Pure-Rust PDF digital-signing SDK

Digitally sign PDFs, to standard

Mudrit turns a PDF and any key source into a signed, standards-grade document — PAdES baseline profiles, LTV, RFC-3161 timestamps, RSA & ECDSA, and encrypted output — with no OpenSSL and no native dependencies.

Get Started Read the docs
No OpenSSLNo native dependenciesRust 1.74+Adobe-valid output
sign.rs
use mudrit::prelude::*;let signer = PfxSigner::from_file("cert.pfx", "pass")?;let cfg = SignConfig::builder()    .place("L", [350, 60, 560, 160])?    .approval()    .timestamp(Timestamp::url(DEFAULT_TSA_URL))    .ltv(true)    .build();let signed = sign_pdf(pdf, &signer, &cfg)?;
Output validates in Adobe Acrobat — signature valid, LTV enabled
Why Mudrit

Everything a signing pipeline needs

One trait between your key and the PDF engine — and a complete, standards-grade toolset on top of it.

One trait, any key source

PFX file, Windows store, PKCS#11 token, or your own HSM / cloud KMS. Implement one small Signer trait and the whole pipeline works unchanged.

Standards-grade output

PAdES B-B / B-T / B-LT / B-LTA, document timestamps, LTV (DSS with CRL + OCSP), RFC-3161 timestamps, and Adobe-valid certification.

Certificate pickers

A native Windows store picker and a cross-platform Iced picker for PKCS#11 tokens — brandable, localizable, dark-mode aware.

Lean & modular

Three independently usable crates. Cargo features decide exactly what compiles — the GUI stack is opt-in, and there are no C dependencies.

Encrypted documents

Sign password-protected inputs and emit AES-128 / AES-256 encrypted, signed output — with per-document permissions.

Long-term validity

Embed the certificate chain, CRLs and OCSP into the DSS, then renew with document timestamps for archival-grade signatures.

Any key source

Swap one line, nothing else

Every backend is a Signer. The SignConfig and sign_pdf call stay identical.

PFX / P12 file

Offline signing, no prompt. RSA and ECDSA (P-256 / P-384 / P-521).

PfxSigner::from_file("cert.pfx", "pass")?

Windows store

Native CryptoAPI / CNG. The OS handles the PIN prompt at sign time.

WinStoreSigner::select()?

PKCS#11 token

Any module (.dll / .so / .dylib), cross-platform, by serial.

Pkcs11Signer::open(dll, pin, serial)?
Built for compliance

Standards-grade, verified externally

Signatures validate in Adobe Acrobat and pyHanko across every profile Mudrit produces.

PAdES B-B / B-T / B-LT / B-LTALTV (DSS · CRL + OCSP)RFC-3161 timestampsDocument timestampsRSA PKCS#1 + PSSECDSA P-256 / P-384 / P-521AES-128 / AES-256 outputPDF/A-2BDocMDP certificationDetached CMS / PKCS#7

Start signing in minutes

Add the crate, choose your features, and sign your first PDF with a few lines of Rust.

Get Started Browse the API

Proprietary SDK, licensed by Trexolab · contact Trexolab for access.