diff -rupN openssl-1.0.1g-orig/apps/cms.c openssl-1.0.1g-patched/apps/cms.c
--- openssl-1.0.1g-orig/apps/cms.c	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/apps/cms.c	2014-04-19 21:25:49.790804805 +0200
@@ -65,6 +65,7 @@
 #include <openssl/x509_vfy.h>
 #include <openssl/x509v3.h>
 #include <openssl/cms.h>
+#include <openssl/ts.h>
 
 #undef PROG
 #define PROG cms_main
@@ -132,6 +133,7 @@ int MAIN(int argc, char **argv)
 	const EVP_MD *sign_md = NULL;
 	int informat = FORMAT_SMIME, outformat = FORMAT_SMIME;
         int rctformat = FORMAT_SMIME, keyform = FORMAT_PEM;
+
 #ifndef OPENSSL_NO_ENGINE
 	char *engine=NULL;
 #endif
@@ -244,6 +246,8 @@ int MAIN(int argc, char **argv)
 				flags |= CMS_NO_SIGNER_CERT_VERIFY;
 		else if (!strcmp (*args, "-nocerts")) 
 				flags |= CMS_NOCERTS;
+		else if (!strcmp (*args, "-cades")) 
+				flags |= CMS_CADES;
 		else if (!strcmp (*args, "-noattr")) 
 				flags |= CMS_NOATTR;
 		else if (!strcmp (*args, "-nodetach")) 
@@ -621,6 +625,7 @@ int MAIN(int argc, char **argv)
 		BIO_printf (bio_err, "-nosigs        don't verify message signature\n");
 		BIO_printf (bio_err, "-noverify      don't verify signers certificate\n");
 		BIO_printf (bio_err, "-nocerts       don't include signers certificate when signing\n");
+		BIO_printf (bio_err, "-cades         include signer certificate digest\n");
 		BIO_printf (bio_err, "-nodetach      use opaque signing\n");
 		BIO_printf (bio_err, "-noattr        don't include any signed attributes\n");
 		BIO_printf (bio_err, "-binary        don't translate message to text\n");
@@ -1017,6 +1022,44 @@ int MAIN(int argc, char **argv)
 			si = CMS_add1_signer(cms, signer, key, sign_md, flags);
 			if (!si)
 				goto end;
+
+			if (flags & CMS_CADES) 
+				{
+				ASN1_STRING *seq = NULL;
+				unsigned char *p, *pp = NULL;
+				int len;
+				ESS_SIGNING_CERT *sc = NULL;
+				ESS_CERT_ID *cid;
+
+			        /* Create the SigningCertificateV2 attribute. */
+
+				if (!(sc = ESS_SIGNING_CERT_new())) goto end;
+
+				/* Adding the signing certificate id. */
+				if (!(cid = ESS_CERT_ID_new())) goto end;
+				if (!ASN1_OCTET_STRING_set(cid->hash, signer->sha256_hash,
+							   sizeof(signer->sha256_hash)))
+				goto end;
+
+				if (!sk_ESS_CERT_ID_push(sc->cert_ids, cid)) goto end;
+
+			        /* Add SigningCertificateV2 signed attribute to the signer info. */
+
+				len = i2d_ESS_SIGNING_CERT(sc, NULL);
+				if (!(pp = (unsigned char *) OPENSSL_malloc(len))) goto end;
+
+				p = pp;
+				i2d_ESS_SIGNING_CERT(sc, &p);
+				if (!(seq = ASN1_STRING_new()) || !ASN1_STRING_set(seq, pp, len))
+				goto end;
+
+				OPENSSL_free(pp); pp = NULL;
+
+				CMS_signed_add1_attr_by_NID(si, NID_id_smime_aa_signingCertificateV2,
+                                                V_ASN1_SEQUENCE,
+                                                seq, -1);
+				}
+
 			if (rr && !CMS_add1_ReceiptRequest(si, rr))
 				goto end;
 			X509_free(signer);
diff -rupN openssl-1.0.1g-orig/crypto/cms/cms.h openssl-1.0.1g-patched/crypto/cms/cms.h
--- openssl-1.0.1g-orig/crypto/cms/cms.h	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/crypto/cms/cms.h	2014-04-19 21:22:15.673742995 +0200
@@ -112,6 +112,7 @@ DECLARE_ASN1_PRINT_FUNCTION(CMS_ContentI
 #define CMS_REUSE_DIGEST		0x8000
 #define CMS_USE_KEYID			0x10000
 #define CMS_DEBUG_DECRYPT		0x20000
+#define CMS_CADES			0x40000
 
 const ASN1_OBJECT *CMS_get0_type(CMS_ContentInfo *cms);
 
diff -rupN openssl-1.0.1g-orig/crypto/objects/obj_dat.h openssl-1.0.1g-patched/crypto/objects/obj_dat.h
--- openssl-1.0.1g-orig/crypto/objects/obj_dat.h	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/crypto/objects/obj_dat.h	2014-04-19 21:08:31.277655103 +0200
@@ -62,12 +62,12 @@
  * [including the GNU Public Licence.]
  */
 
