title: Can't get bouncycastle to correctly tag constructed octet string in der encoding
body: <p>I have the following requirements. I have an asn1 type that needs to be encapsulated in a constructed octet string (octet string tagged as 0x24). This structure is then signed in a CMS signed block and the whole CMS block needs to be DER encoded.</p>
  
  <p>My problem is every time I DER encode the CMS block the constructed octet string becomes a (nonconstructed?) octet string. I mean its tag switches from 0x24 (what I need) to 0x04.</p>
  
  <p>Is this a Bouncycastle bug or am I doing something I shouldn't? Ignoring the CMS block, it appears that anytime I try to der encode a 'BerConstructedOctetString' it no longer is a constructed octetstring:</p>
  
  <pre><code>BERConstructedOctetString constructed = new BERConstructedOctetString(new DERInteger(3));
  ASN1Object nonConstructed= new DEROctetString(new DERInteger(3));
  
  System.out.println(Util.toHex(constructed.getDEREncoded()));
  System.out.println(Util.toHex(nonConstructed.getDEREncoded()));
  System.out.println(Util.toHex(constructed.getEncoded()));
  System.out.println(Util.toHex(nonConstructed.getEncoded()));
  </code></pre>
  
  <p>With the following output:</p>
  
  <pre><code>04:03:02:01:03
  04:03:02:01:03
  24:80:04:03:02:01:03:00:00
  04:03:02:01:03
  </code></pre>
  
  <p>Edit: Is this even possible? Is there a reason both bouncycastle and not-yet-commons-ssl contain '<b>Ber</b>ConstructedOctetString' that encode and tag as 0x04 when encoded to DER? Are my two requirements incompatible?</p>