title: Verify signature of PE file
body: <p>I am trying to verify the certificates/signatures of a a PE file with OpenSSL (or actually with Python, but it seems like Python sucks regarding certificate handling).</p>
  
  <p>I have extracted the DER PKCS7 certificate from the PE file as described here: <a href="http://blog.didierstevens.com/2008/01/11/the-case-of-the-missing-digital-signatures-tab/" rel="nofollow">http://blog.didierstevens.com/2008/01/11/the-case-of-the-missing-digital-signatures-tab/</a></p>
  
  <p>And I have created a modified version of the PE file without the checksum and signature data, like described here: <a href="http://www.mail-archive.com/cryptography@c2.net/msg04202.html" rel="nofollow">http://www.mail-archive.com/cryptography@c2.net/msg04202.html</a></p>
  
  <p>The sha1sum of the modified file is the same as the sha1sum in the certificate.</p>
  
  <p>I have tried to verify the unsigned, modified PE file with openssl as such: <code>openssl smime -verify -in signature.der -content modified_executable.exe -inform DER -binary</code> But I only get </p>
  
  <blockquote>
    <p>Verification failure
    140415508248232:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:342:Verify error:unsupported certificate purpose</p>
  </blockquote>
  
  <p>If i add <code>-noverify</code> to the command I just get </p>
  
  <blockquote>
    <p>Verification failure
    140595583981224:error:21071065:PKCS7 routines:PKCS7_signatureVerify:digest failure:pk7_doit.c:1097:
    140595583981224:error:21075069:PKCS7 routines:PKCS7_verify:signature failure:pk7_smime.c:410:</p>
  </blockquote>
  
  <p>What am I missing?</p>