2019-04-16

Brak ważnego podpisu.

Jeden z programistów przygotowujących aplikację do przesyłania danych do GIIF zwrócił nam uwagę, na plik który po przesłaniu do MF zwraca błąd: 401 „Brak ważnego podpisu.” pomimo, że ten sam plik waliduje się w oprogramowaniu KIR Szafir i Certum SmartSign.

Aby przeanalizować problem stworzyłem dodatkowe wywołanie w systemie testowym:

1
2
3

curl --data-binary @plik.sig \
     -H 'Content-Type: application/binary' \
     https://test.giif.mofnet.gov.pl/api/rest2018/validate/

Po wywołaniu otrzymałem poniższą odpowiedź (skroconą dla ochrony danych osobowych), nie trzeba się w nią wgłębiać zamieszczam ją wyłącznie dla zilustrowania czego spodziewać się po wywołaniu:

----------------Diagnostic data-----------------
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<DiagnosticData xmlns="http://dss.esig.europa.eu/validation/diagnostic">
    <DocumentName></DocumentName>
    <ValidationDate>2019-04-16T08:34:14</ValidationDate>
    <Signatures>
        <Signature Id="id-0d5c90b084135f343a2314d0ea973930">
            <SignatureFilename></SignatureFilename>
            <SignatureFormat>CAdES-BASELINE-T</SignatureFormat>
            <StructuralValidation>
                <Valid>true</Valid>
            </StructuralValidation>
            <BasicSignature>
                <EncryptionAlgoUsedToSignThisToken>RSA</EncryptionAlgoUsedToSignThisToken>
                <KeyLengthUsedToSignThisToken>2048</KeyLengthUsedToSignThisToken>
                <DigestAlgoUsedToSignThisToken>SHA256</DigestAlgoUsedToSignThisToken>
                <ReferenceDataFound>true</ReferenceDataFound>
                <ReferenceDataIntact>true</ReferenceDataIntact>
                <SignatureIntact>true</SignatureIntact>
                <SignatureValid>true</SignatureValid>
            </BasicSignature>
            <SigningCertificate Id="[...]">
                <AttributePresent>true</AttributePresent>
                <DigestValuePresent>true</DigestValuePresent>
                <DigestValueMatch>true</DigestValueMatch>
                <IssuerSerialMatch>true</IssuerSerialMatch>
            </SigningCertificate>
            <CertificateChain>
                <ChainItem Id="[...]">
                    <Source>UNKNOWN</Source>
                </ChainItem>
                <ChainItem Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914">
                    <Source>TRUSTED_LIST</Source>
                </ChainItem>
            </CertificateChain>
            <ContentType>1.2.840.113549.1.7.1</ContentType>
            <CommitmentTypeIndication>
                <Indication>1.2.840.113549.1.9.16.6.1</Indication>
                <Indication>1.2.840.113549.1.9.16.6.6</Indication>
            </CommitmentTypeIndication>
            <ClaimedRoles/>
            <Timestamps>
                <Timestamp Id="9D07AB05D4AF83148F1EC8C0146F38F8F5771825617AEA270646B0E125B13087" Type="SIGNATURE_TIMESTAMP">
                    <ProductionTime>2019-04-15T12:02:50</ProductionTime>
                    <SignedDataDigestAlgo>SHA256</SignedDataDigestAlgo>
                    <EncodedSignedDataDigestValue>2HZ/upb0BvAmObWE/Yp9vUtQvPdi0VtRwS095U+3CEk=</EncodedSignedDataDigestValue>
                    <MessageImprintDataFound>true</MessageImprintDataFound>
                    <MessageImprintDataIntact>true</MessageImprintDataIntact>
                    <BasicSignature>
                        <EncryptionAlgoUsedToSignThisToken>RSA</EncryptionAlgoUsedToSignThisToken>
                        <KeyLengthUsedToSignThisToken>4096</KeyLengthUsedToSignThisToken>
                        <DigestAlgoUsedToSignThisToken>SHA256</DigestAlgoUsedToSignThisToken>
                        <ReferenceDataFound>true</ReferenceDataFound>
                        <ReferenceDataIntact>true</ReferenceDataIntact>
                        <SignatureIntact>true</SignatureIntact>
                        <SignatureValid>true</SignatureValid>
                    </BasicSignature>
                    <SigningCertificate Id="673BE8A1DA927DB63CCAB7CB3E7AC352DC3AEB6A8DA3E2A359CA158D0A440DB8"/>
                    <CertificateChain>
                        <ChainItem Id="673BE8A1DA927DB63CCAB7CB3E7AC352DC3AEB6A8DA3E2A359CA158D0A440DB8">
                            <Source>TRUSTED_LIST</Source>
                        </ChainItem>
                    </CertificateChain>
                    <TimestampedObjects>
                        <TimestampedObject Id="id-0d5c90b084135f343a2314d0ea973930" Category="SIGNATURE"/>
                        <TimestampedObject Category="CERTIFICATE">
                            <DigestAlgoAndValue>
                                <DigestMethod>SHA256</DigestMethod>
                                <DigestValue>D/J4sy7f7TeVRDOMFeybyext51PG/Gxoy7j3qDHUTyE=</DigestValue>
                            </DigestAlgoAndValue>
                        </TimestampedObject>
                    </TimestampedObjects>
                </Timestamp>
            </Timestamps>
            <SignatureScopes>
                <SignatureScope name="Full document" scope="FullSignatureScope">Full document</SignatureScope>
            </SignatureScopes>
        </Signature>
    </Signatures>
    <UsedCertificates>
        <Certificate Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914">
            <SubjectDistinguishedName Format="CANONICAL">2.5.4.97=#0c10564154504c2d35313730333539343538,cn=certum qca 2017,o=asseco data systems s.a.,c=pl</SubjectDistinguishedName>
