PHP

Check if an Email Was Received Digitally Signed

Demonstrates the read-only Chilkat Email.ReceivedSigned property, which is true if the email was originally received carrying one or more digital signatures. Knowing a message was signed is separate from knowing the signature checked out, so this example also reads SignaturesValid to report whether the signed content verified.

Background: A digital signature on an email (S/MIME) provides two things: authenticity (it was really sent by the holder of a particular certificate) and integrity (the content was not altered in transit). The sender signs a hash of the message with their private key; the recipient verifies it with the sender's public certificate. ReceivedSigned simply tells you a signature is present — verifying it is a separate step exposed through SignaturesValid.

Chilkat PHP Downloads

Download Chilkat for PHP

Chilkat2 PHP

<?php

use Chilkat2\Email;

// Demonstrates the read-only Email.ReceivedSigned property, which is true if this
// email was originally received with a digital signature.  Use SignaturesValid to
// determine whether the signed content actually verified.

$email = new Email();

try {
    $email->LoadEml('qa_data/eml/signed.eml');
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

if ($email->ReceivedSigned) {
    echo "This email was received with a digital signature.\n";
    if ($email->SignaturesValid) {
        echo "All signatures are valid.\n";
    } else {
        echo "One or more signatures are NOT valid.\n";
    }
} else {
    echo "This email was not signed.\n";
}

// Note: Paths such as "qa_data/..." are relative local filesystem paths,
// relative to the current working directory of the running application.