Backends

For the narrative tour — when to pick which backend, algorithm support, and a bring-your-own Signer example — see the Signing Backends guide. This page is the exhaustive API reference for the three bundled backends, their KeyStores, and the token types they return.

PfxSigner

Feature pfx · all platforms. Signs with a key + certificate loaded from a .pfx / .p12 file. Supports RSA (PKCS#1 v1.5 and PSS) and ECDSA P-256 / P-384 / P-521; the key type is detected at load time and the scheme defaults to the natural one for the key.

use mudrit_pdfsign::prelude::*;

let signer = PfxSigner::from_file("samples/ABC12.pfx", "ABC12")?;
let pss    = PfxSigner::from_file("rsa.pfx", "pw")?.with_algorithm(SignatureAlgorithm::RsaPssSha256)?;

PfxKeyStore

Feature pfx. A KeyStore over a single .pfx / .p12 file — one key, so aliases() always returns exactly one KeyEntry with alias "0".

Pkcs11Signer

Feature pkcs11 · all platforms. Signs using a certificate + key on a PKCS#11 token, selected by certificate serial. The session stays open (and logged in) for the signer's lifetime.

let signer = Pkcs11Signer::open(dll, pin, serial_hex)?;

Pkcs11KeyStore

Feature pkcs11. A KeyStore over one PKCS#11 module — each certificate on a connected token is one KeyEntry (alias = hex serial).

Pkcs11MultiStore

Feature pkcs11. Discover and sign across several PKCS#11 modules at once — e.g. an ePass token and a vendor token from different manufacturers. Listing reads certificates as public objects (no PIN); modules with no token connected, or that fail to load, are skipped so the others still list.

WinStoreSigner

Feature winstore · Windows only. Signs using a certificate from the Windows Current-User MY store via native CryptoAPI / CNG. The PIN prompt (and wrong-PIN count / lockout) is handled by the OS/provider at sign time — Mudrit never sees the PIN.

let signer = WinStoreSigner::from_thumbprint("AB12…")?;
let signer = WinStoreSigner::select()?;
let signer = WinStoreSigner::select_with(&CertFilter::default().signing_only(true))?;

WinStoreKeyStore

Feature winstore · Windows only. A KeyStore over the Windows Current-User MY store — each certificate matching the CertFilter is one KeyEntry (alias = thumbprint). Implements Default.

Off Windows, every WinStoreSigner / WinStoreKeyStore operation returns Error::Unsupported("the Windows certificate store is only available on Windows") — the types still compile (so cross-platform code links), they simply error at call time.

TokenCert

One certificate discovered on a PKCS#11 token (returned by Pkcs11MultiStore::tokens/list, and by Pkcs11Manager::list_certificates).

TokenInfo

A connected PKCS#11 token (one slot) and the certificates on it — all read without a PIN. Returned by Pkcs11MultiStore::tokens.

Feature and platform summary

All three are on by default. See Cargo Features for the full feature/dependency matrix and lean-build recipes.

Next