            <SubjectDistinguishedName Format="RFC2253">2.5.4.97=#0c10564154504c2d35313730333539343538,CN=Certum QCA 2017,O=Asseco Data Systems S.A.,C=PL</SubjectDistinguishedName>
            <IssuerDistinguishedName Format="CANONICAL">2.5.4.97=#0c10564154504c2d35323530303038313938,cn=narodowe centrum certyfikacji,o=narodowy bank polski,c=pl</IssuerDistinguishedName>
            <IssuerDistinguishedName Format="RFC2253">2.5.4.97=#0c10564154504c2d35323530303038313938,CN=Narodowe Centrum Certyfikacji,O=Narodowy Bank Polski,C=PL</IssuerDistinguishedName>
            <SerialNumber>710871166242919768730898917567636976287103054975</SerialNumber>
            <CommonName>Certum QCA 2017</CommonName>
            <CountryName>PL</CountryName>
            <OrganizationName>Asseco Data Systems S.A.</OrganizationName>
            <AuthorityInformationAccessUrls/>
            <CRLDistributionPoints/>
            <OCSPAccessUrls/>
            <DigestAlgoAndValues>
                <DigestAlgoAndValue>
                    <DigestMethod>SHA256</DigestMethod>
                    <DigestValue>7TgBiesoD12GyRS/3SjYl5XlZ2rok/PD11sS8+QsyRQ=</DigestValue>
                </DigestAlgoAndValue>
            </DigestAlgoAndValues>
            <NotAfter>2028-03-15T23:59:59</NotAfter>
            <NotBefore>2017-03-15T10:17:34</NotBefore>
            <PublicKeySize>4096</PublicKeySize>
            <PublicKeyEncryptionAlgo>RSA</PublicKeyEncryptionAlgo>
            <KeyUsageBits>
                <KeyUsage>keyCertSign</KeyUsage>
                <KeyUsage>crlSign</KeyUsage>
            </KeyUsageBits>
            <ExtendedKeyUsages/>
            <IdPkixOcspNoCheck>false</IdPkixOcspNoCheck>
            <BasicSignature>
                <EncryptionAlgoUsedToSignThisToken>RSA</EncryptionAlgoUsedToSignThisToken>
                <KeyLengthUsedToSignThisToken>?</KeyLengthUsedToSignThisToken>
                <DigestAlgoUsedToSignThisToken>SHA512</DigestAlgoUsedToSignThisToken>
                <ReferenceDataFound>true</ReferenceDataFound>
                <ReferenceDataIntact>true</ReferenceDataIntact>
                <SignatureIntact>true</SignatureIntact>
                <SignatureValid>true</SignatureValid>
            </BasicSignature>
            <Trusted>true</Trusted>
            <SelfSigned>false</SelfSigned>
            <CertificatePolicies>
                <certificatePolicy cpsUrl="www.nccert.pl">2.5.29.32.0</certificatePolicy>
            </CertificatePolicies>
            <QCStatementIds/>
            <QCTypes/>
            <TrustedServiceProviders>
                <TrustedServiceProvider>
                    <TSPName>Asseco Data Systems S.A.</TSPName>
                    <TSPRegistrationIdentifier>VATPL-5170359458</TSPRegistrationIdentifier>
                    <CountryCode>PL</CountryCode>
                    <TrustedServices>
                        <TrustedService>
                            <ServiceName>Certification authority issuing qualified certificates</ServiceName>
                            <ServiceType>http://uri.etsi.org/TrstSvc/Svctype/CA/QC</ServiceType>
                            <Status>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted</Status>
                            <StartDate>2017-09-25T12:00:00</StartDate>
                            <AdditionalServiceInfoUris>
                                <URI>http://uri.etsi.org/TrstSvc/TrustedList/SvcInfoExt/ForeSignatures</URI>
                                <URI>http://uri.etsi.org/TrstSvc/TrustedList/SvcInfoExt/ForeSeals</URI>
                            </AdditionalServiceInfoUris>
                            <ServiceSupplyPoints>
                                <URI>http://qca.crl.certum.pl/qca_2017.crl</URI>
                            </ServiceSupplyPoints>
                        </TrustedService>
                        <TrustedService>
                            <ServiceName>Certification authority issuing qualified certificates</ServiceName>
                            <ServiceType>http://uri.etsi.org/TrstSvc/Svctype/CA/QC</ServiceType>
                            <Status>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted</Status>
                            <StartDate>2017-03-15T10:17:34</StartDate>
                            <EndDate>2017-09-25T12:00:00</EndDate>
                            <AdditionalServiceInfoUris>
                                <URI>http://uri.etsi.org/TrstSvc/TrustedList/SvcInfoExt/ForeSignatures</URI>
                            </AdditionalServiceInfoUris>
                        </TrustedService>
                    </TrustedServices>
                </TrustedServiceProvider>
            </TrustedServiceProviders>
            <Info/>
