PKI Signing Service

Pure Rust code signing engine. Authenticode for Windows PE executables, detached CMS/PKCS#7 for any file, PowerShell script signing, and RFC 3161 timestamping. No OpenSSL. No signtool.exe. One binary.

Overview

How It Works

One binary, three modes. The same pki-sign binary runs as a CLI tool, a REST API server, or a standalone RFC 3161 TSA server.

                          pki-sign (single binary)
    ┌─────────────────────────────────────────────────────────┐
    │                                                         │
    │   ┌───────────┐    ┌──────────────┐    ┌────────────┐  │
    │   │    CLI    │    │   Web API    │    │ TSA Server │  │
    │   │           │    │  (axum)      │    │ (RFC 3161) │  │
    │   │ sign      │    │ :6447       │    │ :3318      │  │
    │   │ verify    │    │              │    │            │  │
    │   └─────┬─────┘    └──────┬───────┘    └─────┬──────┘  │
    │         │                 │                   │         │
    │         └────────┬────────┘                   │         │
    │                  │                            │         │
    │         ┌────────▼─────────┐     ┌────────────▼──────┐  │
    │         │  Signer Engine   │     │  TSA Token Engine │  │
    │         │                  │     │                   │  │
    │         │  PFX ──▶ key     │     │  Nonce cache      │  │
    │         │  key ──▶ hash    │     │  Serial tracking  │  │
    │         │  hash ─▶ sign    │     │  Policy OID       │  │
    │         └──┬────┬────┬─────┘     └───────────────────┘  │
    │            │    │    │                                   │
    │    ┌───────┘    │    └──────────┐                        │
    │    │            │              │                        │
    │  ┌─▼──────┐  ┌──▼────────┐  ┌──▼──────────┐            │
    │  │  PE    │  │  PKCS#7   │  │ Timestamper │            │
    │  │ Parser │  │  Builder  │  │ (RFC 3161   │            │
    │  │        │  │           │  │  client)    │            │
    │  │ parse  │  │ SignedData│  │             │            │
    │  │ hash   │  │ DER enc  │  │ failover    │            │
    │  │ embed  │  │ sign     │  │ across TSAs │            │
    │  └────────┘  └───────────┘  └─────────────┘            │
    └─────────────────────────────────────────────────────────┘

Signing Pipeline (6 stages)

Every signing operation follows the same pipeline. Here's what happens when you run pki-sign sign --pfx cert.pfx input.exe:

