Digital signatures · C# and .NET
Digitally sign a PDF in C#
Add a cryptographic PKCS#7 or PAdES signature to a PDF from C#. rust-pdf signs through a non-destructive incremental update, so the original bytes are preserved and the signature stays verifiable in Adobe Reader, pdfsig and any PAdES validator.
Last updated: 2026-06-29
Why C# and .NET needs this
Most .NET shops already hold their signing credential as a .pfx or in the Windows certificate store. Load it with X509Certificate2, export the pieces rust-pdf expects, cert.Export(X509ContentType.Cert) for the X.509 DER and the private key as PKCS#8 DER, and hand both byte arrays to Pdf.Sign. No PEM juggling and no OpenSSL shell-out.
Signing is a static Pdf.Sign call that returns the signed bytes, which slots straight into a Web API controller or minimal-API handler that streams the result back as application/pdf. Because the core appends an incremental update, the original document is preserved byte for byte and any earlier signature stays valid; pades: true switches the subfilter to ETSI.CAdES.detached for B-B, and you can follow with a DSS and an RFC 3161 timestamp for B-LT and B-LTA.
The native library ships inside the NuGet package and is located at runtime by a NativeLibrary.SetDllImportResolver hook, so the same code signs on a developer's Windows box and inside a dotnet/aspnet:8.0 Linux container with no rebuild. Signing is gated by a Signatures license; without it Pdf.Sign throws a PdfException you can map to an HTTP error response.
- PKCS#7 detached and PAdES B-B, with B-LT and B-LTA for long-term validation.
- Incremental update: the original file is preserved byte for byte, so earlier signatures stay valid.
- Bring your own key and X.509 certificate (PKCS#8 DER), or chain to a TSA for timestamps.
Sign a PDF in C# with rust-pdf
Install with NuGet, then call the same idiomatic API every rust-pdf binding shares. The snippet below is real C# code from the reference docs.
dotnet add package RustPdf
using RustPdf;
byte[] pdf = File.ReadAllBytes("contract.pdf");
byte[] keyDer = File.ReadAllBytes("signing-key.pkcs8.der"); // PKCS#8 private key (DER)
byte[] certDer = File.ReadAllBytes("signing-cert.der"); // X.509 certificate (DER)
byte[] signed = Pdf.Sign(pdf, keyDer, certDer,
reason: "Approved", location: "New York",
name: "Jane Doe", pades: true);
File.WriteAllBytes("contract.signed.pdf", signed);
// Verify in a shell: pdfsig contract.signed.pdf → "Signature is Valid."C# basic generation is free. Signing is a corporate feature, unlocked by one offline license token. See pricing & licensing.
Full C# reference in the documentation.
Signing in C#: FAQ
Is the signature legally valid?
rust-pdf produces standards-compliant PKCS#7 and PAdES signatures. Legal validity depends on the certificate you sign with (for example an eIDAS qualified certificate or an ICP-Brasil certificate). The library handles the cryptography and the PDF structure correctly, which is what validators such as pdfsig and Adobe Reader check.
Does it support long-term validation (LTV)?
Yes. After signing you can append a Document Security Store with certificates and CRLs (PAdES B-LT) and an RFC 3161 document timestamp (PAdES B-LTA), all offline. A trusted external TSA and live OCSP fetching are the only parts that need network infrastructure.
Do I need a license to sign in C#?
Signing is a corporate feature, so it requires an active license token. Basic PDF generation in C# is free. The same offline Ed25519 token unlocks signing across every language.
Can I sign with an X509Certificate2 or .pfx in .NET?
Yes. Load your credential with new X509Certificate2("cred.pfx", password), export the certificate as DER via Export(X509ContentType.Cert) and the RSA private key as PKCS#8 DER, then pass both byte arrays to Pdf.Sign. The library builds the detached CMS itself, so you never pull in BouncyCastle, and pdfsig and Adobe Reader confirm the result is valid.
Bring PAdES signatures to your .NET API
One Rust core, the same output across every language. Prototype for free, license the corporate features when you ship.