diff --git a/pkix/src/main/java/org/bouncycastle/operator/BufferingContentSigner.java b/pkix/src/main/java/org/bouncycastle/operator/BufferingContentSigner.java
index d174367299..7426caf2a9 100644
--- a/pkix/src/main/java/org/bouncycastle/operator/BufferingContentSigner.java
+++ b/pkix/src/main/java/org/bouncycastle/operator/BufferingContentSigner.java
@@ -67,4 +67,14 @@ public byte[] getSignature()
     {
         return contentSigner.getSignature();
     }
+
+    @Override
+    public void close() throws Exception
+    {
+        output.close();
+        if (contentSigner != null)
+        {
+            contentSigner.close();
+        }
+    }
 }
diff --git a/pkix/src/main/java/org/bouncycastle/operator/ContentSigner.java b/pkix/src/main/java/org/bouncycastle/operator/ContentSigner.java
index 2274a19fc7..fe5a9faf9e 100644
--- a/pkix/src/main/java/org/bouncycastle/operator/ContentSigner.java
+++ b/pkix/src/main/java/org/bouncycastle/operator/ContentSigner.java
@@ -8,7 +8,7 @@
  * General interface for an operator that is able to create a signature from
  * a stream of output.
  */
-public interface ContentSigner
+public interface ContentSigner extends AutoCloseable
 {
     /**
      * Return the algorithm identifier describing the signature
diff --git a/pkix/src/main/java/org/bouncycastle/operator/bc/BcContentSignerBuilder.java b/pkix/src/main/java/org/bouncycastle/operator/bc/BcContentSignerBuilder.java
index a7b45fcbfb..667e71bf07 100644
--- a/pkix/src/main/java/org/bouncycastle/operator/bc/BcContentSignerBuilder.java
+++ b/pkix/src/main/java/org/bouncycastle/operator/bc/BcContentSignerBuilder.java
@@ -1,5 +1,6 @@
 package org.bouncycastle.operator.bc;
 
+import java.io.IOException;
 import java.io.OutputStream;
 import java.security.SecureRandom;
 import java.util.Map;
@@ -51,7 +52,7 @@ public ContentSigner build(AsymmetricKeyParameter privateKey)
 
         return new ContentSigner()
         {
-            private BcSignerOutputStream stream = new BcSignerOutputStream(sig);
+            private final BcSignerOutputStream stream = new BcSignerOutputStream(sig);
 
             public AlgorithmIdentifier getAlgorithmIdentifier()
             {
@@ -74,6 +75,12 @@ public byte[] getSignature()
                     throw new RuntimeOperatorException("exception obtaining signature: " + e.getMessage(), e);
                 }
             }
+
+            @Override
+            public void close() throws IOException
+            {
+                stream.close();
+            }
         };
     }
 
diff --git a/pkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentSignerBuilder.java b/pkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentSignerBuilder.java
index f219b11b1c..a8922daf45 100644
--- a/pkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentSignerBuilder.java
+++ b/pkix/src/main/java/org/bouncycastle/operator/jcajce/JcaContentSignerBuilder.java
@@ -125,7 +125,7 @@ public ContentSigner build(PrivateKey privateKey)
 
             return new ContentSigner()
             {
-                private OutputStream stream = OutputStreamFactory.createStream(sig);
+                private final OutputStream stream = OutputStreamFactory.createStream(sig);
 
                 public AlgorithmIdentifier getAlgorithmIdentifier()
                 {
@@ -148,6 +148,12 @@ public byte[] getSignature()
                         throw new RuntimeOperatorException("exception obtaining signature: " + e.getMessage(), e);
                     }
                 }
+
+                @Override
+                public void close() throws IOException
+                {
+                    stream.close();
+                }
             };
         }
         catch (GeneralSecurityException e)
@@ -189,7 +195,7 @@ private ContentSigner buildComposite(CompositePrivateKey privateKey)
 
             return new ContentSigner()
             {
-                OutputStream stream = sigStream;
+                final OutputStream stream = sigStream;
 
                 public AlgorithmIdentifier getAlgorithmIdentifier()
                 {
@@ -223,6 +229,15 @@ public byte[] getSignature()
                         throw new RuntimeOperatorException("exception obtaining signature: " + e.getMessage(), e);
                     }
                 }
+
+                @Override
+                public void close() throws Exception
+                {
+                    if (stream != null)
+                    {
+                        stream.close();
+                    }
+                }
             };
         }
         catch (GeneralSecurityException e)