  input.exe + cert.pfx
         │
         ▼
  ┌──────────────────────────────────────────────────────┐
  │ 1. LOAD CREDENTIALS                                  │
  │    Parse PFX ──▶ extract private key + cert chain    │
  │    Validate: codeSigning EKU, key usage, expiry      │
  │    Support: RSA, ECDSA P-256/P-384, Ed25519, ML-DSA │
  └──────────────────────────┬───────────────────────────┘
                             │
                             ▼
  ┌──────────────────────────────────────────────────────┐
  │ 2. DETECT FILE TYPE                                  │
  │    .exe/.dll/.sys ──▶ PE Authenticode                │
  │    .ps1             ──▶ PowerShell SIP               │
  │    .msi/.cab        ──▶ MSI/CAB (planned)            │
  │    anything else    ──▶ Detached CMS (.p7s)          │
  └──────────────────────────┬───────────────────────────┘
                             │
                             ▼
  ┌──────────────────────────────────────────────────────┐
  │ 3. COMPUTE HASH                                      │
  │                                                      │
  │    PE files: Authenticode hash (RFC-compliant)        │
  │    ┌─────────────────────────────────────────┐       │
  │    │ Hash entire PE, EXCLUDING:              │       │
  │    │   • PE checksum field       (4 bytes)   │       │
  │    │   • Certificate table entry (8 bytes)   │       │
  │    │   • Data after end-of-image             │       │
  │    │ Pad to 8-byte alignment boundary        │       │
  │    └─────────────────────────────────────────┘       │
  │                                                      │
  │    Other files: SHA-256 of entire content             │
  └──────────────────────────┬───────────────────────────┘
                             │
                             ▼
  ┌──────────────────────────────────────────────────────┐
  │ 4. BUILD PKCS#7 SignedData                           │
  │                                                      │
  │    ContentInfo                                       │
  │    └─ SignedData                                     │
  │       ├─ digestAlgorithms: { SHA-256 }               │
  │       ├─ contentInfo: SpcIndirectDataContent         │
  │       ├─ certificates: [ signer + chain ]            │
  │       └─ signerInfos:                                │
  │          ├─ signedAttrs:                              │
  │          │  ├─ contentType                            │
  │          │  ├─ messageDigest                          │
  │          │  ├─ signingTime                            │
  │          │  └─ CMSAlgorithmProtection                 │
  │          ├─ signature: RSA/ECDSA/Ed25519/ML-DSA      │
  │          └─ unsignedAttrs: (timestamp ──▶ stage 5)   │
  └──────────────────────────┬───────────────────────────┘
                             │
                             ▼
  ┌──────────────────────────────────────────────────────┐
  │ 5. TIMESTAMP (optional, RFC 3161)                    │
  │                                                      │
  │    SHA-256(signature bytes) ──▶ TimeStampReq         │
  │                 │                                    │
  │                 ├──▶ POST to TSA server               │
  │                 │    (DigiCert, Comodo, or built-in)  │
  │                 │                                    │
  │                 └──▶ TimeStampToken embedded in       │
  │                      unsignedAttrs of SignerInfo      │
  └──────────────────────────┬───────────────────────────┘
                             │
                             ▼
  ┌──────────────────────────────────────────────────────┐
  │ 6. EMBED OUTPUT                                      │
  │                                                      │
  │    PE:         WIN_CERTIFICATE struct at 8-byte      │
  │                boundary, update cert table RVA,      │
  │                recalculate PE checksum               │
  │                                                      │
  │    Detached:   Write .p7s file (DER-encoded)         │
  │                                                      │
  │    PowerShell: Base64 PKCS#7 block appended          │
  │                to script text                        │
  └──────────────────────────┬───────────────────────────┘
                             │
                             ▼
                       signed.exe

Web API Request Flow

When running as a web service (pki-sign serve), a signing request flows through middleware layers before hitting the signer engine:

  curl -F "file=@app.exe" https://sign.quantumnexus.com/api/v1/sign
         │
         ▼
  ┌─ Security Headers ────────────────────────────────────┐
  │  CSP, X-Content-Type-Options, X-Frame-Options         │
  └───────────────────────────┬───────────────────────────┘
                              │
  ┌─ LDAP Auth Middleware ────▼───────────────────────────┐
  │  Extract X-Remote-User, X-Remote-Groups headers       │
  │  Validate user belongs to cert-group for requested    │
  │  signing certificate                                  │
  └───────────────────────────┬───────────────────────────┘
                              │
  ┌─ Sign Handler ────────────▼───────────────────────────┐
  │  1. Parse multipart upload (file bytes + filename)    │
  │  2. Validate: size limit, allowed extension, MZ magic │
  │  3. Write to temp file (prefer /dev/shm for speed)    │
  │  4. Load credentials via RwLock (hot-reloadable)      │
  │  5. Call signer::sign_file_with_options()              │
  │  6. Update atomic stats (files_signed, bytes, time)   │
  │  7. Write audit log entry (request_id, hash, signer)  │
  └───────────────────────────┬───────────────────────────┘
                              │
                              ▼
  HTTP 200: signed binary + metadata headers
    X-PKI-Sign-Hash, X-PKI-Sign-Algorithm,
    X-PKI-Sign-Certificate, X-PKI-Sign-Timestamp,
    X-PKI-Sign-Duration-Ms

