Detector Configuration

A detectors list loads only the detectors it names — every other detector is dropped. To add a detector while keeping the default detection chain, include a default-detector entry (the same pattern as default-parser; see Configuration).

Enabling the PKCS7/CMS detector

Content detection of ASN.1/DER cryptographic containers is coarse by default: a CMS/PKCS7 message is detected as application/pkcs7-signature, and the exact CMS subtype (signed vs. enveloped vs. certs-only) is refined by Pkcs7Parser at parse time — it is set on the output content type, the same way PDFParser refines a PDF to application/illustrator.

If you need that subtype from Tika.detect() without parsing, enable the opt-in pkcs-7-detector. It is not loaded by default (so the common detect path stays cheap and does no ASN.1 work on every stream); add it ahead of default-detector:

{
  "detectors": [
    { "pkcs-7-detector": {} },
    { "default-detector": {} }
  ]
}

View source on GitHub

List pkcs-7-detector before default-detector. It returns a parameterized application/pkcs7-mime; smime-type=…​, which is a sibling of the magic detector’s application/pkcs7-signature (neither is a specialization of the other). A CompositeDetector replaces the running type only with a strict specialization, so of two sibling results it keeps the first — the opt-in detector must run first to win.

Tika.detect() on a signed CMS message then returns application/pkcs7-mime; smime-type=signed-data instead of the coarse application/pkcs7-signature, as verified end-to-end in ConfigExamplesTest.

The default magic-only path already identifies the crypto families — PKCS7/CMS, RFC 5544 timestamped-data, PKCS12. Enable this detector only when a routing or downstream decision depends on the CMS subtype before parsing.