emails.
-
Healthcare – To protect patient health information (PHI), hospitals and insurance providers implement S/MIME for emails.
-
Banks & Finance – Financial firms rely on S/MIME encryption to prevent data breaches and fulfill compliance mandates. In one survey, over 75% of finance industry respondents said they use S/MIME.
-
Law Firms – Legal services use S/MIME to safely exchange privileged client information and documentation.
-
Other Large Enterprises – Any big corporate, academic, or nonprofit entity that routinely communicates sensitive data can benefit from S/MIME.
Individuals and smaller groups generally use PGP instead due to wider device and platform support. But S/MIME remains the top choice for securing huge volumes of enterprise emails.
S/MIME vs PGP Encryption
S/MIME and PGP are the two leading standards used for email encryption today:
| S/MIME | PGP |
| Relies on centralized certificate model | Uses web-of-trust decentralized model |
| X.509 certificates | OpenPGP keys |
| Common in businesses | Popular for personal use |
| Built-in support in Outlook | Supported on all major platforms |
Similarities:
- Both use public key cryptography for encrypting and signing
- Allow sender authentication
- Provide message confidentiality and integrity
Differences:
- S/MIME relies on certificate authorities (CAs) while PGP uses direct key exchanges
- PGP messages can be decrypted decades later while S/MIME keys may expire
- PGP users directly exchange public keys, CAs centrally manage S/MIME public keys
In summary, S/MIME is best suited for large enterprises while PGP suits smaller groups and individuals. Both are secure when properly implemented.
According to a 2022 survey of IT professionals by Enterprise Management Associates, 46% said they use S/MIME encryption while only 19% use PGP. However, PGP usage increased by 5% versus a 6% decline for S/MIME.
Final Thoughts
Hopefully this guide has demystified those cryptic S/MIME.p7s email attachments!
While their sudden appearance may be confusing at first, .p7s files are quite harmless and serve an important function – validating the authenticity of S/MIME signed messages.
Now that you understand what they contain and why they get attached, you can confidently decode these digital signatures using tools like OpenSSL or online S/MIME viewers.
For the best experience with signed/encrypted emails, using an enterprise-grade email client with native S/MIME support is ideal. Large organizations rely on it to secure confidential communications and prevent data breaches.
Alternatives like PGP encryption provide similar protection and are easier for average users to implement.
But whichever system is used, properly validating digital signatures is essential to ensure emails are authentic and have not been compromised. S/MIME.p7s attachments provide a way to transport that validation data even when the recipient‘s client doesn‘t fully support S/MIME.
So next time you see one of those strange .p7s files pop up unexpectedly, you‘ll know exactly what it means and why it‘s there. Mystery solved!