title: openssl cms -verify doesn't work with external certificate
body: <p>I've been investigating this for a couple of days, and I finally came up with a simple test case. I need to sign and verify the signature for a SMIME/CMS formatted file which MUST NOT include the certificate.</p>
  
  <p>Signing works fine, but verification only works if the certificate is embedded in the signed file AND openssl is allowed to use it. If I don't include the certificate OR if I tell openssl to ignore it, verification fails, even if I specify both the signer certificate and the CA certificate explicitly in both scenarios.</p>
  
  <p>I have the following files:</p>
  
  <ul>
  <li><code>ca-crt.pem</code> – the CA certificate</li>
  <li><code>server-crt.pem</code> – the certificate I'm using for signing</li>
  <li><code>server-key.pem</code> – the server's private key</li>
  <li><code>sample.xml</code> – a sample file I want to sign</li>
  </ul>
  
  <p><strong>Step 1: Generate the signed file:</strong></p>
  
  <pre><code>$ openssl cms -sign -signer server-crt.pem -inkey server-key.pem -nodetach -md sha256 -in sample.xml -outform der -out sample.cms-der -noattr
  </code></pre>
  
  <p>Notice I didn't ask openssl to exclude the certificate. In the final version I would have to also add <code>-nocerts</code>, but for now it's easier to test if we leave it in.</p>
  
  <p><strong>Step 2: Verify the signature using the embedded certificate</strong></p>
  
  <p>Ok, so now we have the signed file in <code>sample.cms-der</code> – let's first verify it using the certificate included in the signed file:</p>
  
  <pre><code>$ openssl cms -verify -CAfile ca-crt.pem -inform der -signer server-crt.pem -in sample.cms-der
  Verification successful
  </code></pre>
  
  <p><strong>Step 3 Alpha: Verify the signature ignoring the embedded certificate</strong></p>
  
  <p>Now let's ask openssl to ignore the certificate embedded in the signed file – I'm using the exact same command line, except I'm adding the <code>-nointern</code> option at the end:</p>
  
  <pre><code>$ openssl cms -verify -CAfile ca-crt.pem -inform der -signer server-crt.pem -in sample.cms-der -nointern
  Verification failure
  14712:error:2E09D08A:CMS routines:CMS_verify:signer certificate not found:.\crypto\cms\cms_smime.c:333:
  </code></pre>
  
  <p>Of course, in this scenario I can still verify the signature because the certificate is included – but if I generate the signed file using the <code>-nocerts</code> option I end up in the failure scenario, regardless of whether I verify using <code>-nointern</code> or not.</p>
  
  <p><strong>Step 3 Beta: SMIME instead of CMS</strong></p>
  
  <p>I also tried using smime instead of cms, and interestingly, although the error message is the same, the error has a different error number, and it comes from a different part in the source code:</p>
  
  <pre><code>$ openssl smime -verify -CAfile ca-crt.pem -inform der -signer server-crt.pem -in sample.cms-der -nointern
  Verification failure
  13580:error:2107C080:PKCS7 routines:PKCS7_get0_signers:signer certificate not found:.\crypto\pkcs7\pk7_smime.c:466:
  </code></pre>
  
  <p>The version of openssl I'm using is <code>OpenSSL 1.0.2n  7 Dec 2017</code>.</p>