Digital signatures · Ruby
Digitally sign a PDF in Ruby
Add a cryptographic PKCS#7 or PAdES signature to a PDF from Ruby. rust-pdf signs through a non-destructive incremental update, so the original bytes are preserved and the signature stays verifiable in Adobe Reader, pdfsig and any PAdES validator.
Last updated: 2026-06-29
Why Ruby needs this
Prawn can lay out a contract beautifully, but it cannot sign one, so Ruby shops have historically driven OpenSSL by hand or shelled out to a Java tool just to attach a PKCS#7 blob to the bytes. rust-pdf assembles the signature itself.
A real digital signature proves who approved a document and that nothing changed afterwards. rust-pdf builds the detached CMS by hand to control the ByteRange, signs through a non-destructive incremental update so earlier signatures stay valid, and supports PAdES B-B, B-LT and B-LTA for long-term validation.
Read your PEM or PKCS#12 with Ruby's openssl module, convert it to PKCS#8 and X.509 DER, then call RustPdf.sign from a Rails request or an ActiveJob worker; wrap it in begin/rescue so a missing Signatures license surfaces as a handled RustPdf::Error.
- PKCS#7 detached and PAdES B-B, with B-LT and B-LTA for long-term validation.
- Incremental update: the original file is preserved byte for byte, so earlier signatures stay valid.
- Bring your own key and X.509 certificate (PKCS#8 DER), or chain to a TSA for timestamps.
Sign a PDF in Ruby with rust-pdf
Install with RubyGems, then call the same idiomatic API every rust-pdf binding shares. The snippet below is real Ruby code from the reference docs.
gem install rustpdf
pdf = File.binread("contract.pdf")
key_der = File.binread("signing-key.pkcs8.der") # PKCS#8 private key (DER)
cert_der = File.binread("signing-cert.der") # X.509 certificate (DER)
signed = RustPdf.sign(pdf, key_der, cert_der,
reason: "Approved", location: "New York",
name: "Jane Doe", pades: true)
File.binwrite("contract.signed.pdf", signed)
# Verify in a shell: pdfsig contract.signed.pdf → "Signature is Valid."Ruby basic generation is free. Signing is a corporate feature, unlocked by one offline license token. See pricing & licensing.
Full Ruby reference in the documentation.
Signing in Ruby: FAQ
Is the signature legally valid?
rust-pdf produces standards-compliant PKCS#7 and PAdES signatures. Legal validity depends on the certificate you sign with (for example an eIDAS qualified certificate or an ICP-Brasil certificate). The library handles the cryptography and the PDF structure correctly, which is what validators such as pdfsig and Adobe Reader check.
Does it support long-term validation (LTV)?
Yes. After signing you can append a Document Security Store with certificates and CRLs (PAdES B-LT) and an RFC 3161 document timestamp (PAdES B-LTA), all offline. A trusted external TSA and live OCSP fetching are the only parts that need network infrastructure.
Do I need a license to sign in Ruby?
Signing is a corporate feature, so it requires an active license token. Basic PDF generation in Ruby is free. The same offline Ed25519 token unlocks signing across every language.
What key formats does signing accept in Ruby?
Pass the private key as PKCS#8 DER and the certificate as X.509 DER. If you hold a PEM file or a PKCS#12 bundle, convert it once with Ruby's openssl module, then call RustPdf.sign from a Rails request or an ActiveJob worker.
Bring trusted digital signatures to your Ruby stack
One Rust core, the same output across every language. Prototype for free, license the corporate features when you ship.