title: Verify detached PKSC #7 signature in java (may be by Bouncy Castle), generated by CAPICOM
body: <p>all!</p>
  
  <p>I'm solving two problems:</p>
  
  <ol>
  <li>Stop using CAPICOM to sign/verify documents - because it's no longer supported by Microsoft (see more: <a href="http://msdn.microsoft.com/en-us/library/cc778518%28v=VS.85%29.aspx" rel="nofollow">Alternatives to Using CAPICOM</a>)</li>
  <li>Flowing out first we want to wide list of supported browsers by our system (customized Documentum webtop). Now it fully supported only by IE 6+ because of CAPICOM used as ActiveX.</li>
  </ol>
  
  <p>For signing we use windows module <a href="http://www.cryptopro.ru/products/csp/overview" rel="nofollow">CryptoPro</a> because of only it officially have legal effect in Russia. Our system deployed in government of one Russian region.</p>
  
  <p>Our system works already 5 years and there are many generated signs (all by CAPICOM). Signs is detached and persist in database.</p>
  
  <p>We want to find solution to verify those signs in java code (wrapped in Applet).</p>
  
  <p>I have tried code below, but I can't find any suitable method to verify any signature. This method always returns false.</p>
  
  <pre><code>public boolean verifyFile(String fileInput, String metadata, String base64Signature) throws Exception {
      Security.addProvider(new BouncyCastleProvider());
      byte[] signedContent = Base64.decode(base64Signature.getBytes("UTF-8"));
      CMSSignedData cms7 = new CMSSignedData(signedContent);
      CertStore certs = cms7.getCertificatesAndCRLs("Collection", "BC");
      SignerInformationStore signers = cms7.getSignerInfos();
      Collection c = signers.getSigners();
  
      SignerInformation signer = (SignerInformation)c.iterator().next();
      Collection certCollection = certs.getCertificates(signer.getSID());
      Iterator certIt = certCollection.iterator();
      X509Certificate cert = (X509Certificate)certIt.next();
  
      Signature signature = Signature.getInstance("SHA1withRSA", "BC");
      signature.initVerify(cert.getPublicKey());
      String signedContentString = getSignedDataString(fileInput, metadata);
      signature.update(signedContentString.getBytes("UTF-8"));
      return signature.verify(signer.getSignature());
  }
  </code></pre>
  
  <p>Have somebody any solution or already encountered this pr</p>