Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having problems verifying some S/MIME messages in Mutt.

First some background

$ mutt -v
Mutt 1.5.21 (2010-09-15)
Copyright (C) 1996-2009 Michael R. Elkins and others.
Mutt comes with ABSOLUTELY NO WARRANTY; for details type `mutt -vv'.
Mutt is free software, and you are welcome to redistribute it
under certain conditions; type `mutt -vv' for details.

System: Linux (i686)
ncurses: ncurses 5.8.20110319 (compiled with 5.8)
libidn: 1.19 (compiled with 1.19)
hcache backend: tokyocabinet 1.4.46
Compile options:
To contact the developers, please mail to <>.
To report a bug, please visit

And Openssl: OpenSSL 1.0.0e-fips 6 Sep 2011

I'm using the smime.rc bundled with Mutt.

On to the problem

[-- OpenSSL output follows (current time: Mon 26 Sep 2011 01:07:18 PM CDT) --]
Verification failure 30686:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:245:Verify error:unable to get issuer certificate
[-- End of OpenSSL output --]

AFAIK, this happens when the certificate belonging to the CA that signed the email sender's certificate isn't in .smime/ca-bundle.crt

So, to work the problem further, I locate the certificate that belongs to this person, already grabbed from Mutt using ^K:

$ openssl x509 -in 5c400f68.0 -subject -issuer -out /dev/null
subject= /C=US/O=U.S. Government/OU=ECA/OU=VeriSign, Inc./OU=**REDACTED**/CN=**REDACTED**
issuer= /C=US/O=U.S. Government/OU=ECA/OU=Certification Authorities/CN=VeriSign Client External Certification Authority - G2

I seem to have the certificate in my roots file:

$ grep 'VeriSign Client External Certification Authority - G2'  ca-bundle.crt 
Subject: C=US, O=U.S. Government, OU=ECA, OU=Certification Authorities, CN=VeriSign Client External Certification Authority - G2
share|improve this question
Does running openssl verify on the grabbed certificate provide more details? Is the issuer certificate in your roots file expired or otherwise invalid? Does mutt generally decode S/MIME correctly for other users? – P.T. Sep 29 '11 at 18:53

You must log in to answer this question.

Browse other questions tagged .