Digital signatures · Ruby
Digitally sign a PDF in Ruby
Add a cryptographic PKCS#7 or PAdES signature to a PDF from Ruby. rust-pdf signs through a non-destructive incremental update, so the original bytes are preserved and the signature stays verifiable in Adobe Reader, pdfsig and any PAdES validator.
Last updated: 2026-06-29
Why Ruby needs this
Prawn can lay out a contract beautifully, but it cannot sign one, so Ruby shops have historically driven OpenSSL by hand or shelled out to a Java tool just to attach a PKCS#7 blob to the bytes. rust-pdf assembles the signature itself.
A real digital signature proves who approved a document and that nothing changed afterwards. rust-pdf builds the detached CMS by hand to control the ByteRange, signs through a non-destructive incremental update so earlier signatures stay valid, and supports PAdES B-B, B-LT and B-LTA for long-term validation.
Read your PEM or PKCS#12 with Ruby's openssl module, convert it to PKCS#8 and X.509 DER, then call RustPdf.sign from a Rails request or an ActiveJob worker; wrap it in begin/rescue so a failure surfaces as a handled RustPdf::Error.
- PKCS#7 detached and PAdES B-B, with B-LT and B-LTA for long-term validation.
- Incremental update: the original file is preserved byte for byte, so earlier signatures stay valid.
- Bring your own key and X.509 certificate (PKCS#8 DER), or chain to a TSA for timestamps.
Sign a PDF in Ruby with rust-pdf
Install with RubyGems, then call the same idiomatic API every rust-pdf binding shares. The snippet below is real Ruby code from the reference docs.
gem install rustpdf
pdf = File.binread("contract.pdf")
key_der = File.binread("signing-key.pkcs8.der") # PKCS#8 private key (DER)
cert_der = File.binread("signing-cert.der") # X.509 certificate (DER)
signed = RustPdf.sign(pdf, key_der, cert_der,
reason: "Approved", location: "New York",
name: "Jane Doe", pades: true)
File.binwrite("contract.signed.pdf", signed)
# Verify in a shell: pdfsig contract.signed.pdf → "Signature is Valid."Everything is free.
Full Ruby reference in the documentation.
Signing in Ruby: FAQ
Is the signature legally valid?
rust-pdf produces standards-compliant PKCS#7 and PAdES signatures. Legal validity depends on the certificate you sign with (for example an eIDAS qualified certificate or an ICP-Brasil certificate). The library handles the cryptography and the PDF structure correctly, which is what validators such as pdfsig and Adobe Reader check.
Does it support long-term validation (LTV)?
Yes. After signing you can append a Document Security Store with certificates and CRLs (PAdES B-LT) and an RFC 3161 document timestamp (PAdES B-LTA), all offline. A trusted external TSA and live OCSP fetching are the only parts that need network infrastructure.
Is signing free in Ruby?
Signing is free, like every feature in rust-pdf.
What key formats does signing accept in Ruby?
Pass the private key as PKCS#8 DER and the certificate as X.509 DER. If you hold a PEM file or a PKCS#12 bundle, convert it once with Ruby's openssl module, then call RustPdf.sign from a Rails request or an ActiveJob worker.
Bring trusted digital signatures to your Ruby stack
One Rust core, the same output across every language. Every feature is free.