diff --git a/test/test_rauc_extract.py b/test/test_rauc_extract.py
new file mode 100644
index 000000000..13054d690
--- /dev/null
+++ b/test/test_rauc_extract.py
@@ -0,0 +1,61 @@
+import os
+import pytest
+
+from helper import run
+from conftest import have_openssl
+
+
+@pytest.mark.skipif(not have_openssl(), reason="Have no OPENSSL")
+def test_rauc_extract_signature(tmp_path):
+    out, err, exitcode = run('rauc --keyring openssl-ca/dev-ca.pem'
+                             f' extract-signature good-bundle.raucb {tmp_path}/bundle.sig ')
+
+    assert exitcode == 0
+
+    assert os.path.exists(f'{tmp_path}/bundle.sig')
+
+    out, err, exitcode = run(f'openssl asn1parse -inform DER -in {tmp_path}/bundle.sig -noout')
+    assert exitcode == 0
+
+
+@pytest.mark.skipif(not have_openssl(), reason="Have no OPENSSL")
+def test_rauc_extract_signature_crypt(tmp_path):
+    out, err, exitcode = run('rauc --keyring openssl-ca/dev-ca.pem'
+                             ' --key openssl-enc/keys/rsa-4096/private-key-000.pem'
+                             f' extract-signature good-crypt-bundle-encrypted.raucb {tmp_path}/bundle.sig ')
+
+    assert exitcode == 0
+
+    assert os.path.exists(f'{tmp_path}/bundle.sig')
+
+    out, err, exitcode = run(f'openssl asn1parse -inform DER -in {tmp_path}/bundle.sig -noout')
+    assert exitcode == 0
+
+
+@pytest.mark.skipif(not have_openssl(), reason="Have no OPENSSL")
+def test_rauc_extract(tmp_path):
+    out, err, exitcode = run('rauc --keyring openssl-ca/dev-ca.pem'
+                             f' extract good-bundle.raucb {tmp_path}/bundle-extract ')
+
+    assert exitcode == 0
+
+    assert os.path.exists(f'{tmp_path}/bundle-extract/appfs.img')
+    assert os.path.exists(f'{tmp_path}/bundle-extract/custom_handler.sh')
+    assert os.path.exists(f'{tmp_path}/bundle-extract/hook.sh')
+    assert os.path.exists(f'{tmp_path}/bundle-extract/manifest.raucm')
+    assert os.path.exists(f'{tmp_path}/bundle-extract/rootfs.img')
+
+
+@pytest.mark.skipif(not have_openssl(), reason="Have no OPENSSL")
+def test_rauc_extract_crypt(tmp_path):
+    out, err, exitcode = run('rauc --keyring openssl-ca/dev-ca.pem'
+                             ' --key openssl-enc/keys/rsa-4096/private-key-000.pem'
+                             f' extract good-bundle.raucb {tmp_path}/bundle-extract ')
+
+    assert exitcode == 0
+
+    assert os.path.exists(f'{tmp_path}/bundle-extract/appfs.img')
+    assert os.path.exists(f'{tmp_path}/bundle-extract/custom_handler.sh')
+    assert os.path.exists(f'{tmp_path}/bundle-extract/hook.sh')
+    assert os.path.exists(f'{tmp_path}/bundle-extract/manifest.raucm')
+    assert os.path.exists(f'{tmp_path}/bundle-extract/rootfs.img')