title: how to use X509 certificates (to sign a file w/ simple verification, + other questions)
body: <p>I spent several hours yesterday trying to digitally sign a short file using an X509 certificate (one of the "freemail" certificates from thawte). I finally got openssl to sign it as an SMIME message, but I can't successfully verify it, AND it's in the SMIME format -- I don't have access to a "sendmail" program which can actually send out the SMIME file.</p>
  
  <p>I just want to create some file that is "excerptable" via plain cut &amp; paste, like:</p>
  
  <pre><code>===BEGIN SIGNED DOCUMENT===
  ===BEGIN DOCUMENT===
  blah blah blah this is the plaintext ...
  ===END DOCUMENT===
  ===BEGIN SIGNATURE===
  AFab12121abadAF ...
  ===END SIGNATURE===
  ===END SIGNED DOCUMENT===
  </code></pre>
  
  <p>Alternatively I guess I could make a .zip file that contains the original file and also the signature.</p>
  
  <p>so I guess my requirements are:</p>
  
  <ol>
  <li>input plaintext = arbitrary file</li>
  <li>input signkey = from X509 certificate</li>
  <li>output = something I can easily email to someone else by cut&amp;paste or by attaching a single .zip file</li>
  <li>program = something that is free &amp; open source like openssl or gpg</li>
  <li>program != a magic GUI where I don't understand what's going on</li>
  <li>ability to easily use the program to generate output from inputs</li>
  <li>ability to easily extract the plaintext from the output (e.g. either directly by eye or as a component of the .zip file)</li>
  <li>ability to verify that the plaintext was signed by the grantee of the X509 certificate (i.e. me) and that the grantor (CA) of the certificate is a Well-Known CA... assuming that I am a rational person who keeps the certificate secure from use by other parties (otherwise someone could sign things as me).</li>
  </ol>
  
  <p>Is there a good tutorial for X509 certificates &amp; how they are used in practice for this stuff? I have the 2nd edition of Schneier's "Applied Cryptography" &amp; have a fair amount of experience with cryptographic algorithms + protocols, but don't know much at all about X509 and I'm really confused as to what a certificate actually is in practical terms. (In other words, "a certificate is a cryptographic assertion by the issuing party CA that the party X named in the certificate is an identity known to the CA?" AND "a certificate enables its bearer to _____")</p>
  
  <p>When I get one it shows up in Firefox's "Your Certificates" tab of the Certificate Manager, and I can export it and read it with openssl, but I want to make sure that it's not stored in any way that someone else can use it w/o knowing the cert. passphrase -- and I get really confused because it seems like some certificates only have the public key &amp; others have encrypted private keys.</p>
  
  <p>Is there a good, simple GUI wrapper around openssl that allows you to have it explain what it's doing?</p>
  
  <hr>
  
  <p><strong>edit:</strong> thawte doesn't easily let you use certificate requests directly; instead it talks to web browsers (I use Firefox) &amp; that generatese the private key and handles all the certificate protocol. So I can export that as a PKCS12 file but am not exactly sure how to use that.</p>