Cisco Catalyst 2960 Series, Configuration Manual

Page: 1913 / 2288

Example:
Host% ls -l
total 40
-rw-r--r--
1 janedoe eng12 1659 Jun 12 15:01 cert.pem
-rw-r--r-- 1 janedoe eng12 115 Jun 13 10:16 hello
-rw-r--r-- 1 janedoe eng12 1876 Jun 13 10:16 hello.pk7
-rw-r--r-- 1 janedoe eng12 1679 Jun 12 14:55 privkey.pem
-rw-r--r-- 1 janedoe eng12 451 Jun 12 14:57 pubkey.pem
The hello.pk7 file contains the signed Tcl file created by the
openssl smime
command from the unsigned Tcl file named
hello and using the X.509 certificate in the cert.pem file.
Verifying the Signature
Perform this task to verify that the signature matches the data, use the openssl smime command with the
-verify
keyword. The original Tcl content must be provided in the input file, because the file does not have
the original content.
SUMMARY STEPS
1.
openssl smime -verify -in signed-tcl-file -CAfile certificate-file -inform DER -content tcl-file
2.
ls -l
DETAILED STEPS
Step 1
openssl smime -verify -in signed-tcl-file -CAfile certificate-file -inform DER -content tcl-file
This command verifies the signed Tcl file stored in DER PKCS#7 format in signed-tcl-file using the trusted Certificate
Authority (CA) certificates in certificate-file and then writes the detached content to the file tcl-file .
The following example shows how to verify the signature with the input file hello.pk7:
Example:
Host%
openssl smime -verify -in hello.pk7 -CAfile cert.pem -inform DER -content hello
puts hello
puts "argc = $argc"
puts "argv = $argv"
puts "argv0 = $argv0"
puts "tcl_interactive = $tcl_interactive"
Verification successful
The SSL command page describes -in filename as the input message to be encrypted or signed or the MIME
message to be decrypted or verified. For more information, go to http://www.openssl.org/ .
Note
Step 2
ls -l
This command displays detailed information about each file in the current directory, including the permissions, owners,
size, and when last modified.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1831
How to Configure Signed Tcl Scripts