public byte[] sign(byte[] data) throws Exception {
    /* initialize data to sign with CMS structure */
    CMSTypedData msg = new CMSProcessableByteArray(data);

    /* create CMS signature data builder */
    CMSSignedDataGenerator gen = new CMSSignedDataGenerator();

    /* provide required certificates */
    gen.addCertificates(new JcaCertStore(Arrays.asList(certificate)));

    /* initialize content signer (message digest) */
//    ContentSigner contentSigner = new JcaContentSignerBuilder("SHA256withRSA") // это была бага
//            .setProvider("BC").build(privateKey);
    AlgorithmIdentifier sigAlgId = certificate.getSignatureAlgorithm();
    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
    ContentSigner contentSigner = new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
            .build(PrivateKeyFactory.createKey(privateKey.getEncoded()));

    /* initialize digest provider (where to get digest from) */
    DigestCalculatorProvider calculatorProvider = new JcaDigestCalculatorProviderBuilder()
            .setProvider("BC").build();

    /* Cades-bes signed attributes generator */
    CMSAttributeTableGenerator signedGen
            = new CadesBesSignedAttributeTableGenerator(certificate);

    /* force to add cades-bes attributes into CMS structure */
    SignerInfoGenerator signerInfoGenerator = new JcaSignerInfoGeneratorBuilder(calculatorProvider)
            .setSignedAttributeGenerator(signedGen)
            .build(contentSigner, certificate);
    gen.addSignerInfoGenerator(signerInfoGenerator);

    /* sign data */
    CMSSignedData signedData = gen.generate(msg, true);

    /* return signed CMS structure */
    return signedData.getEncoded();
}

/**
 * Cades-Bes attributes generator
 */
public class CadesBesSignedAttributeTableGenerator extends DefaultSignedAttributeTableGenerator {
    private static final Logger LOG = LoggerFactory.getLogger(CadesBesSignedAttributeTableGenerator.class);

    /**
     * Signer certificate to add into the attributes table
     */
    private final X509CertificateHolder signer;

    /**
     * Signing certificate version
     */
    private final int version;

    /**
     * Creates cades-bes attributes table generator
     *
     * @param signer signer certificate to add into the attributes table
     */
    public CadesBesSignedAttributeTableGenerator(X509CertificateHolder signer) {
        this(signer, 2);
    }

    /**
     * Creates cades-bes attributes table generator
     *
     * @param signer  signer certificate to add into the attributes table
     * @param version (1) to use default signing certificate or (2) to use signing certificate v2
     */
    public CadesBesSignedAttributeTableGenerator(X509CertificateHolder signer, int version) {
        this.signer = signer;
        this.version = version;
    }

    @Override
    protected Hashtable createStandardAttributeTable(Map parameters) {
        @SuppressWarnings({"unchecked"})
        Hashtable<ASN1ObjectIdentifier, Attribute> table = super.createStandardAttributeTable(parameters);

        switch (version) {
            case 1:
                // generate and add signing certificate (v1) into the attributes table
                addSigningCertificate(table);
                break;
            case 2:
                // generate and add signing certificate (v2) into the attributes table
                addSigningCertificateV2(table);
                break;
            default:
                throw new IllegalStateException("unsupported signing certificate version: " + version);
        }

        return table;
    }


    /**
     * Add signing certificate (v1) into the attributes table
     *
     * @param table attributes table to add signing certificate (v1) to
     */
    // IT WORKS!!!
    private void addSigningCertificate(Hashtable<ASN1ObjectIdentifier, Attribute> table) {
        LOG.trace("generate signing certificate v1");

        final IssuerSerial signerSerial = new IssuerSerial(
                new GeneralNames(new GeneralName(signer.getIssuer())),
                new DERInteger(signer.getSerialNumber()));

        ESSCertID essCertid = new ESSCertID(
                getSignerHash("SHA-1"), // sha-1 - required by specification
                signerSerial);

        table.put(PKCSObjectIdentifiers.id_aa_signingCertificate, new Attribute(
                PKCSObjectIdentifiers.id_aa_signingCertificate,
                new DERSet(new SigningCertificate(essCertid))
        ));
    }

    /**
     * Add signing certificate (v2) into the attributes table
     *
     * @param table attributes table to add signing certificate (v2) to
     */
    // IT WORKS TOO!!!
    private void addSigningCertificateV2(Hashtable<ASN1ObjectIdentifier, Attribute> table) {
        LOG.trace("generate signing certificate v2");

        final IssuerSerial signerSerial = new IssuerSerial(
                new GeneralNames(new GeneralName(signer.getIssuer())),
                new DERInteger(signer.getSerialNumber()));

        ESSCertIDv2 essCertid = new ESSCertIDv2(
                // sha-1 - is the only algorithm understanded by cspwrap.exe utility
                new AlgorithmIdentifier(X509ObjectIdentifiers.id_SHA1),
//                new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha512),
                getSignerHash("SHA-1"),
                signerSerial);

        table.put(PKCSObjectIdentifiers.id_aa_signingCertificateV2, new Attribute(
                PKCSObjectIdentifiers.id_aa_signingCertificateV2,
                new DERSet(new SigningCertificateV2(new ESSCertIDv2[]{essCertid}))
        ));
    }

    /**
     * Get hash of signer certificate
     *
     * @param algorithm algorithm to generate hash from the signer certificate
     * @return hash of signer certificate
     */
    private byte[] getSignerHash(String algorithm) {
        try {
            return MessageDigest.getInstance(algorithm).digest(signer.getEncoded());
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException(e);
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
    }
}