diff --git a/envelope/envelope.py b/envelope/envelope.py index b9be86e..c0d5c3f 100644 --- a/envelope/envelope.py +++ b/envelope/envelope.py @@ -1335,6 +1335,17 @@ def smime_sign_encrypt(self, email, sign, encrypt): else: pubkey = encrypt + certificates = encrypt + + recipient_certs = [] + for cert in certificates: + try: + c = load_pem_x509_certificate(cert) + except ValueError as e: + raise ValueError("failed to load certificate from file") + + recipient_certs.append(c) + try: pubkey = load_pem_x509_certificate(pubkey) except ValueError as e: @@ -1344,7 +1355,11 @@ def smime_sign_encrypt(self, email, sign, encrypt): envelope_builder = pkcs7.PKCS7EnvelopeBuilder().set_data(signed_email) envelope_builder = envelope_builder.add_recipient(pubkey) - options = [pkcs7.PKCS7Options.Text] + for recip in recipient_certs: + envelope_builder = envelope_builder.add_recipient(recip) + + + options = [pkcs7.PKCS7Options.Binary] encrypted_email = envelope_builder.encrypt(serialization.Encoding.SMIME, options) return encrypted_email @@ -1397,7 +1412,7 @@ def _encrypt_smime_now(self, email, sign, encrypt: Union[None, bool, bytes, List output = self.smime_sign_only(email, sign) elif sign and encrypt: - output = self.smime_sign_encrypt(email, sign, encrypt[0]) + output = self.smime_sign_encrypt(email, sign, encrypt) elif not sign and encrypt: output = self.smime_encrypt_only(email, encrypt)