            <Base64Encoded>MIIGijCCBHKgAwIBAgIUfISQyDPXmKeE2/tYh2gjP2679H8wDQYJKoZIhvcNAQENBQAwbzELMAkGA1UEBhMCUEwxHTAbBgNVBAoMFE5hcm9kb3d5IEJhbmsgUG9sc2tpMSYwJAYDVQQDDB1OYXJvZG93ZSBDZW50cnVtIENlcnR5ZmlrYWNqaTEZMBcGA1UEYQwQVkFUUEwtNTI1MDAwODE5ODAeFw0xNzAzMTUxMDE3MzRaFw0yODAzMTUyMzU5NTlaMGUxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xGDAWBgNVBAMMD0NlcnR1bSBRQ0EgMjAxNzEZMBcGA1UEYQwQVkFUUEwtNTE3MDM1OTQ1ODCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKqhIng0CRIPhoofahIMMQOBeWmoSdBNs/7a8DjAtBmpD/MD0X2KMFHBJeVMFkA+o9k2rdbHzSR295YKzDPqEniGMhNUyYND999PMcuSH1wN/R3OM6asTugCxLVKiCNdHrZ9MUjOLG9JJOr+NzPbk2h9SZZa3fBwUkfWKJt4rWPn71DQ/swRdrC7UqCm0gDBqq2jSv42lfNxK7trySf/zxC7GnAtfgF8msF5F52O0DooY9lkPENpnGBotytq38oP9TkvQbh8aNV2nj34HyiXciIErF8gNthuIdArvedU7vL1ZQxRNfVie8V/ziJmphbC5CcYXzPUPjG2sxQjYVivs4o+ooSh2bdzuN0+B2utW2vqGgkOhla8ExYPmjoXvErlYjWcXJlv8kXi4pwKALALc7sB8olWCtT6/QnvC906s3wQOjgslEU+TsWSyq48u2hhkjl/ukiS/lEmHsWnoDF96j8Hv5bq+otA3OdR+PNh19fY94w/wCVp2FDXw/hwSarnaNNMlouMW5361gPuYuiVm2QuUUfgvTNOzwP0ia902mxU38E+hyQsUcbzYl/JN8V7ymZE3Jo1A7sle8OLAYAf7KOJL2EYBuM+mnZrL1AqnzuHamgL41gMphRcyl77/z09ATVryP9jTZIxC5oR21wqItHduL17AKusFnu44RV+Y28ZAgMBAAGjggEmMIIBIjAPBgNVHRMBAf8EBTADAQH/MIGsBgNVHSMEgaQwgaGAFCmzyMTfo4f4ZgUSWP1GKriYDXmHoXOkcTBvMQswCQYDVQQGEwJQTDEdMBsGA1UECgwUTmFyb2Rvd3kgQmFuayBQb2xza2kxJjAkBgNVBAMMHU5hcm9kb3dlIENlbnRydW0gQ2VydHlmaWthY2ppMRkwFwYDVQRhDBBWQVRQTC01MjUwMDA4MTk4ghRA+PeKsONkEFaRyNngLPjBxkAKRjAxBgNVHSABAf8EJzAlMCMGBFUdIAAwGzAZBggrBgEFBQcCARYNd3d3Lm5jY2VydC5wbDAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFCfx2E5gUGi2Yf5oGyhsbeQLcwlNMA0GCSqGSIb3DQEBDQUAA4ICAQC47g9Dyycy+6JsnGsSJfE4kbo6Q72YB5zwIA8wqlwz9eZko6qmH5SoDjmuCXswGe3WCnErRL8bZ6XD/tkR6HBc4CbxOJCMbD0KcIWXgIuumEQP/mn8UIGPYsqtDufDc47pqPTHntHWvMh4JL8NiIyKNNve7xuYVjm78YiK2KGDABcsKN2ZWeCsgn7qsSmGuMOwe382eNoZZI8brkJ9UizkIIx/Hw1XVXfQ9om8k30Q4ue693mMFHjeEH0ZJdOGyUxNJI6OcgjthOpL0ca6BZsom1Gye6HnkHqCTI0qHiuLMvFsIjr2OpPNHOeLoh5LCZVa5ll/zPzw5UZxckyy+lSky8RPNl0FngzBAwbvB6Zw+E61gotFQnBtw1XEJQumR3rrLzECMsrv59ezuORFTUJpZ5MOc97pnnALkF8oFdiFspu8y/W57HmpP/8vCjtuXT2/aBJtOHTHBWjQ/hyPALzp+zZQn7GcZ9DdQBQrXM10X2Vuazh0U71KLuAAZ6Vh92qitfz16oENWTYm0gGHdrpP+Zu1yS+3HV6qzWCPuHtK9mz7fY5gFSWv7uT0KKnShYx5zfqy9uRL5hoXEy5/uBjWAwHFXFZDitC56/DmqdMpZHHG+966JPvGWLf3Jc7u++D2g5Bd5+uxxsUYDsqikzBh0Jl2Fyqjrh51d6YrUuzp0g==</Base64Encoded>
        </Certificate>
        <Certificate Id="673BE8A1DA927DB63CCAB7CB3E7AC352DC3AEB6A8DA3E2A359CA158D0A440DB8">
            <SubjectDistinguishedName Format="CANONICAL">2.5.4.97=#0c10564154504c2d35313730333539343538,cn=certum qtst 2017,o=asseco data systems s.a.,c=pl</SubjectDistinguishedName>
            <SubjectDistinguishedName Format="RFC2253">2.5.4.97=#0c10564154504c2d35313730333539343538,CN=Certum QTST 2017,O=Asseco Data Systems S.A.,C=PL</SubjectDistinguishedName>
            <IssuerDistinguishedName Format="CANONICAL">2.5.4.97=#0c10564154504c2d35323530303038313938,cn=narodowe centrum certyfikacji,o=narodowy bank polski,c=pl</IssuerDistinguishedName>
            <IssuerDistinguishedName Format="RFC2253">2.5.4.97=#0c10564154504c2d35323530303038313938,CN=Narodowe Centrum Certyfikacji,O=Narodowy Bank Polski,C=PL</IssuerDistinguishedName>
            <SerialNumber>100341102919473197820118384675833212695201296873</SerialNumber>
            <CommonName>Certum QTST 2017</CommonName>
            <CountryName>PL</CountryName>
            <OrganizationName>Asseco Data Systems S.A.</OrganizationName>
            <AuthorityInformationAccessUrls/>
            <CRLDistributionPoints/>
            <OCSPAccessUrls/>
            <DigestAlgoAndValues>
                <DigestAlgoAndValue>
                    <DigestMethod>SHA256</DigestMethod>
                    <DigestValue>ZzvoodqSfbY8yrfLPnrDUtw662qNo+KjWcoVjQpEDbg=</DigestValue>
                </DigestAlgoAndValue>
            </DigestAlgoAndValues>
            <NotAfter>2028-03-15T23:59:59</NotAfter>
            <NotBefore>2017-03-15T10:23:18</NotBefore>
            <PublicKeySize>4096</PublicKeySize>
            <PublicKeyEncryptionAlgo>RSA</PublicKeyEncryptionAlgo>
            <KeyUsageBits>
                <KeyUsage>nonRepudiation</KeyUsage>
                <KeyUsage>digitalSignature</KeyUsage>
            </KeyUsageBits>
            <ExtendedKeyUsages>
                <oid Description="timeStamping">1.3.6.1.5.5.7.3.8</oid>
            </ExtendedKeyUsages>
            <IdPkixOcspNoCheck>false</IdPkixOcspNoCheck>
            <BasicSignature>
                <EncryptionAlgoUsedToSignThisToken>RSA</EncryptionAlgoUsedToSignThisToken>
                <KeyLengthUsedToSignThisToken>?</KeyLengthUsedToSignThisToken>
                <DigestAlgoUsedToSignThisToken>SHA512</DigestAlgoUsedToSignThisToken>
                <ReferenceDataFound>true</ReferenceDataFound>
                <ReferenceDataIntact>true</ReferenceDataIntact>
                <SignatureIntact>true</SignatureIntact>
                <SignatureValid>true</SignatureValid>
            </BasicSignature>
            <Trusted>true</Trusted>
            <SelfSigned>false</SelfSigned>
            <CertificatePolicies>
                <certificatePolicy cpsUrl="www.nccert.pl">2.5.29.32.0</certificatePolicy>
            </CertificatePolicies>
            <QCStatementIds/>
            <QCTypes/>
            <TrustedServiceProviders>
                <TrustedServiceProvider>
                    <TSPName>Asseco Data Systems S.A.</TSPName>
                    <TSPRegistrationIdentifier>VATPL-5170359458</TSPRegistrationIdentifier>
                    <CountryCode>PL</CountryCode>
                    <TrustedServices>
                        <TrustedService>
                            <ServiceName>Time Stamping Authority</ServiceName>
                            <ServiceType>http://uri.etsi.org/TrstSvc/Svctype/TSA/QTST</ServiceType>
                            <Status>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted</Status>
                            <StartDate>2017-03-15T10:23:18</StartDate>
                        </TrustedService>
                    </TrustedServices>
                </TrustedServiceProvider>
            </TrustedServiceProviders>
            <Info/>
