openssl pkcs7 - get the data only

Question

I have a PKCS7-signed file in DER format, pkcs_input, and I want to extract the data out of it.

Running the command: openssl pkcs7 -in pkcs_input -inform DER -print results in the following output:

PKCS7:
  type: pkcs7-signedData (1.2.840.113549.1.7.2)
  d.sign:
    version: 1
    md_algs:
        [...]
    contents:
      type: pkcs7-data (1.2.840.113549.1.7.1)
      d.data:
        0000 - [hex data]   [ASCII data]
        [...]
    cert:
        cert_info:
          [...]

And then, in order to get the data (marked with [ASCII data]) out of this output, I have to manually parse the entire output.

Is there any other way to get the data only?

Answer 1

The pkcs7 command is mostly intended to give informations on the pkcs7 structure and the certificates it contains.
So to extract the content inside the pkcs7, you need to use instead the smime command :

 openssl smime -verify -CAfile chain_root.pem -in pkcs_input -inform DER -out content

If for some reason, you wish to extract the content without verification, you need to add -noverify after -verify:

 openssl smime -verify -noverify -in pkcs_input -inform DER -out content