smime.p7m: what it is and how to open it

Quick answer

1. First try your mail app: open the message in its own window (double-click it) instead of the reading pane or conversation view. Microsoft documents this step for S/MIME messages in Outlook, and it is often all it takes.
2. If you still only see smime.p7m, save that attachment (or the whole message as .eml) and drop it on the box above.
3. Signed message: ApriP7M shows the text, lists the attachments with a Download button each, checks that the content was not changed after signing, and offers the unwrapped message as smime.eml.
4. Encrypted message: only the recipient’s private key can open it. Read it in the mail app where your certificate is installed (often a work PC or a smart card), or ask the sender to resend it another way.

What smime.p7m actually is

S/MIME is the standard way to sign and encrypt e-mail with certificates (RFC 8551). It can package a message in two ways, and the file name tells you which one you are looking at:

What you see	What it is	Readable without S/MIME?
smime.p7m, signed-data	“Opaque” signing: text, attachments and signature packed together in one CMS container	Not in the mail app — but the content is not secret. ApriP7M or OpenSSL can unpack it.
smime.p7m, enveloped-data	Encryption: the message is encrypted for each recipient’s certificate	No. Only with the recipient’s private key.
smime.p7s	“Clear” signing: the message stays normal, the signature travels as a small separate attachment	Yes. The text and attachments display normally; smime.p7s is only the signature.

So smime.p7m is never “the attachment” in the usual sense. The PDF, spreadsheet or photo the sender attached is inside it.

Why your mail app shows smime.p7m

• The app or account has no S/MIME support. Microsoft notes that both sender and recipient need a mail application that supports S/MIME, and that Outlook’s encryption features require a qualifying Microsoft 365 subscription for work or school accounts. Google lists S/MIME in Gmail as available for work or school accounts only. A personal mailbox may therefore just show the raw container.
• The message was shown in a preview that does not process S/MIME. Microsoft’s own help says that in Outlook on the desktop, on the web and on mobile you have to open an encrypted message in a new window, because conversation view does not support viewing encrypted messages; in new Outlook the same applies to signed messages if you use conversation view. On Microsoft Q&A, Outlook for Mac users report the mirror image for signed mail: the reading pane lists smime.p7m, and the real attachments appear once the message is opened in its own window.
• It is encrypted and this device does not have your certificate. Outlook decrypts S/MIME only if a certificate with its private key is available on the computer (or on your smart card). On a phone, a home computer or a webmail that has never had your certificate installed, the message stays locked.

Signed or encrypted? How to tell

The fastest way is to drop the file above: a signed message opens and shows “Signature intact” plus the text; an encrypted one ends with a message that says it is encrypted. Without any tool, your mail app’s “view source / show original” usually shows the part header: smime-type=signed-data or smime-type=enveloped-data. With OpenSSL:

openssl cms -cmsout -print -inform DER -in smime.p7m | head -3

The first line says pkcs7-signedData for a signed message and pkcs7-envelopedData (or id-smime-ct-authEnvelopedData for AES-GCM) for an encrypted one. If OpenSSL complains about the format, the file is Base64 text: use -inform PEM if it starts with -----BEGIN, or decode it first with base64 -di smime.p7m > smime.der.

Fix it in your mail app

The menu names below are the ones on Microsoft’s and Apple’s support pages; your version may differ slightly.

Classic Outlook for Windows

Double-click the message so it opens in its own window. For encrypted mail, Outlook looks for your certificate on the computer and decrypts the message when you open it; if the certificate is on a smart card, it asks you to insert the card and possibly a PIN. The certificate itself is chosen in File › Options › Trust Center › Trust Center Settings › Email Security, under Encrypted email › Settings › Certificates and Algorithms › Choose.

New Outlook for Windows and Outlook on the web

Both keep S/MIME under Settings › Mail › S/MIME. Microsoft points out that new Outlook does not import certificates automatically: install yours manually there or ask your administrator. Outlook on the web also needs the S/MIME control; the S/MIME settings page shows “To use S/MIME, you need to install the S/MIME control. To install it, click here.”, and you are prompted to install it if you open an encrypted message first. In Chrome it only works on a computer joined to your organisation’s domain with the S/MIME extension policy, so on a personal laptop this route is usually closed. If the message sits in a shared or delegated mailbox, check Microsoft 365 roadmap item 565861, which extends S/MIME in new Outlook to those mailboxes.