-#define NUM_NID 920
-#define NUM_SN 913
-#define NUM_LN 913
-#define NUM_OBJ 857
+#define NUM_NID 921
+#define NUM_SN 914
+#define NUM_LN 914
+#define NUM_OBJ 858
 
-static const unsigned char lvalues[5980]={
+static const unsigned char lvalues[5991]={
 0x00,                                        /* [  0] OBJ_undef */
 0x2A,0x86,0x48,0x86,0xF7,0x0D,               /* [  1] OBJ_rsadsi */
 0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,          /* [  7] OBJ_pkcs */
@@ -925,6 +925,7 @@ static const unsigned char lvalues[5980]
 0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x08,/* [5952] OBJ_mgf1 */
 0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x0A,/* [5961] OBJ_rsassaPss */
 0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x07,/* [5970] OBJ_rsaesOaep */
+0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x09,0x10,0x02,0x2F,/* [5979] OBJ_id_smime_aa_signingCertificateV2 */
 };
 
 static const ASN1_OBJECT nid_objs[NUM_NID]={
@@ -2406,6 +2407,9 @@ static const ASN1_OBJECT nid_objs[NUM_NI
 {"AES-256-CBC-HMAC-SHA1","aes-256-cbc-hmac-sha1",
 	NID_aes_256_cbc_hmac_sha1,0,NULL,0},
 {"RSAES-OAEP","rsaesOaep",NID_rsaesOaep,9,&(lvalues[5970]),0},
+{"id-smime-aa-signingCertificateV2",
+	"id-smime-aa-signingCertificateV2",
+	NID_id_smime_aa_signingCertificateV2,11,&(lvalues[5979]),0},
 };
 
 static const unsigned int sn_objs[NUM_SN]={
@@ -2931,6 +2935,7 @@ static const unsigned int sn_objs[NUM_SN
 213,	/* "id-smime-aa-securityLabel" */
 239,	/* "id-smime-aa-signatureType" */
 223,	/* "id-smime-aa-signingCertificate" */
+920,	/* "id-smime-aa-signingCertificateV2" */
 224,	/* "id-smime-aa-smimeEncryptCerts" */
 225,	/* "id-smime-aa-timeStampToken" */
 192,	/* "id-smime-alg" */
@@ -3832,6 +3837,7 @@ static const unsigned int ln_objs[NUM_LN
 213,	/* "id-smime-aa-securityLabel" */
 239,	/* "id-smime-aa-signatureType" */
 223,	/* "id-smime-aa-signingCertificate" */
+920,	/* "id-smime-aa-signingCertificateV2" */
 224,	/* "id-smime-aa-smimeEncryptCerts" */
 225,	/* "id-smime-aa-timeStampToken" */
 192,	/* "id-smime-alg" */
@@ -5073,6 +5079,7 @@ static const unsigned int obj_objs[NUM_O
 238,	/* OBJ_id_smime_aa_ets_archiveTimeStamp 1 2 840 113549 1 9 16 2 27 */
 239,	/* OBJ_id_smime_aa_signatureType    1 2 840 113549 1 9 16 2 28 */
 240,	/* OBJ_id_smime_aa_dvcs_dvc         1 2 840 113549 1 9 16 2 29 */
+920,	/* OBJ_id_smime_aa_signingCertificateV2 1 2 840 113549 1 9 16 2 47 */
 241,	/* OBJ_id_smime_alg_ESDHwith3DES    1 2 840 113549 1 9 16 3 1 */
 242,	/* OBJ_id_smime_alg_ESDHwithRC2     1 2 840 113549 1 9 16 3 2 */
 243,	/* OBJ_id_smime_alg_3DESwrap        1 2 840 113549 1 9 16 3 3 */
diff -rupN openssl-1.0.1g-orig/crypto/objects/objects.txt openssl-1.0.1g-patched/crypto/objects/objects.txt
--- openssl-1.0.1g-orig/crypto/objects/objects.txt	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/crypto/objects/objects.txt	2014-04-19 16:35:34.464446760 +0200
@@ -290,6 +290,7 @@ id-smime-aa 26		: id-smime-aa-ets-certCR
 id-smime-aa 27		: id-smime-aa-ets-archiveTimeStamp
 id-smime-aa 28		: id-smime-aa-signatureType
 id-smime-aa 29		: id-smime-aa-dvcs-dvc
+id-smime-aa 47		: id-smime-aa-signingCertificateV2
 
 # S/MIME Algorithm Identifiers
 # obsolete
diff -rupN openssl-1.0.1g-orig/crypto/objects/obj_mac.h openssl-1.0.1g-patched/crypto/objects/obj_mac.h
--- openssl-1.0.1g-orig/crypto/objects/obj_mac.h	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/crypto/objects/obj_mac.h	2014-04-19 21:08:19.365596030 +0200
@@ -968,6 +968,10 @@
 #define NID_id_smime_aa_dvcs_dvc		240
 #define OBJ_id_smime_aa_dvcs_dvc		OBJ_id_smime_aa,29L
 
