Introduction
Mudrit — a pure-Rust PDF digital-signing SDK with PAdES baseline profiles, LTV, RFC-3161 timestamps, RSA/ECDSA, encrypted output, and first-class certificate pickers.
Mudrit is a pure-Rust PDF digital-signing SDK. It signs PDFs to standards-grade profiles (PAdES B-B / B-T / B-LT / B-LTA), attaches RFC-3161 timestamps and long-term-validation data, supports RSA (PKCS#1 v1.5 + PSS) and ECDSA (P-256 / P-384 / P-521), encrypts its output (AES-128 / AES-256), and ships both a native Windows and a cross-platform certificate picker — with no OpenSSL and no Python.
The PDF engine accepts any key source through one small Signer trait — a PFX file, the Windows
store, a PKCS#11 token, or your own HSM / cloud KMS. Implement one trait and the whole pipeline works
unchanged.
New to digital signatures?
Start with Digital signatures 101 for the ideas, then Getting Started to sign your first PDF. Keep the Glossary handy for the acronyms (PAdES, LTV, DSC, PKCS#11, …).
Sign a PDF in five lines
use mudrit::prelude::*;
let signer = PfxSigner::from_file("cert.pfx", "password")?;
let cfg = SignConfig::builder().place("L", [350, 60, 560, 160])?.build();
let signed = sign_pdf(std::fs::read("in.pdf")?, &signer, &cfg)?;
std::fs::write("signed.pdf", &signed)?;Swapping PfxSigner for WinStoreSigner::select()? or Pkcs11Signer::open(dll, pin, serial)? is
the only change needed to sign from the Windows store or a token — the config and sign_pdf
call stay identical.
What Mudrit does
Any key source
PFX file, Windows store, PKCS#11 token, or a custom Signer (HSM / cloud KMS). One trait,
one pipeline.
Standards-grade output
PAdES B-B / B-T / B-LT / B-LTA, LTV (DSS with CRL + OCSP), RFC-3161 timestamps, and document timestamps.
RSA & ECDSA
RSA PKCS#1 v1.5, RSA-PSS, and ECDSA P-256 / P-384 / P-521 — with SHA-256 / 384 / 512.
Rich appearances
Logos, handwritten graphics, watermarks, embedded Unicode fonts (Devanagari / CJK / Arabic), and the layered validity icon.
Encrypted documents
Sign password-protected inputs and produce AES-128 / AES-256 encrypted, signed output.
Certificate pickers
A native Windows dialog and a brandable, cross-platform Iced picker for PKCS#11 tokens.
Architecture
Mudrit is a Cargo workspace of three independently usable, pure-Rust crates:
mudrit-keystore key management — the Signer trait + KeyStore discovery
+ 3 backends (PfxSigner, Pkcs11Signer, WinStoreSigner)
+ cross-platform Iced Pkcs11Picker (feature: pkcs11-picker)
│
▼ (the PDF signer depends on key management)
mudrit-pdfsign PDF signing engine — CMS/PKCS#7, RFC-3161 TSA, LTV/DSS
│
▼ (facade re-exports both)
mudrit all-in-one bundle — `use mudrit::prelude::*;` + `pick_and_sign`Depend on mudrit-keystore alone for pure key management (no PDF), on mudrit-pdfsign for the
engine with your own Signer, or on mudrit for the whole bundle. Cargo features
decide exactly what compiles — the GUI stack is opt-in.
Where to go next
Getting Started
Install the crates, choose your features, and sign your first PDF.
Concepts
The signing flow, algorithms, and the standards Mudrit implements.
Guides
Task-focused how-tos for every feature — backends, appearance, LTV, encryption, and more.
Cookbook
60+ runnable examples, grouped by use case.
Reference
The full in-site API reference for every public type, trait, and function.
Certificate pickers
Let a person choose a certificate — native or cross-platform.
Test certificate
The bundled samples/ABC12.pfx is a TEST certificate (DS TEST CERTIFICATE 06, password
ABC12) used by the examples and tests. Use your own DSC for real signing. A viewer shows the
green "trusted" tick only when the certificate chains to a trusted root (Adobe AATL, the Windows
store, or a CCA root).
Licensing
Mudrit is a proprietary SDK distributed under licence by Trexolab. Getting Started covers private-access install; contact Trexolab for a licence and credentials.