I am trying to decrypt (and later encrypt) an email message (ebXML). The message contains a Signature element that contains child elements to specify the SignedInfo, SignatureValue and KeyInfo. Also, the message contains an encrypted attachment.
The KeyInfo element contains two X509Data elements. Each of these specify a X509Certificate. Why are there two certificates? Is it one certificate for the message itself and one certificate for the attachment?
Most likely it’s an end-entity certificate and it’s CA certificate. You can check this by obtaining those certificates and comparing their Issuer and Subject properties.