            <Base64Encoded>MIIGoDCCBIigAwIBAgIUEZNzXxfBfhRNP5KPYZu/1QJ9sekwDQYJKoZIhvcNAQENBQAwbzELMAkGA1UEBhMCUEwxHTAbBgNVBAoMFE5hcm9kb3d5IEJhbmsgUG9sc2tpMSYwJAYDVQQDDB1OYXJvZG93ZSBDZW50cnVtIENlcnR5ZmlrYWNqaTEZMBcGA1UEYQwQVkFUUEwtNTI1MDAwODE5ODAeFw0xNzAzMTUxMDIzMThaFw0yODAzMTUyMzU5NTlaMGYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xGTAXBgNVBAMMEENlcnR1bSBRVFNUIDIwMTcxGTAXBgNVBGEMEFZBVFBMLTUxNzAzNTk0NTgwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDIVBFNnvM3EStAtw37R/k3CHZ0+owXd1n06h1IkLV/mg4E6PmurUhlXAAmjFfezbHsT/IzzUNmN3h25lA8C/F/lx0AASljXeS8YCdFSQ9ETK1NjsyEq3wPRVaMFkFNmsuEjiNtiSiycunOBV4BgT4Z4Nj0TFsxOxlI7F18E8YW0HT9CrDMUruMDLA/PW5Id6YyUQCfJOouIM2uoDxnOYy/Hn7y+doWFaHm8tsUsju6t3ZLJsPthxJwo1YfXNb+nprQW0xPWU3cZBtcAjHkezdRUtE5uAum/fN2CSj2zI46lyStl/3cQHP3lb1CWuR6SUeTupB+qRtSFu/zCeEqMGjHiJ/EaSAwPGQa3tJ6svMDrFZLfd/SpKYLL6bgNHGJHGhM82xwu6Sw3D2HMSe/j+sUEyDk2RWm+RcsooFaCL81vuBuerhcBpQQo+gfjqeZitWGeFX11EMk9wi0GFG1MCnrKs7T1sosNaFoxydfmj7I8Ib6H/1wB7+XTiVixwZovAQsJfDEWFHxwSnbtDmE0EQjMDUx4ErMX7rbo+iP5v+sqB2zlvWhAUnQl7Qa8QG+jgAO1fy2nW0OgaDM3/OiTCKNnl/OCwi/cWulwBUjfo5/zhuOTqTiM+NskT3q5HIyNOIdZt4+4wB8A7HXFgBAb2ZWPaVlXoThZQJoppX3zkLZ4wIDAQABo4IBOzCCATcwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDAYDVR0TAQH/BAIwADCBrAYDVR0jBIGkMIGhgBQps8jE36OH+GYFElj9Riq4mA15h6FzpHEwbzELMAkGA1UEBhMCUEwxHTAbBgNVBAoMFE5hcm9kb3d5IEJhbmsgUG9sc2tpMSYwJAYDVQQDDB1OYXJvZG93ZSBDZW50cnVtIENlcnR5ZmlrYWNqaTEZMBcGA1UEYQwQVkFUUEwtNTI1MDAwODE5OIIUQPj3irDjZBBWkcjZ4Cz4wcZACkYwMQYDVR0gAQH/BCcwJTAjBgRVHSAAMBswGQYIKwYBBQUHAgEWDXd3dy5uY2NlcnQucGwwDgYDVR0PAQH/BAQDAgbAMB0GA1UdDgQWBBSyvRLLB4Hie6OwYR1KQ3moh/TQdjANBgkqhkiG9w0BAQ0FAAOCAgEAkR6N1BwfIgO59t98HetjN+pCO1NOlXoRxiQMURmi1QnPeKJZYg4TPPOzsM5lQzo9s91XuYIHGlRvCactk8Z2FK9DPpJI670XfhJN+jNoADC09JupKh8YNfFdLNInDHjr5WK1qocfKgwvvgMH1SzjpuECDAr2PozwnmdSzd7hM6SlG6Yn0mEWb8WI7ElVdAa5no9R7jlJwUgPMpL3TM4SzPjfHVZlwnan5kUXurTLTT69duSc2hqosrESvw7m6vO+O0+QiDUpV10EBC17Y8YeGwDQFyhwHL6EC50uNtOySeG2z7BnBrqaeleP2UnJlQmkgxmYqz915JbcX9f2J13TU69H08fKvoF4n3bdn9eEl/RTSQ/lAv6p7kMuDGM+PA9ycvo9r6lES+PeB5IC29JRxN/C+eafN8+m9b0xfUF8GgSXOvqxA6KIfaD+EMhpWhzAY206KcDHmo2bBRFWDJ2Z36qWK7jhcOq5M/mT4mY5QuoeTxbTMHiMKqZzUumG+UhEG3jJOxR9dVthMS+DxrbYNsH4z2l3U+0Dp+U9KH+qBioxz42IdbOZAkzzR5dMZah/6EXW5Ft7EFR0VgXUH3pAOTyK/N1PAoz+9SuQQn71FW/bfwhelaOefSh6+jkYO9TzrVPJAQw0V2QARd4Y9A6qF2XwiTyjzewLHdj8ptMR3VY=</Base64Encoded>
        </Certificate>
        <Certificate Id="0FF278B32EDFED379544338C15EC9BC9EC6DE753C6FC6C68CBB8F7A831D44F21">
            <SubjectDistinguishedName Format="CANONICAL">[...]</SubjectDistinguishedName>
            <SubjectDistinguishedName Format="RFC2253">[...]</SubjectDistinguishedName>
            <IssuerDistinguishedName Format="CANONICAL">2.5.4.97=#0c10564154504c2d35313730333539343538,cn=certum qca 2017,o=asseco data systems s.a.,c=pl</IssuerDistinguishedName>
            <IssuerDistinguishedName Format="RFC2253">2.5.4.97=#0c10564154504c2d35313730333539343538,CN=Certum QCA 2017,O=Asseco Data Systems S.A.,C=PL</IssuerDistinguishedName>
            <SerialNumber>[...]</SerialNumber>
            <CommonName>[...]</CommonName>
            <CountryName>PL</CountryName>
            <GivenName>[...]</GivenName>
            <Surname>[...]</Surname>
            <AuthorityInformationAccessUrls>
                <Url>http://repository.certum.pl/qca_2017.cer</Url>
            </AuthorityInformationAccessUrls>
            <CRLDistributionPoints>
                <Url>http://qca.crl.certum.pl/qca_2017.crl</Url>
            </CRLDistributionPoints>
            <OCSPAccessUrls>
                <Url>http://qca-2017.qocsp-certum.com</Url>
            </OCSPAccessUrls>
            <DigestAlgoAndValues>
                <DigestAlgoAndValue>
                    <DigestMethod>SHA256</DigestMethod>
                    <DigestValue>D/J4sy7f7TeVRDOMFeybyext51PG/Gxoy7j3qDHUTyE=</DigestValue>
                </DigestAlgoAndValue>
            </DigestAlgoAndValues>
            <NotAfter>2021-02-10T22:14:08</NotAfter>
            <NotBefore>2019-02-11T22:14:08</NotBefore>
            <PublicKeySize>2048</PublicKeySize>
            <PublicKeyEncryptionAlgo>RSA</PublicKeyEncryptionAlgo>
            <KeyUsageBits>
                <KeyUsage>nonRepudiation</KeyUsage>
                <KeyUsage>digitalSignature</KeyUsage>
            </KeyUsageBits>
            <ExtendedKeyUsages/>
            <IdPkixOcspNoCheck>false</IdPkixOcspNoCheck>
            <BasicSignature>
                <EncryptionAlgoUsedToSignThisToken>RSA</EncryptionAlgoUsedToSignThisToken>
                <KeyLengthUsedToSignThisToken>4096</KeyLengthUsedToSignThisToken>
                <DigestAlgoUsedToSignThisToken>SHA256</DigestAlgoUsedToSignThisToken>
                <ReferenceDataFound>true</ReferenceDataFound>
                <ReferenceDataIntact>true</ReferenceDataIntact>
                <SignatureIntact>true</SignatureIntact>
                <SignatureValid>true</SignatureValid>
            </BasicSignature>
            <SigningCertificate Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914"/>
            <CertificateChain>
                <ChainItem Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914">
                    <Source>TRUSTED_LIST</Source>
                </ChainItem>
            </CertificateChain>
            <Trusted>false</Trusted>
            <SelfSigned>false</SelfSigned>
            <CertificatePolicies>
                <certificatePolicy Description="qcp-natural-qscd">0.4.0.194112.1.2</certificatePolicy>
                <certificatePolicy cpsUrl="http://www.certum.pl/repozytorium">1.2.616.1.113527.2.4.1.12.1</certificatePolicy>
            </CertificatePolicies>
            <QCStatementIds>
