How to Open a .p7m File
A .p7m is not a document — it is an envelope. Inside is a real file (usually a PDF), wrapped in a digital signature, encryption, or both. What you can do with it depends entirely on which.
.p7m
.p7s
Why it will not open
- The envelope is the point, not an accident. S/MIME wraps the document so that tampering can be detected, or so that only the intended recipient can read it. Your operating system has no handler for the wrapper.
- Signed and encrypted look identical from the outside. Both use the extension .p7m. A signed one can be unwrapped by anybody; an encrypted one cannot be opened without the recipient's private key.
- It is common in business and government workflows — Italian invoicing in particular — and rare enough elsewhere that most people meet it once and have no tools ready.
How to open it
If it is signed (the common case)
- 1 Signed documents can be unwrapped by anyone; the signature proves origin, it does not restrict reading.
- 2 With OpenSSL: openssl smime -verify -in file.p7m -inform DER -noverify -out document.pdf
- 3 The -noverify flag skips checking the signer's certificate chain, which is what you want when you only need the contents. Drop it if you also want to validate who signed it.
- 4 On Windows without OpenSSL, renaming a copy to .p7m.p7m sometimes lets Windows extract it, but a dedicated tool is more reliable.
If it is encrypted
- 1 You need the private key belonging to the certificate it was encrypted for. Without it there is no way in, and no tool or service can change that.
- 2 If it arrived in a mail client that holds your certificate — Outlook, Thunderbird, Apple Mail — opening the original message there will decrypt it automatically.
- 3 If you are not the intended recipient, ask the sender to resend it to the right address or unencrypted.
Dedicated viewers
- 1 In Italy, Dike GoSign and ArubaSign are the standard free tools for signed .p7m documents.
- 2 Most of them upload the file to a server. For a signed invoice or contract, that is worth thinking about before you use one.
Telling signed from encrypted
Opening the file in a text editor is enough for a rough check: a signed document usually shows fragments of the original filename and readable PDF markers among the binary, while an encrypted one is uniformly opaque. The identifier on this site reports it as an S/MIME envelope either way.
.p7s is the signature by itself
A .p7s file is a detached signature — it accompanies a separate document rather than containing one. On its own there is nothing to extract from it.