Rust Modules (13,263 lines)

  crates/pki-sign/src/
  ├── main.rs             CLI entry point, 3 mode dispatch
  ├── signer.rs           Signing orchestrator (1,030 lines)
  ├── verifier.rs         Signature validation  (4,500 lines)
  ├── config.rs           TOML config loader
  │
  ├── pe/
  │   ├── parser.rs       PE/COFF header parsing
  │   ├── authenticode.rs Authenticode hash computation
  │   └── embed.rs        WIN_CERTIFICATE embedding
  │
  ├── pkcs7/
  │   ├── builder.rs      CMS/PKCS#7 SignedData (hand-rolled DER)
  │   ├── asn1.rs         ASN.1 primitives
  │   ├── enveloped.rs    EnvelopedData (encryption)
  │   ├── ecdh.rs         ECDH key agreement
  │   └── ess.rs          ESS signing-certificate-v2
  │
  ├── timestamp.rs        RFC 3161 TSA client + failover
  ├── tsa_server.rs       TSA token generation engine
  ├── powershell.rs       PowerShell .ps1 SIP signing
  │
  ├── web/
  │   ├── mod.rs          axum server setup + router
  │   ├── handlers.rs     Request handlers (sign, verify, admin)
  │   ├── middleware.rs    Auth + security middleware
  │   └── audit.rs        Structured audit logging
  │
  └── crypto/
      ├── hkdf.rs         Key derivation
      └── rsa_oaep.rs     RSA-OAEP encryption

Download

$ curl -LO https://github.com/rayketcham-lab/PKI-Signing-Service/releases/latest/download/pki-sign
$ chmod +x pki-sign
$ sudo mv pki-sign /usr/local/bin/
$ pki-sign --version
pki-sign 0.3.0-beta.2

Or build from source:

$ git clone https://github.com/rayketcham-lab/PKI-Signing-Service.git
$ cd PKI-Signing-Service
$ cargo build --release
   Compiling pki-sign v0.3.0-beta.2
    Finished `release` profile [optimized] target(s)

$ # Static binary (musl)
$ rustup target add x86_64-unknown-linux-musl
$ cargo build --release --target x86_64-unknown-linux-musl

Quick Start

Sign a File (Authenticode)

# Set the PFX password
$ export PKI_SIGN_PFX_PASSWORD="your-password"

# Sign a Windows executable
$ pki-sign sign --pfx cert.pfx input.exe -o signed.exe
Signed: signed.exe
  Certificate: CN=QuantumNexus Code Signing, O=QuantumNexus
  Algorithm:   RSA-SHA256
  Timestamped: true (DigiCert)
  Duration:    342ms

# Sign a DLL without timestamping (offline/testing)
$ pki-sign sign --pfx cert.pfx --no-timestamp input.dll -o signed.dll
Signed: signed.dll
  Timestamped: false

# Sign with a custom TSA server
$ pki-sign sign --pfx cert.pfx --tsa https://timestamp.digicert.com input.exe

Supported PE extensions: .exe, .dll, .sys, .ocx, .scr, .cpl, .drv

Verify a Signature

$ pki-sign verify signed.exe
Verifying: signed.exe
  Signature:   VALID
  Timestamped: true
  Signer:      CN=QuantumNexus Code Signing, O=QuantumNexus
  Issuer:      CN=QuantumNexus Issuing CA
  Algorithm:   RSA-SHA256
  Digest:      SHA-256
  Content:     SPC_INDIRECT_DATA

$ pki-sign verify --verbose signed.exe
Verifying: signed.exe
  Signature:    VALID
  Chain Valid:  true
  EKU Valid:    true (codeSigning)
  Timestamped:  true
  Timestamp:    2026-03-12T14:30:00Z
  Signer:       CN=QuantumNexus Code Signing, O=QuantumNexus
  Issuer:       CN=QuantumNexus Issuing CA
  Algorithm:    RSA-SHA256
  Digest:       SHA-256
  File Hash:    a1b2c3d4e5f6...
  Signed Hash:  a1b2c3d4e5f6...

Detached CMS Signing

Create a detached PKCS#7 signature (.p7s) for any file type — PDFs, ZIPs, tarballs, firmware images, documents. The signature is stored separately from the original file.