                <oid Description="qc-compliance">0.4.0.1862.1.1</oid>
                <oid Description="qc-sscd">0.4.0.1862.1.4</oid>
                <oid Description="qc-pds">0.4.0.1862.1.5</oid>
                <oid>0.4.0.1862.1.6</oid>
            </QCStatementIds>
            <QCTypes>
                <oid Description="qc-type-esign">0.4.0.1862.1.6.1</oid>
            </QCTypes>
            <TrustedServiceProviders>
                <TrustedServiceProvider>
                    <TSPName>Asseco Data Systems S.A.</TSPName>
                    <TSPRegistrationIdentifier>VATPL-5170359458</TSPRegistrationIdentifier>
                    <CountryCode>PL</CountryCode>
                    <TrustedServices>
                        <TrustedService>
                            <ServiceName>Certification authority issuing qualified certificates</ServiceName>
                            <ServiceType>http://uri.etsi.org/TrstSvc/Svctype/CA/QC</ServiceType>
                            <Status>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted</Status>
                            <StartDate>2017-09-25T12:00:00</StartDate>
                            <CapturedQualifiers>
                                <Qualifier>http://uri.etsi.org/TrstSvc/TrustedList/SvcInfoExt/QCForESig</Qualifier>
                                <Qualifier>http://uri.etsi.org/TrstSvc/TrustedList/SvcInfoExt/QCWithQSCD</Qualifier>
                                <Qualifier>http://uri.etsi.org/TrstSvc/TrustedList/SvcInfoExt/QCStatement</Qualifier>
                            </CapturedQualifiers>
                            <AdditionalServiceInfoUris>
                                <URI>http://uri.etsi.org/TrstSvc/TrustedList/SvcInfoExt/ForeSignatures</URI>
                                <URI>http://uri.etsi.org/TrstSvc/TrustedList/SvcInfoExt/ForeSeals</URI>
                            </AdditionalServiceInfoUris>
                            <ServiceSupplyPoints>
                                <URI>http://qca.crl.certum.pl/qca_2017.crl</URI>
                            </ServiceSupplyPoints>
                        </TrustedService>
                    </TrustedServices>
                </TrustedServiceProvider>
            </TrustedServiceProviders>
            <Revocations>
                <Revocation Id="0ff278b32edfed379544338c15ec9bc9ec6de753c6fc6c68cbb8f7a831d44f21e656ce513922afbffee4a2af979d95462dba58f56cc74ecb44430c908e9c2586">
                    <Origin>EXTERNAL</Origin>
                    <Source>CRLToken</Source>
                    <SourceAddress>http://qca.crl.certum.pl/qca_2017.crl</SourceAddress>
                    <Available>true</Available>
                    <Status>true</Status>
                    <ProductionDate>2019-04-16T05:46:14</ProductionDate>
                    <ThisUpdate>2019-04-16T05:46:14</ThisUpdate>
                    <NextUpdate>2019-04-17T05:46:14</NextUpdate>
                    <DigestAlgoAndValues>
                        <DigestAlgoAndValue>
                            <DigestMethod>SHA256</DigestMethod>
                            <DigestValue>5lbOUTkir7/+5KKvl52VRi26WPVsx07LREMMkI6cJYY=</DigestValue>
                        </DigestAlgoAndValue>
                    </DigestAlgoAndValues>
                    <BasicSignature>
                        <EncryptionAlgoUsedToSignThisToken>RSA</EncryptionAlgoUsedToSignThisToken>
                        <KeyLengthUsedToSignThisToken>4096</KeyLengthUsedToSignThisToken>
                        <DigestAlgoUsedToSignThisToken>SHA512</DigestAlgoUsedToSignThisToken>
                        <ReferenceDataFound>true</ReferenceDataFound>
                        <ReferenceDataIntact>true</ReferenceDataIntact>
                        <SignatureIntact>true</SignatureIntact>
                        <SignatureValid>true</SignatureValid>
                    </BasicSignature>
                    <SigningCertificate Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914"/>
                    <CertificateChain>
                        <ChainItem Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914">
                            <Source>TRUSTED_LIST</Source>
                        </ChainItem>
                    </CertificateChain>
                    <Info/>
                </Revocation>
            </Revocations>
            <Info>
                <Message Id="0">No CRL info found !</Message>
            </Info>
            <Base64Encoded>[...]</Base64Encoded>
        </Certificate>
    </UsedCertificates>
    <TrustedLists>
        <TrustedList>
            <CountryCode>PL</CountryCode>
            <Url>https://www.nccert.pl/tsl/PL_TSL.xml</Url>
            <SequenceNumber>105</SequenceNumber>
            <Version>5</Version>
            <LastLoading>2019-04-16T08:22:01</LastLoading>
            <IssueDate>2019-03-15T01:00:00</IssueDate>
            <NextUpdate>2019-06-14T00:00:00</NextUpdate>
            <WellSigned>true</WellSigned>
        </TrustedList>
    </TrustedLists>
    <ListOfTrustedLists>
        <CountryCode>EU</CountryCode>
        <Url>https://ec.europa.eu/information_society/policy/esignature/trusted-list/tl-mp.xml</Url>
        <SequenceNumber>238</SequenceNumber>
        <Version>5</Version>
        <LastLoading>2019-04-16T08:21:59</LastLoading>
        <IssueDate>2019-04-04T12:00:00</IssueDate>
        <NextUpdate>2019-10-04T00:00:00</NextUpdate>
        <WellSigned>true</WellSigned>
    </ListOfTrustedLists>
</DiagnosticData>

