Verifying a Signed Export

Revision as of 09:34, 18 October 2017 by Bmeyn (talk | contribs)

It is possible to digitally sign an export of archived messages to the file system if the EML or MSG format is used. This helps to ensure the integrity of each exported email while it resides outside of the archive. A SHA256 hash of the public key that can be used to verify the signatures is stored in the archive's tamper proof audit log.

To verify the integrity of a signed export the use of OpenSSL is recommended. It needs to be installed on the computer where verification takes place in order to run the following commands.

Create Hash of Public Key

The following command generates a SHA256 hash of the public key in order to verify it against the hash recorded in MailStore's Audit Log.

  openssl dgst -sha256 -hex publickey.pem

Verify All Emails

The following one-liners can be used to verify a signed export including all subdirectories. The commands are to be executed inside the export's target directory.

Linux or MacOS

  find . -name '*.eml' -exec openssl dgst -sha256 -verify publickey.pem -signature \{}.sig \{} \;

Windows (PowerShell)

  ls -r *.eml | ForEach-Object { $file_sig = ($_.FullName) + '.sig';  $file_eml = $_.FullName; openssl.exe dgst -sha256 -verify publickey.pem -signature  "$file_sig" "$file_eml" }