System.setProperty("com.sun.security.enableCRLDP", "true");
        System.setProperty("com.ibm.security.enableCRLDP", "true");
        System.setProperty("ru.CryptoPro.notThrowIfChainIsInvalid", "true");

		try {
			KeyStore keyStore = KeyStore.getInstance(keyStoreType, keyStoreProvider);
			keyStore.load(null, keyStorePassword.toCharArray());

			//читаем сертификат с носителя
			Enumeration<String> enumeration = keyStore.aliases();
			String alias = null;
			if (enumeration.hasMoreElements())                    // One certificate per USB key
				alias = (String) enumeration.nextElement();
			if (alias==null)
				throw new Exception ("No certificate found in container");

			X509Certificate keyCert = (X509Certificate) keyStore.getCertificate(alias);

			//читаем корневой и промежуточные сертификаты
			String folderPath = keysCertificateFolder;
			List<X509Certificate> certificates = getCertificatesFromFolder(folderPath);
			X509Certificate[] keyCertChain = new X509Certificate[certificates.size() + 1];
			keyCertChain[0] = keyCert;
			for (int j = 1; j < certificates.size() + 1; j++) {
				keyCertChain[j] = certificates.get(j - 1);
			}

                        //HDImageStore
			String pathToKeyStore = "xxx\\3dbe6165.000";
			KeyStore jks = KeyStore.getInstance("HDImageStore");
			jks.load(null, keyStorePassword.toCharArray());

			//копируем в хранилище HDImageStore сертификат с цепочкой
			jks.setKeyEntry(alias, keyStore.getKey(alias, keyStorePassword.toCharArray()),
					keyStorePassword.toCharArray(), keyCertChain);

			PrivateKey privateKey = (PrivateKey) jks.getKey(alias, keyStorePassword.toCharArray());

			List<X509Certificate> chain = new ArrayList<>();

			// Получаем цепочку сертификатов.
			List<Certificate> lChain = Arrays.asList(jks.getCertificateChain(alias));

			// Конвертируем цепочку в X509Certificate.
			Collection<X509Certificate> xChain = Arrays.asList((lChain).toArray(new X509Certificate[lChain.size()]));

			chain.addAll(xChain);


			//Создаем CAdES подпись.
	        CAdESSignature cadesSignature = new CAdESSignature(false); //detached = false
	        cadesSignature.setCertificateStore(null);
	        cadesSignature.setCRLStore(null);

	        cadesSignature.addSigner(
	        		JCP.PROVIDER_NAME
	        		, getDigestOid(privateKey)
	        		, getPublicKeyOid(privateKey)
	        		, privateKey
	        		, chain
	        		, CAdESType.CAdES_BES
	        		, null
	        		, false);

	private Set<X509CRL> getCRLsFromFolder(String folderName) throws Exception {
		Set<X509CRL> result = new HashSet<>();
		CertificateFactory cf = CertificateFactory.getInstance("X509");
		try {
			List<Path> files = Files.walk(Paths.get(folderName))
					.filter(Files::isRegularFile)
					.collect(Collectors.toList());
			for (Path path : files) {
				X509CRL crl;
				String contents = new String(Files.readAllBytes(path));
				System.out.println("CRL contents: " + contents);

				//contents = new String(Base64.getDecoder().decode(contents), "UTF-8");//эксперименты с кодировками

				try (InputStream in = new ByteArrayInputStream(contents.getBytes()) ){
					crl = (X509CRL)cf.generateCRL(in);
					result.add(crl);
				}
			}
		} catch (Exception e) {
			throw new Exception("Failed to retrieve any certificates from the input file", e);
		}
		return result;
	}

//так читаем CRL из файлов
	private CollectionStore getCRLsFromFolder(String folderName) throws Exception {
		Set<X509CRLHolder> crlList = new HashSet<>();
		try {
			List<Path> files = Files.walk(Paths.get(folderName))
					.filter(Files::isRegularFile)
					.collect(Collectors.toList());
			for (Path path : files) {
				try (PEMParser pemParser = new PEMParser(new FileReader(path.toFile().getAbsolutePath())) ){
					X509CRLHolder crlHolder = (X509CRLHolder) pemParser.readObject();
					if (crlHolder != null)
						crlList.add(crlHolder);
				}
			}
		} catch (Exception e) {
			throw new Exception("Failed to retrieve any crl from folder " + folderName, e);
		}
		return new CollectionStore(crlList);
	}



        //и затем пытаемся подставить crl в метод подписания, чтобы читался именно наш исправленный СОС

                System.setProperty("com.sun.security.enableCRLDP", "false");  //пробовала true и false - результат одинаковый
                System.setProperty("ocsp.enable", "false");                   //пробовала true и false - результат одинаковый

	        CAdESSignature cadesSignature = new CAdESSignature(false); //detached = false
	        cadesSignature.setCertificateStore(null);

		CollectionStore crlStore = getCRLsFromFolder("...\\crl");
	        cadesSignature.setCRLStore(crlStore);

	        cadesSignature.addSigner(
	        		JCP.PROVIDER_NAME
	        		, getDigestOid(privateKey)
	        		, getPublicKeyOid(privateKey)
	        		, privateKey
	        		, chain
	        		, CAdESType.CAdES_BES
	        		, null
	        		, false);