Outlook for Mac

Your certificate must be in the macOS keychain. Then choose Outlook › Accounts, select the account, select Security and pick it under Certificate (legacy Outlook for Mac: Tools › Accounts › Advanced › Security; Microsoft says support for legacy Outlook for Mac ends in October 2026). If a signed message shows only smime.p7m in the reading pane, open it in its own window first.

Outlook on iPhone and Android

Tap the Account control at the top left, then Settings, tap the account and then Security, where the S/MIME toggle is. Microsoft adds that if there is no Security option, that account type or provider does not support S/MIME — which is a likely reason when smime.p7m shows up on the phone while the same message reads fine on a work PC.

iPhone Mail

iOS Mail supports S/MIME. Apple places its options under the account’s Account › Advanced settings (on current iOS: Settings › Apps › Mail › Mail Accounts, then the account). To read encrypted mail the iPhone needs your own S/MIME certificate with its private key installed for that account. For signed mail, Mail shows a blue checkmark next to a trusted sender and a red question mark for an untrusted one.

Gmail

Gmail’s S/MIME (“hosted S/MIME”, green lock) is a Google Workspace feature for work or school accounts. Personal Gmail accounts do not have S/MIME, so an encrypted S/MIME message cannot be decrypted there. If the smime.p7m is only signed, download it and open it above.

Read a signed smime.p7m in your browser

1. Save the smime.p7m attachment. If your app will not let you, save the whole message as .eml and drop that: ApriP7M finds the smime.p7m inside it. (Outlook’s own .msg format is not supported.)
2. Drop it on the box at the top of this page.
3. You get a card named smime.eml with the message text (taken from the HTML version, without images, if the e-mail has no plain-text part), the list of attachments with a Download button for each, and the signer’s certificate.
4. The verdict says whether the content still matches the signature. If someone changed even one character, you see “Signature NOT intact”, and the text is still shown so you can judge it.

The file is read with your browser’s File API and parsed on your device; the page blocks all network connections while it works. It handles the container in binary (DER), as Base64 text and as PEM.

If it is encrypted

An encrypted smime.p7m is locked with the recipient’s public key. Only the matching private key opens it — not the sender, not your mail provider, not any website. No “online smime.p7m decrypter” can get around that, and you should not upload a private key to one. What works:

• open the message in the app and on the device where your certificate is installed (work computer, smart card, company phone with the certificate profile);
• ask your IT department to install your S/MIME certificate on the device you are using;
• if the message was not meant for you, or your certificate was replaced and the old key is gone, ask the sender to send it again.

If you do hold your certificate as a .p12/.pfx file, OpenSSL can decrypt locally:

openssl pkcs12 -in my-id.p12 -nodes -out my-id.pem      # add -legacy for older .p12 exports
openssl cms -decrypt -in smime.p7m -inform DER -inkey my-id.pem -recip my-id.pem -out message.eml
rm my-id.pem                                             # it contains your private key unprotected

We tested this with OpenSSL 3.5: an older .p12 (RC2 encryption) fails with an “unsupported” error unless you add -legacy. If the sender both signed and encrypted, message.eml may contain a signed smime.p7m in turn: drop message.eml on the box above and ApriP7M unpacks that second layer (we tested this too).

Unpacking a signed smime.p7m with OpenSSL

openssl cms -verify -noverify -in smime.p7m -inform DER -out message.eml

-noverify skips the certificate-chain check (the sender’s CA is rarely in OpenSSL’s store) but still checks the content against the signature; without it, a self-signed or company certificate makes the command fail with an empty output file. Watch the exit code: on a tampered message OpenSSL prints CMS Verification failure and exits with 4, but still writes message.eml. Open message.eml in a mail app to see the attachments.

What ApriP7M does and does not do

• Does: unpack signed S/MIME messages (smime.p7m in DER, Base64 or PEM, or inside a saved .eml); show the text; let you download each attachment and the unwrapped smime.eml; check that the content matches the signature; show the signer’s certificate.
• Does not: decrypt encrypted messages (it never asks for your private key); validate the sender’s certificate chain or revocation — this is an integrity check, not a qualified verification; display HTML formatting or inline images; open Outlook .msg files.
• If an attachment inside is itself a .p7m — say an Italian signed contract or e-invoice — download it and drop it again: it opens like any other .p7m.

One file at a time is free, which is all a smime.p7m normally needs. Pro (€19.99 one-time) is for people who open many signed files or Italian e-invoices together and want them as one ZIP or an Excel register.