var
  cert: PCCERT_CONTEXT;
  MessageArray: array of PByte;
  MessageSize: array of DWORD;
  SigParams: CRYPT_SIGN_MESSAGE_PARA;
  cbSignedMessageBlob: DWORD;
  pbSignedMessageBlob: PByte;
  pStreamIn, pStreamOut: TMemoryStream;

..

pStreamIn := TMemoryStream.Create;
try
  pStreamOut := TMemoryStream.Create;
  try
    SetLength(MessageArray, 1);
    SetLength(MessageSize, 1);

    pStreamIn.LoadFromFile(AFile);
    MessageArray[0] := pStreamIn.Memory;
    MessageSize[0] := pStreamIn.Size;
    FillChar(SigParams, SizeOf(CRYPT_SIGN_MESSAGE_PARA), #0);
    //ZeroMemory(@SigParams, SizeOf(CRYPT_SIGN_MESSAGE_PARA));
    SigParams.cbSize := SizeOF(CRYPT_SIGN_MESSAGE_PARA);
    SigParams.dwMsgEncodingType := PKCS_7_ASN_ENCODING or X509_ASN_ENCODING;
    SigParams.pSigningCert := cert;
    SigParams.HashAlgorithm.pszObjId := '1.2.643.2.2.9';
    SigParams.cMsgCert := 1;
    SigParams.rgpMsgCert := @cert;

    cbSignedMessageBlob := 0;
    if (not (CryptSignMessage(@SigParams,
                          True {для Detached},
                          1,
                          @MessageArray,
                          @MessageSize,
                          nil,
                          cbSignedMessageBlob))) then
      begin
        ShowMessage(SysErrorMessage(GetLastError) + ' - ' + IntToStr(GetLastError));
        Exit;
      end;

    pStreamOut.SetSize(cbSignedMessageBlob);
    GetMem(pbSignedMessageBlob, cbSignedMessageBlob);
    try
      if (not (CryptSignMessage(@SigParams,
                            True {для Detached},
                            1,
                            @MessageArray,
                            @MessageSize,
                            pbSignedMessageBlob, // pStreamOut.Memory,
                            cbSignedMessageBlob))) then
        begin
          // после обновления Крипто-ПРО здесь уже код ошибки [b]87[/b] - Параметр задан неверно 
          ShowMessage(SysErrorMessage(GetLastError) + ' - ' + IntToStr(GetLastError));
          Exit;
        end;
      pStreamOut.SetSize(cbSignedMessageBlob);
      pStreamOut.WriteBuffer(pbSignedMessageBlob, cbSignedMessageBlob);
      pStreamOut.SaveToFile(AFile + '.sig');
    finally
      FreeMem(pbSignedMessageBlob, cbSignedMessageBlob);
    end;
  finally
    FreeAndNil(pStreamOut);
  end;
finally
  FreeAndNil(pStreamIn);
end;