----------------Validation report---------------
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<DetailedReport xmlns="http://dss.esig.europa.eu/validation/detailed-report">
    <Signatures Id="id-0d5c90b084135f343a2314d0ea973930">
        <ValidationProcessBasicSignatures BestSignatureTime="2019-04-16T08:34:14">
            <Constraint Id="id-0d5c90b084135f343a2314d0ea973930">
                <Name NameId="ADEST_ROBVPIIC">Is the result of the Basic Validation Process conclusive?</Name>
                <Status>NOT OK</Status>
                <Error NameId="ADEST_ROBVPIIC_ANS">The result of the Basic validation process is not conclusive!</Error>
            </Constraint>
            <Conclusion>
                <Indication>FAILED</Indication>
                <SubIndication>SIG_CONSTRAINTS_FAILURE</SubIndication>
                <Errors NameId="BBB_SAV_ISQPSTP_ANS">The signed qualifying property: 'signing-time' is not present!</Errors>
            </Conclusion>
        </ValidationProcessBasicSignatures>
        <ValidationSignatureQualification SignatureQualification="Not AdES but QC with QSCD">
            <Constraint>
                <Name NameId="QUAL_IS_ADES">Is the signature/seal an acceptable AdES (ETSI EN 319 102-1) ?</Name>
                <Status>WARNING</Status>
                <Warning NameId="QUAL_IS_ADES_INV">The signature/seal is not a valid AdES!</Warning>
            </Constraint>
            <Constraint>
                <Name NameId="QUAL_TRUSTED_CERT_PATH">Is the certificate path trusted?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint Id="EU">
                <Name NameId="QUAL_TRUSTED_LIST_ACCEPT">Is the trusted list acceptable?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint Id="PL">
                <Name NameId="QUAL_TRUSTED_LIST_ACCEPT">Is the trusted list acceptable?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="QUAL_QC_AT_ST">Is the certificate qualified at (best) signing time?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="QUAL_FOR_SIGN_AT_ST">Is the certificate for eSig at (best) signing time?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="QUAL_QC_AT_CC">Is the certificate qualified at issuance time?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="QUAL_QSCD_AT_ST">Is the private key on a QSCD at (best) signing time?</Name>
                <Status>OK</Status>
            </Constraint>
            <Conclusion>
                <Indication>INDETERMINATE</Indication>
                <Warnings NameId="QUAL_IS_ADES_INV">The signature/seal is not a valid AdES!</Warnings>
            </Conclusion>
            <ValidationCertificateQualification DateTime="2019-02-11T22:14:08" ValidationTime="CERTIFICATE_ISSUANCE_TIME" CertificateQualification="QC Cert for ESig with QSCD">
                <Constraint>
                    <Name NameId="QUAL_HAS_CAQC">Is the certificate related to a CA/QC?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_HAS_GRANTED">Is the certificate related to a trust service with a granted status?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_TL_SERV_CONS">Is the trust service consistent ?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_IS_TRUST_CERT_MATCH_SERVICE">Is the trusted certificate match the trust service ?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_QC_AT_CC">Is the certificate qualified at issuance time?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_FOR_SIGN_AT_CC">Is the certificate for eSig at issuance time?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_QSCD_AT_CC">Is the private key on a QSCD at issuance time?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Conclusion>
                    <Indication>PASSED</Indication>
                </Conclusion>
            </ValidationCertificateQualification>
            <ValidationCertificateQualification DateTime="2019-04-16T08:34:14" ValidationTime="BEST_SIGNATURE_TIME" CertificateQualification="QC Cert for ESig with QSCD">
                <Constraint>
                    <Name NameId="QUAL_HAS_CAQC">Is the certificate related to a CA/QC?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_HAS_GRANTED">Is the certificate related to a trust service with a granted status?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_TL_SERV_CONS">Is the trust service consistent ?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_IS_TRUST_CERT_MATCH_SERVICE">Is the trusted certificate match the trust service ?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_QC_AT_ST">Is the certificate qualified at (best) signing time?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_FOR_SIGN_AT_ST">Is the certificate for eSig at (best) signing time?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="QUAL_QSCD_AT_ST">Is the private key on a QSCD at (best) signing time?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Conclusion>
                    <Indication>PASSED</Indication>
                </Conclusion>
            </ValidationCertificateQualification>
        </ValidationSignatureQualification>
    </Signatures>
    <BasicBuildingBlocks Id="id-0d5c90b084135f343a2314d0ea973930" Type="SIGNATURE">
        <FC>
            <Constraint>
                <Name NameId="BBB_FC_IEFF">Is the expected format found?</Name>
                <Status>OK</Status>
            </Constraint>
            <Conclusion>
                <Indication>PASSED</Indication>
            </Conclusion>
        </FC>
        <ISC>
            <Constraint>
                <Name NameId="BBB_ICS_ISCI">Is there an identified candidate for the signing certificate?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="BBB_ICS_ISCS">Is the signing certificate signed?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="BBB_ICS_ISASCP">Is the signed attribute: 'signing-certificate' present?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="BBB_ICS_ISACDP">Is the signed attribute: 'cert-digest' of the certificate present?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="BBB_ICS_ICDVV">Is the certificate's digest value valid?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="BBB_ICS_AIDNASNE">Are the issuer distinguished name and the serial number equal?</Name>
                <Status>OK</Status>
            </Constraint>
            <Conclusion>
                <Indication>PASSED</Indication>
            </Conclusion>
            <CertificateChain>
                <ChainItem Id="[...]">
                    <Source>UNKNOWN</Source>
                </ChainItem>
                <ChainItem Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914">
                    <Source>TRUSTED_LIST</Source>
                </ChainItem>
            </CertificateChain>
        </ISC>
        <VCI>
            <Constraint>
                <Name NameId="BBB_VCI_ISPK">Is the signature policy known?</Name>
                <Status>OK</Status>
            </Constraint>
            <Conclusion>
                <Indication>PASSED</Indication>
            </Conclusion>
        </VCI>
        <CV>
            <Constraint>
                <Name NameId="BBB_CV_IRDOF">Is the reference data object(s) found?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="BBB_CV_IRDOI">Is the reference data object(s) intact?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint>
                <Name NameId="BBB_CV_ISI">Is the signature intact?</Name>
                <Status>OK</Status>
            </Constraint>
            <Conclusion>
                <Indication>PASSED</Indication>
            </Conclusion>
        </CV>
        <SAV>
            <Constraint>
                <Name NameId="BBB_SAV_ISQPSTP">Is signed qualifying property: 'signing-time' present?</Name>
                <Status>NOT OK</Status>
                <Error NameId="BBB_SAV_ISQPSTP_ANS">The signed qualifying property: 'signing-time' is not present!</Error>
            </Constraint>
            <Conclusion>
                <Indication>FAILED</Indication>
                <SubIndication>SIG_CONSTRAINTS_FAILURE</SubIndication>
                <Errors NameId="BBB_SAV_ISQPSTP_ANS">The signed qualifying property: 'signing-time' is not present!</Errors>
            </Conclusion>
        </SAV>
        <XCV>
            <Constraint>
                <Name NameId="BBB_XCV_CCCBB">Can the certificate chain be built till the trust anchor?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint Id="0FF278B32EDFED379544338C15EC9BC9EC6DE753C6FC6C68CBB8F7A831D44F21">
                <Name NameId="BBB_XCV_SUB">Is the certificate validation concluant ?</Name>
                <Status>OK</Status>
            </Constraint>
            <Constraint Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914">
                <Name NameId="BBB_XCV_SUB">Is the certificate validation concluant ?</Name>
                <Status>OK</Status>
            </Constraint>
            <Conclusion>
                <Indication>PASSED</Indication>
            </Conclusion>
            <SubXCV Id="0FF278B32EDFED379544338C15EC9BC9EC6DE753C6FC6C68CBB8F7A831D44F21" TrustAnchor="false">
                <Constraint>
                    <Name NameId="QUAL_UNIQUE_CERT">Is the certificate unique ?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_PSEUDO_USE">Is pseudo used ?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_ISNSSC">Is not self-signed certificate?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_ICSI">Is the certificate's signature intact?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="ASCCM">Are signature cryptographic constraints met?</Name>
                    <Status>OK</Status>
                    <AdditionalInfo>Validation time : 2019-04-16 08:34</AdditionalInfo>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_ISCGKU">Has the signer's certificate given key-usage?</Name>
                    <Status>OK</Status>
                    <AdditionalInfo>Key usage : nonRepudiation, digitalSignature</AdditionalInfo>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_AIA_PRES">Is authority info access present?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_REVOC_PRES">Is revocation info access present?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_ICTIVRSC">Is the current time in the validity range of the signer's certificate?</Name>
                    <Status>OK</Status>
                    <AdditionalInfo>Certificate validity : 2019-02-11 22:14 to 2021-02-10 22:14</AdditionalInfo>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_ISCR">Is the certificate not revoked?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_ISCOH">Is the certificate on hold?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Constraint>
                    <Name NameId="BBB_XCV_RFC">Is the revocation freshness check concluant ?</Name>
                    <Status>OK</Status>
                </Constraint>
                <Conclusion>
                    <Indication>PASSED</Indication>
                </Conclusion>
                <RFC Id="0ff278b32edfed379544338c15ec9bc9ec6de753c6fc6c68cbb8f7a831d44f21e656ce513922afbffee4a2af979d95462dba58f56cc74ecb44430c908e9c2586">
                    <Constraint>
                        <Name NameId="BBB_XCV_IRDPFC">Is the revocation data present for the certificate?</Name>
                        <Status>OK</Status>
                    </Constraint>
                    <Constraint>
                        <Name NameId="BBB_RFC_NUP">Is there a Next Update defined for the revocation data?</Name>
                        <Status>OK</Status>
                    </Constraint>
                    <Constraint>
                        <Name NameId="BBB_RFC_IRIF">Is the revocation information fresh for the certificate?</Name>
                        <Status>OK</Status>
                        <AdditionalInfo>Next update : 2019-04-17 05:46</AdditionalInfo>
                    </Constraint>
                    <Constraint>
                        <Name NameId="ASCCM">Are signature cryptographic constraints met?</Name>
                        <Status>OK</Status>
                        <AdditionalInfo>Validation time : 2019-04-16 08:34</AdditionalInfo>
                    </Constraint>
                    <Conclusion>
                        <Indication>PASSED</Indication>
                    </Conclusion>
                </RFC>
            </SubXCV>
            <SubXCV Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914" TrustAnchor="true">
                <Conclusion>
                    <Indication>PASSED</Indication>
                </Conclusion>
            </SubXCV>
        </XCV>
        <CertificateChain>
            <ChainItem Id="[...]">
                <Source>UNKNOWN</Source>
            </ChainItem>
            <ChainItem Id="ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914">
                <Source>TRUSTED_LIST</Source>
            </ChainItem>
        </CertificateChain>
        <Conclusion>
            <Indication>FAILED</Indication>
            <SubIndication>SIG_CONSTRAINTS_FAILURE</SubIndication>
            <Errors NameId="BBB_SAV_ISQPSTP_ANS">The signed qualifying property: 'signing-time' is not present!</Errors>
        </Conclusion>
    </BasicBuildingBlocks>
    <TLAnalysis CountryCode="EU">
        <Constraint>
            <Name NameId="QUAL_TL_FRESH">Is the trusted list fresh ?</Name>
            <Status>OK</Status>
        </Constraint>
        <Constraint>
            <Name NameId="QUAL_TL_EXP">Is the trusted list not expired ?</Name>
            <Status>OK</Status>
        </Constraint>
        <Constraint>
            <Name NameId="QUAL_TL_VERSION">Is the trusted list has the expected version ?</Name>
            <Status>OK</Status>
        </Constraint>
        <Constraint>
            <Name NameId="QUAL_TL_WS">Is the trusted list well signed ?</Name>
            <Status>OK</Status>
        </Constraint>
        <Conclusion>
            <Indication>PASSED</Indication>
        </Conclusion>
    </TLAnalysis>
    <TLAnalysis CountryCode="PL">
        <Constraint>
            <Name NameId="QUAL_TL_FRESH">Is the trusted list fresh ?</Name>
            <Status>OK</Status>
        </Constraint>
        <Constraint>
            <Name NameId="QUAL_TL_EXP">Is the trusted list not expired ?</Name>
            <Status>OK</Status>
        </Constraint>
        <Constraint>
            <Name NameId="QUAL_TL_VERSION">Is the trusted list has the expected version ?</Name>
            <Status>OK</Status>
        </Constraint>
        <Constraint>
            <Name NameId="QUAL_TL_WS">Is the trusted list well signed ?</Name>
            <Status>OK</Status>
        </Constraint>
        <Conclusion>
            <Indication>PASSED</Indication>
        </Conclusion>
    </TLAnalysis>
</DetailedReport>

