title: SMIME can't be validated by receiver when using newer version of Bouncy Castle
body: <p>I am using BC to encrypt and sign an SMIME message for use with AS2.  The code we have works fine with an absolutely ancient version of bouncy castle, <code>bcmail-1.4:125</code>.  Upgrading to anything newer causes the receiver of the message (not too ancient Cyclone server) to fail to verify the message. (e.g. the <em>earliest v in maven</em> causes this too.  These are the versions without API changes (e.g. 1.38).</p>
  
  <p>Since we use JDK 1.7 (and 1.8), I've been trying to update this to a newer version of BC, java-mail, etc.  I've upgraded all of bouncy castle to <code>bcmail-jdk15on:1.51</code> and <code>bcprov-jdk15on:1.51</code>, along with java mail, and followed the examples in the <code>bcmail</code> package.  However, I am still getting an error from Cyclone saying <code>integrity-check-failed</code>.  </p>
  
  <p>I am fairly certain the error is with how I am doing signing. When I disable signing and only use encryption it processes correctly.  Also, I can correctly receive a signed response from the remote server and verify the signature, which is how I get the error message out (from content-disposition on the MimeMultiPart). </p>
  
  <ul>
  <li>The certificates are created by openssl/self signed/etc, stored in pkcs12 file</li>
  <li>Unlimited strength policies are in place</li>
  <li><code>senderKey</code> is a <code>BCRSAPrivateCrtKey</code></li>
  <li><code>senderCert</code>
  <ul>
  <li><code>org.bouncycastle.jcajce.provider.asymmetric.x509.X509CertificateObject</code></li>
  </ul></li>
  </ul>
  
  <p><strong>Failing</strong>: The current code is this, using <code>bcmail-jdk15on:1.51</code> &amp; etc   </p>
  
  <pre><code>SMIMESignedGenerator gen = new SMIMESignedGenerator();
  gen.addSignerInfoGenerator(new JcaSimpleSignerInfoGeneratorBuilder()
             .setProvider("BC")
             .build("SHA1withRSA", senderKey, senderCert));
  // gen.addCertificates(new JcaCertStore(list(senderCert))); old v. doesn't add certs
  MimeMultipart smime = gen.generate(part); // MimeBodyPart passed in to function
  MimeBodyPart tmpBody = new MimeBodyPart();
  tmpBody.setContent(signedData);
  tmpBody.setHeader("Content-Type", signedData.getContentType()
  </code></pre>
  
  <p><strong>Previously working code</strong> looks like this and uses <code>bcmail-1.4:1.25</code>.  Upgrading to 1.3x also causes a failure on the other end when decrypting (irrespective of which jdk I run on, 1.6 - 1.8) </p>
  
  <pre><code>MimeBodyPart body = new MimeBodyPart();
  body.setDataHandler(new DataHandler(new ByteArrayDataSource(bytes[], contentType, null);));
  SMIMESignedGenerator sGen = new SMIMESignedGenerator();
  // SHA1 resolves to "1.3.14.3.2.26", FWIW
  sGen.addSigner(senderKey, senderCert, getBouncyCastleAlgorithmId("SHA1"));
  MimeMultipart signedData = sGen.generate(part, "BC");
  // this is then encrypted &amp; streamed, no issues there
  </code></pre>
  
  <p><strong>Common Setup Code</strong></p>
  
  <pre><code>byte[] data = Files.readAllBytes(filePath);
  MimeBodyPart part = new MimeBodyPart();
  ByteArrayDataSource dataSource = new ByteArrayDataSource(data, "application/EDIFACT", null);
  part.setDataHandler(new DataHandler(dataSource));
  part.setHeader("Content-Transfer-Encoding", "8bit");
  part.setHeader("Content-Type", "application/EDIFACT");
  </code></pre>
  
  <p>I have a feeling it has something to do with how I am adding (or manipulating) the <code>senderCert</code>, which is the local application's X509.  </p>
  
  <p><strong>Update</strong></p>
  
  <p>I've made the new code more in-line with what the old produces by removing the certificate:</p>
  
  <ul>
  <li>It no longer includes the cert in the signed message.  old version didn't</li>
  <li>The entire mime multi-part content is now <em>exactly</em> the same length (1095 bytes) as before</li>
  <li>The format (headers, etc) is now exactly the same</li>
  <li>The signed part is now nearly identical.  There is a portion that seems to vary based on the time (???), though, and that changes each time.  I can't get openssl to verify this message yet, no idea why. </li>
  </ul>
  
  <p>Here is sample output, FWIW.  The text in <code>[]</code> is the only part that changes.</p>
  
  <pre class="lang-none prettyprint-override"><code>------=_Part_1_1448572667.1409621469842
  Content-Type: application/EDIFACT
  Content-Transfer-Encoding: 8bit
  
  this is a test
  
  ------=_Part_1_1448572667.1409621469842
  Content-Type: application/pkcs7-signature; name=smime.p7s; smime-type=signed-data
  Content-Transfer-Encoding: base64
  Content-Disposition: attachment; filename="smime.p7s"
  Content-Description: S/MIME Cryptographic Signature
  
  MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAMYIBpDCCAaAC
  AQEwgZ4wgZAxCzAJBgNVBAYTAmNuMREwDwYDVQQIDAhzaGFuZ2hhaTESMBAGA1UEBwwJY2hhbmdu
  aW5nMREwDwYDVQQKDAhwb3dlcmUyZTEOMAwGA1UECwwFaXRkZXYxEjAQBgNVBAMMCWFiLWNsaWVu
  dDEjMCEGCSqGSIb3DQEJARYUYWItY2xpZW50QG15Q29ycC5jb20CCQClDAGwq37A/jAJBgUrDgMC
  GgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTQwOTAyMDEz
  M[TA5]WjAjBgkqhkiG9w0BCQQxFgQUG6KkoqPBvE7Kd9dB0eop/aUTya0wDQYJKoZIhvcNAQEBBQAE
  gYB[h9N4maow9aoTQ8QBGgXEYE+xgXSmRPy+ufIsMpuS0Yys/1t3AfXSSI7WKgLMRKYXve8gdb4Gn
  dqecHzkBwBq4hebt9YK+E30E6DpZpCwErsgDVaU/ExBA5gauPWneysy+s2bE5Y6pNZ7Qf3kGU5kI
  UjlOF/LUNkCsgT5z//]5N6QAAAAAAAA==
  ------=_Part_1_1448572667.1409621469842--
  </code></pre>