Convert P7S to XPS

A Windows workflow may require an XPS copy of a signed email or document for fixed-layout printing, submission, or archiving. A .p7s file usually contains only the cryptographic signature, so the original message or document must be opened and rendered before an XPS file can be created.

What the P7S format is

.p7s commonly identifies a PKCS#7 or CMS signature container used for S/MIME email signing, document-signing systems, and other PKI workflows. Outlook, Thunderbird, Apple Mail, enterprise mail servers, and electronic-signature software can create or attach P7S data.

A detached P7S, often named smime.p7s, contains the signature and certificate information but not the signed email body or document. It must be processed with the original content. An opaque CMS file can contain the signed content, but it is still a signature container rather than a page-layout file. Renaming .p7s to .xps does not convert it.

What the XPS format is

XPS (XML Paper Specification) is an XML-based fixed-layout document package. It records page geometry, text placement, embedded resources, vector graphics, and print formatting so the document can be rendered consistently.

XPS is suitable when a Windows system specifically requests it or when fixed pagination is required. It is less broadly supported than PDF, and creating XPS normally does not preserve the P7S signature or its verifiable certificate evidence; it creates a new rendered document.

How to create an XPS file

Signed email in Outlook or another mail client

1. Keep the complete original message, such as .eml or .msg, with its smime.p7s attachment. Do not open the P7S attachment as if it were the message.
2. Open the message in an S/MIME-compatible mail client and check its signature status. Resolve an unknown, expired, or revoked certificate before relying on the message.
3. Choose File → Print and select Microsoft XPS Document Writer.
4. Set the required pages, paper size, orientation, and scaling, then select Print.
5. Choose a destination and save the output with the .xps extension.

Attachments are not automatically included in the printed message. Open and print each required attachment separately.

Signed documents and CMS files

First verify or extract the signed content, then open that content in its native application and print it to the XPS writer. For a DER-encoded CMS file containing embedded content, OpenSSL can extract the content with:

openssl cms -verify -inform DER -in signed.p7s -noverify -out original.bin

For a detached signature, provide the original content:

openssl cms -verify -inform DER -in signature.p7s -content original.bin -noverify -out verified.bin

-noverify checks the CMS signature operation while skipping certificate-chain trust validation; it does not prove that the signer is trusted. Use a suitable trusted CA file or certificate store instead when trust validation is required. Use -inform PEM for PEM-encoded input. These commands apply to CMS-compatible files, not every proprietary signature format.

If the extracted result is a PDF, image, or Office file, open it in a suitable desktop application and select File → Print → Microsoft XPS Document Writer. If the XPS printer is missing, enable the relevant Windows optional feature or install an approved XPS printer driver; availability varies by Windows edition and version.

Online conversion

There is no general online service that can reconstruct the missing message or document from a detached P7S. For a non-confidential extracted PDF or Office file, a service such as Zamzar or Online-Convert can be considered only if its current format list explicitly supports that source format and XPS output. Do not upload signed email, certificates, contracts, personal data, or regulated records; use local verification and the Windows XPS printer instead.

Quality and compatibility limits

• A P7S has no guaranteed page size, line wrapping, fonts, or visual content, so it cannot normally be rendered directly as XPS.
• Printing can change pagination, omit interactive or unsupported content, flatten annotations, and substitute unavailable fonts. Inspect page breaks, images, tables, and printed certificate-status information.
• The XPS result is a rendering, not a cryptographically signed replacement. Retain the original signed message or document, the P7S file, and relevant certificate evidence when signature validation or legal provenance matters.
• XPS viewing and printing support is concentrated in Windows. Use PDF instead when the recipient or archive does not specifically require XPS.