title: Using CMS_sign() with CMS_CADES flag including certificate chain for CAdES compliance. Do I have to use CMS_PARTIAL flag?
body: <p>Will the following generate message signature compliant to CAdES?</p>
  <p>The API doc for CMS_sign() seems indicate in order to use SHA256 for message digest, I need to use the flag &quot;CMS_PARTIAL&quot;. Also the <a href="https://github.com/openssl/openssl/pull/7893" rel="nofollow noreferrer">openssl's CAdES patch</a> seems to imply the CMS_PARTIAL and manually call  &quot;CMS_add1_signing_cert_v2()&quot; followed by &quot;CMS_final()&quot; as well. But I was hoping adding CMS_CADES flag to CMS_sign() could have been sufficient. Hence the ask.</p>
  <p>My questions are for any OPENSSL C API experts:</p>
  <ol>
  <li><p>Will the following use SHA1 to generate message digest?</p>
  </li>
  <li><p>Will the following generate cryptographic message syntax compliant to CAdES standards (<a href="https://www.rfc-editor.org/rfc/rfc5126" rel="nofollow noreferrer">RFC-5126</a>)?</p>
  </li>
  <li><p>If SHA256 is the required method to generate message digest, do I have to use CMS_PARTIAL?</p>
  <p>CMS_ContentInfo *CMS_sign(signcert, EVP_PKEY *pkey, STACK_OF(X509)*intermediate_certs, BIO *data, CMS_DETACHED | CMS_CADES);</p>
  </li>
  </ol>