function CryptSignMessage(pSignPara: PCRYPT_SIGN_MESSAGE_PARA;
  fDetachedSignature: BOOL; cToBeSigned: DWORD; rgpbToBeSigned: PByte;
  rgcbToBeSigned: Pointer; pbSignedBlob: PByte; var pcbSignedBlob: DWORD): BOOL;
  stdcall; external 'Crypt32.dll';

procedure SignStream(SignerCert: PCCERT_CONTEXT; ASourceStream: TStream;
  ADestStream: TStream; DetachedSignature: Boolean);
var
  SignPara: CRYPT_SIGN_MESSAGE_PARA;
  bToBeSigned: array of PByte;
  cToBeSigned: array of DWORD;
  pMsgCrl: array of PCCERT_CONTEXT;
  pbSignedBlob: PByte;
  cbSignedBlob: DWORD;
begin
  SetLength(bToBeSigned, 1);
  SetLength(cToBeSigned, 1);
  SetLength(pMsgCrl, 1);
  bToBeSigned[0] := GetMemory(ASourceStream.Size);
  cToBeSigned[0] := ASourceStream.Size;
  pMsgCrl[0] := SignerCert;
  cbSignedBlob := 0;
  try
    ASourceStream.Read(bToBeSigned[0]^, ASourceStream.Size);
    ZeroMemory(@SignPara, SizeOf(CRYPT_SIGN_MESSAGE_PARA));
    SignPara.cbSize := SizeOf(CRYPT_SIGN_MESSAGE_PARA);
    SignPara.dwMsgEncodingType := PKCS_7_ASN_ENCODING or X509_ASN_ENCODING;
    SignPara.pSigningCert := SignerCert;
    SignPara.HashAlgorithm.pszObjId := szOID_RSA_MD5;
    SignPara.HashAlgorithm.Parameters.cbData := 0;
    SignPara.HashAlgorithm.Parameters.pbData := nil;
    SignPara.cMsgCert := 1;
    SignPara.rgpMsgCert := Pointer(pMsgCrl);
    if not(CryptSignMessage(@SignPara, DetachedSignature, 1,
      Pointer(bToBeSigned), Pointer(cToBeSigned), nil, cbSignedBlob)) then
      RaiseLastOSError;
    pbSignedBlob := GetMemory(cbSignedBlob);
    try
      if not CryptSignMessage(@SignPara, DetachedSignature, 1,
        Pointer(bToBeSigned), Pointer(cToBeSigned), pbSignedBlob,
        cbSignedBlob) then
        RaiseLastOSError;
      ADestStream.Write(pbSignedBlob^, cbSignedBlob);
    finally
      FreeMemory(pbSignedBlob);
    end;
  finally
    FreeMemory(bToBeSigned[0]);
  end;
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  cert: PCCERT_CONTEXT;
  pStreamIn, pStreamOut: TMemoryStream;
  afile: string;
  my: hcertstore;
begin
  my := CertOpenSystemStore(0, 'MY');
  cert := CryptUIDlgSelectCertificateFromStore(my, 0, '', '', 0, 0, nil);
  afile := 'D:\ttt\request.xml';
  pStreamIn := TMemoryStream.Create;
  pStreamOut := TMemoryStream.Create;
  pStreamIn.LoadFromFile(afile);
  SignStream(cert, pStreamIn, pStreamOut, true);
  pStreamOut.SaveToFile(afile + '.sig');
  FreeAndNil(pStreamOut);
  FreeAndNil(pStreamIn);
end;