PHP openssl_pkcs7_decrypt() Function: Usage and Examples

openssl_pkcs7_decrypt decrypts an S/MIME-encrypted file using the recipient certificate and corresponding private key.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_pkcs7_decrypt decrypts an S/MIME-encrypted file using the recipient certificate and corresponding private key.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_pkcs7_decrypt(string $input_filename, string $output_filename, $certificate, $private_key = ...): bool

The declared return type is shown above. Errors can include false results or exceptions depending on this API: The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.

Example 1: Basic Operation

The local certificate is self-signed for demonstration; signature acceptance here does not verify a trusted CA chain.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, 'Private message for recipient');
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
openssl_pkcs7_encrypt($input, $output, $cert, []);
var_dump(openssl_pkcs7_decrypt($output, $decoded, $cert, $private));
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Example 2: A Different Use Case

Exercise the container operation with a different document, including binary document bytes.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, 'A second authenticated document');
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
openssl_pkcs7_encrypt($input, $output, $cert, []);
var_dump(openssl_pkcs7_decrypt($output, $decoded, $cert, $private));
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Practical Example: Checking the Result

Exercise the container operation with a different document, including binary document bytes.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, random_bytes(48));
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
openssl_pkcs7_encrypt($input, $output, $cert, []);
var_dump(openssl_pkcs7_decrypt($output, $decoded, $cert, $private));
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Important Behavior and Edge Cases

The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.

These file-based APIs write encoded containers. The self-signed test certificate used in examples is not production trust material.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• openssl_pkcs7_decrypt decrypts an S/MIME-encrypted file using the recipient certificate and corresponding private key.
• The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.
• The openssl_cms_* APIs provide a newer related container interface.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.