----------------Simple report-------------------
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<SimpleReport xmlns="http://dss.esig.europa.eu/validation/simple-report">
    <Policy>
        <PolicyName>QES AdESQC TL based</PolicyName>
        <PolicyDescription>Validate electronic signatures and indicates whether they are Advanced electronic Signatures (AdES), AdES supported by a Qualified Certificate (AdES/QC) or a
		Qualified electronic Signature (QES). All certificates and their related chains supporting the signatures are validated against the EU Member State Trusted Lists (this includes
		signer's certificate and certificates used to validate certificate validity status services - CRLs, OCSP, and time-stamps).
	</PolicyDescription>
    </Policy>
    <ValidationTime>2019-04-16T08:34:14</ValidationTime>
    <DocumentName></DocumentName>
    <ValidSignaturesCount>0</ValidSignaturesCount>
    <SignaturesCount>1</SignaturesCount>
    <Signature Id="id-0d5c90b084135f343a2314d0ea973930" SignatureFormat="CAdES-BASELINE-T">
        <BestSignatureTime>2019-04-16T08:34:14</BestSignatureTime>
        <SignedBy>[...]</SignedBy>
        <CertificateChain>
            <Certificate>
                <id>[...]</id>
                <qualifiedName>[...]</qualifiedName>
            </Certificate>
            <Certificate>
                <id>ED380189EB280F5D86C914BFDD28D89795E5676AE893F3C3D75B12F3E42CC914</id>
                <qualifiedName>Certum QCA 2017</qualifiedName>
            </Certificate>
        </CertificateChain>
        <SignatureLevel description="Not Advanced Electronic Signature but supported by a Qualified Certificate">Not AdES but QC with QSCD</SignatureLevel>
        <Indication>TOTAL_FAILED</Indication>
        <SubIndication>SIG_CONSTRAINTS_FAILURE</SubIndication>
        <Errors>The result of the Basic validation process is not conclusive!</Errors>
        <Errors>The signed qualifying property: 'signing-time' is not present!</Errors>
        <Warnings>The signature/seal is not a valid AdES!</Warnings>
        <SignatureScope name="Full document" scope="FullSignatureScope">Full document</SignatureScope>
    </Signature>
</SimpleReport>