+#define SN_id_smime_aa_signingCertificateV2		"id-smime-aa-signingCertificateV2"
+#define NID_id_smime_aa_signingCertificateV2		920
+#define OBJ_id_smime_aa_signingCertificateV2		OBJ_id_smime_aa,47L
+
 #define SN_id_smime_alg_ESDHwith3DES		"id-smime-alg-ESDHwith3DES"
 #define NID_id_smime_alg_ESDHwith3DES		241
 #define OBJ_id_smime_alg_ESDHwith3DES		OBJ_id_smime_alg,1L
diff -rupN openssl-1.0.1g-orig/crypto/objects/obj_mac.num openssl-1.0.1g-patched/crypto/objects/obj_mac.num
--- openssl-1.0.1g-orig/crypto/objects/obj_mac.num	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/crypto/objects/obj_mac.num	2014-04-19 21:08:19.357595995 +0200
@@ -917,3 +917,4 @@ aes_128_cbc_hmac_sha1		916
 aes_192_cbc_hmac_sha1		917
 aes_256_cbc_hmac_sha1		918
 rsaesOaep		919
+id_smime_aa_signingCertificateV2		920
diff -rupN openssl-1.0.1g-orig/crypto/x509/x509.h openssl-1.0.1g-patched/crypto/x509/x509.h
--- openssl-1.0.1g-orig/crypto/x509/x509.h	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/crypto/x509/x509.h	2014-04-19 16:08:41.580448967 +0200
@@ -305,6 +305,9 @@ struct x509_st
 #ifndef OPENSSL_NO_SHA
 	unsigned char sha1_hash[SHA_DIGEST_LENGTH];
 #endif
+#ifndef OPENSSL_NO_SHA256
+	unsigned char sha256_hash[SHA256_DIGEST_LENGTH];
+#endif
 	X509_CERT_AUX *aux;
 	} /* X509 */;
 
diff -rupN openssl-1.0.1g-orig/crypto/x509v3/v3_purp.c openssl-1.0.1g-patched/crypto/x509v3/v3_purp.c
--- openssl-1.0.1g-orig/crypto/x509v3/v3_purp.c	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/crypto/x509v3/v3_purp.c	2014-04-19 16:10:05.660866132 +0200
@@ -368,6 +368,9 @@ static void x509v3_cache_extensions(X509
 #ifndef OPENSSL_NO_SHA
 	X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
 #endif
+#ifndef OPENSSL_NO_SHA256
+	X509_digest(x, EVP_sha256(), x->sha256_hash, NULL);
+#endif
 	/* Does subject name match issuer ? */
 	if(!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x)))
 			 x->ex_flags |= EXFLAG_SI;
diff -rupN openssl-1.0.1g-orig/include/openssl/cms.h openssl-1.0.1g-patched/include/openssl/cms.h
--- openssl-1.0.1g-orig/include/openssl/cms.h	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/include/openssl/cms.h	2014-04-19 21:22:15.673742995 +0200
@@ -112,6 +112,7 @@ DECLARE_ASN1_PRINT_FUNCTION(CMS_ContentI
 #define CMS_REUSE_DIGEST		0x8000
 #define CMS_USE_KEYID			0x10000
 #define CMS_DEBUG_DECRYPT		0x20000
+#define CMS_CADES			0x40000
 
 const ASN1_OBJECT *CMS_get0_type(CMS_ContentInfo *cms);
 
diff -rupN openssl-1.0.1g-orig/include/openssl/obj_mac.h openssl-1.0.1g-patched/include/openssl/obj_mac.h
--- openssl-1.0.1g-orig/include/openssl/obj_mac.h	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/include/openssl/obj_mac.h	2014-04-19 21:08:19.365596030 +0200
@@ -968,6 +968,10 @@
 #define NID_id_smime_aa_dvcs_dvc		240
 #define OBJ_id_smime_aa_dvcs_dvc		OBJ_id_smime_aa,29L
 
+#define SN_id_smime_aa_signingCertificateV2		"id-smime-aa-signingCertificateV2"
+#define NID_id_smime_aa_signingCertificateV2		920
+#define OBJ_id_smime_aa_signingCertificateV2		OBJ_id_smime_aa,47L
+
 #define SN_id_smime_alg_ESDHwith3DES		"id-smime-alg-ESDHwith3DES"
 #define NID_id_smime_alg_ESDHwith3DES		241
 #define OBJ_id_smime_alg_ESDHwith3DES		OBJ_id_smime_alg,1L
diff -rupN openssl-1.0.1g-orig/include/openssl/x509.h openssl-1.0.1g-patched/include/openssl/x509.h
--- openssl-1.0.1g-orig/include/openssl/x509.h	2014-03-17 17:14:20.000000000 +0100
+++ openssl-1.0.1g-patched/include/openssl/x509.h	2014-04-19 16:08:41.580448967 +0200
@@ -305,6 +305,9 @@ struct x509_st
 #ifndef OPENSSL_NO_SHA
 	unsigned char sha1_hash[SHA_DIGEST_LENGTH];
 #endif
+#ifndef OPENSSL_NO_SHA256
+	unsigned char sha256_hash[SHA256_DIGEST_LENGTH];
+#endif
 	X509_CERT_AUX *aux;
 	} /* X509 */;
 
