CMS SignedData objects

Some options:

The original message content (known as eContent) may be included or not (the latter case is known as a "detached signature").
One person may sign it, or there may be multiple signers.
The person signing may or may not include their X.509 certificate for the recipient to use to verify the signature. If it is not included, the recipient has to obtain a copy of the signer's certificate by other means.
The entire certificate chain for the signer (or multiple signers) can also be included, as could any other certificate the creator feels like including.
At one extreme, the SignedData object can just consist of a collection of certificates with no signature and no signed message content. These are known as PKCS#7 certficate chain files or in S/MIME terminology as degenerate "certs-only" objects. This format is commonly used to distribute X.509 certificates, usually with the .p7c or .p7b filename extension. Some people sneakily use the .cer extension for these types of files as well, even though that extension is usually used only for single X.509 certificates.

To verify that the message content was indeed signed by the signer requires the recipient to do the following:

The function CMS_VerifySigData carries out steps 2 and 3 directly with options for the user to pass the signer's certificate details if they are not already included and also to pass the message digest of the eContent for detached signatures.

The function CMS_GetSigDataDigest will extract the message digest, if possible, to enable the user to perform their own separate comparison with an independently-computed message digest of the eContent. Note that being able to retrieve the message digest with this function implicitly verifies that the purported signer really did use their private key to sign the object. However, unlike the CMS_VerifySigData function, success with this function does not necessarily mean that the signer actually signed the eContent itself. Furthermore, if the signer used the DSA or RSA-PSS signature algorithms and did not include message attributes, then you cannot directly extract the message digest of the eContent.

To extract just the certificates themselves from a SignedData object, use the X509_GetCertFromP7Chain function. This will work for all types of SignedData objects, not just the "certs-only" type.