To verify a files digital signature, OpenSSL dgst takes:

  • public key (from sender)
  • signature (from sender)
  • the file (to verify it hasn't been modified from original sender's)


openssl dgst -sha256 -verify publicKey.pem -signature senderSig.der wholeFile.txt

It recalculates the SHA256 of the file and then compares that to the encrypted digital signature hash, to verify.

However, would like to do the SHA256 "myself" or outside of dgst and pass that value to it instead of the file.

Something Like:

openssl dgst -verify publicKey.pem -signature senderSig.der -theFiles256Hash SHA256ofWholeFile.txt

Looking at the command parameters, seems possible but can't find the right combo.

Is this possible ?

If dgst cannot do this, can it be broken down into steps using other OpenSSL utilities?

(Using ECDSA)

  • 1
    Should you not get your answer here then you could try your luck at Information Security or Super User.
    – phk
    Jan 28, 2017 at 1:55
  • 1
    pkeyutl -verify (and -sign to sign) Jan 28, 2017 at 9:14
  • @dave-thompson-085: I am looking at pkeyutil, getting close, please expand on this as an answer if possible. . Noticed their "Verify the signature" example uses a private key..shouldn't it be the public? unix.stackexchange.com/questions/341356/…
    – P.S.
    Jan 31, 2017 at 2:49
  • I didn't get notified, probably because you used - not _ in your @. Anyway, pkeyutl -verify/-encrypt only uses the publickey, but can obtain it from a privatekey file, publickey (SPKI) file, OR certificate file; for the latter two you must specify -pubin -certin respectively. (Whose doc I notice is a bit confusing.) This differs from dgst -sign/verify which takes only a privatekey file and publickey file respectively -- to verify using a cert, which is common, you must use x509 -pubkey to extract the pubkey to a separate file. Dec 19, 2019 at 6:45

1 Answer 1


This does not answer OP's question since it is about ECDSA but people using RSA might find this helpful.

It is not possible to use dgst utility to verify hashes directly. One has to use pkeyutl utility:

openssl pkeyutl -in hash.bin -inkey pubkey.pem -pubin -verify -sigfile signature.bin -pkeyopt digest:sha256

Most of the parameters are documented directly at OpenSSL

  • 1
    pkeyutl works for all supported algorithms: RSA for sign/verify/recover (including PSS) and encrypt/decrypt (including OAEP), DSA ECDSA for sign/verify, DH ECDH X25519 X448 for derive, as of 1.1.1. Dec 19, 2019 at 6:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.