---------------- Document ------------------
<?xml version="1.0" encoding="utf-8"?>
<rejestracjaCertyfikatu xmlns="http://www.giif.mofnet.gov.pl/xsd/rest/certyfikaty20171017">
<csr>[...]</csr>

Istotny jest poniższy fragment w sekcji Simple report.

<Indication>TOTAL_FAILED</Indication>
<SubIndication>SIG_CONSTRAINTS_FAILURE</SubIndication>
<Errors>The result of the Basic validation process is not conclusive!</Errors>
<Errors>The signed qualifying property: 'signing-time' is not present!</Errors>

Jak widać problem leży w atrybucie signing-time. Początkowo podejrzewałem, że atrybut ten nie został umieszczony w dokumencie lub znalazł się wśród nie podpisanych atrybutów.

Jednak po wydaniu polecenia:

1	openssl cms -cmsout -noout -inform DER -in plik.sig -inform DER -print

otrzymałem poniższy wynik.

[...]
    signerInfos:
        version: 1
        d.issuerAndSerialNumber: 
          issuer: C=PL, O=Asseco Data Systems S.A., CN=Certum QCA 2017/2.5.4.97=VATPL-5170359458
          serialNumber: [...]
        digestAlgorithm: 
          algorithm: sha256 (2.16.840.1.101.3.4.2.1)
          parameter: NULL
        signedAttrs:
            object: contentType (1.2.840.113549.1.9.3)
            value.set:
              OBJECT:pkcs7-data (1.2.840.113549.1.7.1)

            object: signingTime (1.2.840.113549.1.9.5)
            value.set:
              GENERALIZEDTIME:Apr 15 12:02:40 2019 GMT

            object: id-smime-aa-ets-commitmentType (1.2.840.113549.1.9.16.2.16)
            value.set:
              SEQUENCE:
    0:d=0  hl=2 l=  13 cons: SEQUENCE          
    2:d=1  hl=2 l=  11 prim:  OBJECT            :id-smime-cti-ets-proofOfOrigin

              SEQUENCE:
    0:d=0  hl=2 l=  13 cons: SEQUENCE          
    2:d=1  hl=2 l=  11 prim:  OBJECT            :id-smime-cti-ets-proofOfCreation
[...]

Czyli atrybut signingTime o OID:1.2.840.113549.1.9.5 występuje i jest podpisany.

Następnie porównałem to z moim plikiem testowym z pierwszej części wpisu o flow:

signerInfos:
    version: 1
    d.issuerAndSerialNumber: 
      issuer: C=PL, O=Asseco Data Systems S.A., CN=Certum QCA 2017/2.5.4.97=VATPL-5170359458
      serialNumber: 34381343500300685680795199330219258600
    digestAlgorithm: 
      algorithm: sha256 (2.16.840.1.101.3.4.2.1)
      parameter: NULL
    signedAttrs:
        object: id-smime-aa-ets-sigPolicyId (1.2.840.113549.1.9.16.2.15)
        value.set:
          NULL

        object: contentType (1.2.840.113549.1.9.3)
        value.set:
          OBJECT:pkcs7-data (1.2.840.113549.1.7.1)

        object: signingTime (1.2.840.113549.1.9.5)
        value.set:
          UTCTIME:Apr  4 10:03:46 2019 GMT

Atrybuty różnią się, nieprawidłowy plik ma wartość typu GENERALIZEDTIME a prawidłowy typu UTCTIME.

Tutaj przyda się odwołanie do RFC 5652:

Dates between 1 January 1950 and 31 December 2049 (inclusive) MUST be encoded as UTCTime. Any dates with year values before 1950 or after 2049 MUST be encoded as GeneralizedTime.

Czyli plik był odrzucany, gdyż walidator rygorystycznie przestrzega zgodności ze RFC 5652, na którym bazuje specyfikacja CAdES.

Przyjmowanie danych w SI*GIIF

Notatki o systemie SI*GIIF

Brak ważnego podpisu.