email2certs reads an email message from stdin and writes all S/MIME certificates found in the email to stdout in PEM format. To process an entire Berkeley-style mbox file, you can use formail: formail -Y -s email2certs < mbox TODO: Greater tolerance of malformed input. Look for certs in other places (attachments, inline PEM, etc.)