SigningCertificate is null when CMS contains duplicate certificate entries

[jhennessey]

Description

FileInspector.GetSignatures() will return signatures where SigningCertificate is null when there are duplicate certificates in the certificate set

Expected behavior

For each extracted signature, SigningCertificate should resolve when a matching signer certificate is present in the CMS certificate set

Actual behavior

SigningCertificate is null even though the signer certificate exists in the certificate set

Root Cause

Certificate resolution logic currently assumes a unique lookup result by serial number. However, some CMS payloads include duplicate instances of the same certificate. In those cases, lookup returns multiple matches and resolution fails despite a valid match being available.

Repro

• Use a signed file whose CMS contains duplicate certificate entries (the file I noticed this behavior was node.exe version 22.22.0.0)
• Call FileInspector.GetSignatures()
• Inspect each signature’s SigningCertificate
• Observe one or more null values.

Suggested fix

Make certificate lookup tolerant of duplicate matches that refer to the same certificate