# Sign any file
$ pki-sign sign-detached --pfx cert.pfx document.pdf -o document.p7s
Signed (detached): document.p7s
  File Hash:   a1b2c3d4e5f6...
  P7S Hash:    789abcdef012...
  Timestamped: true

# Verify detached signature
$ pki-sign verify-detached --signature document.p7s document.pdf
Verifying (detached): document.pdf
  Signature:   VALID
  Timestamped: true
  Signer:      CN=QuantumNexus Code Signing, O=QuantumNexus

# Sign firmware, archives, anything
$ pki-sign sign-detached --pfx cert.pfx firmware.bin -o firmware.p7s
$ pki-sign sign-detached --pfx cert.pfx release.tar.gz -o release.p7s

PowerShell Script Signing

$ pki-sign sign --pfx cert.pfx deploy.ps1 -o deploy-signed.ps1
Signed: deploy-signed.ps1
  Format: PowerShell signature block (Base64 PKCS#7)

$ pki-sign verify deploy-signed.ps1
Verifying: deploy-signed.ps1
  Signature:   VALID
  Timestamped: true

Web Service Mode

Run as a Code Signing REST API. Upload files, get signed files back. HTTPS with TLS, LDAP authentication, audit logging, and certificate hot-reload.

# Start with config file
$ pki-sign serve --config /etc/pki/sign.toml
INFO PKI Signing Service v0.3.0-beta.2
INFO Loaded 2 signing certificates: desktop, server
INFO Auth mode: header (LDAP)
INFO TLS enabled: /etc/pki/tls/server.pem
INFO Listening on https://0.0.0.0:6447

# Quick start (defaults, port 6447)
$ pki-sign serve

# Custom bind address
$ pki-sign serve --bind 127.0.0.1 --port 8443

Configuration

# /etc/pki/sign.toml

bind_addr = "0.0.0.0"
bind_port = 6447
tls_cert = "/etc/pki/tls/server.pem"
tls_key = "/etc/pki/tls/server-key.pem"
max_upload_size = 524288000   # 500 MB
require_timestamp = true
audit_log = "/var/log/pki-sign/audit.log"
output_dir = "/var/lib/pki-sign/signed"

# Signing certificates (multiple supported)
[[cert_configs]]
name = "desktop"
pfx_path = "/etc/pki/certs/desktop.pfx"
pfx_password_env = "PFX_PASSWORD_DESKTOP"

[[cert_configs]]
name = "server"
pfx_path = "/etc/pki/certs/server.pfx"
pfx_password_env = "PFX_PASSWORD_SERVER"

# Timestamp Authority
[tsa]
urls = ["https://timestamp.digicert.com", "https://timestamp.comodoca.com"]
timeout_secs = 30

# Authentication
auth_mode = "header"  # none, header, mtls, apikey

[ldap]
enabled = true
user_header = "X-Remote-User"
groups_header = "X-Remote-Groups"
email_header = "X-Remote-Email"
admin_group = "CN=PKI Admins,OU=Groups,DC=corp,DC=quantumnexus,DC=com"

[ldap.cert_groups]
desktop = "CN=Desktop Signers,OU=Groups,DC=corp,DC=quantumnexus,DC=com"
server = "CN=Server Signers,OU=Groups,DC=corp,DC=quantumnexus,DC=com"

API Reference

Public Endpoints

Admin Endpoints

API Examples

$ curl -X POST https://sign.quantumnexus.com/api/v1/sign \
    -H "X-Remote-User: jdoe" \
    -F "file=@myapp.exe" \
    -o myapp-signed.exe
# Response headers:
#   X-Request-Id: a1b2c3d4-e5f6-...
#   X-PKI-Sign-Hash: abcdef123456...
#   X-PKI-Sign-Algorithm: RSA-SHA256
#   X-PKI-Sign-Certificate: desktop
#   X-PKI-Sign-Timestamp: true
#   X-PKI-Sign-Duration-Ms: 342

# Binary response (default)
$ curl -X POST https://sign.quantumnexus.com/api/v1/sign-detached \
    -H "X-Remote-User: jdoe" \
    -F "file=@document.pdf" \
    -o document.p7s

# JSON response
$ curl -X POST https://sign.quantumnexus.com/api/v1/sign-detached \
    -H "X-Remote-User: jdoe" \
    -H "Accept: application/json" \
    -F "file=@document.pdf"
{
  "request_id": "a1b2c3d4-...",
  "p7s": "<base64-encoded-signature>",
  "file_hash": "abcdef123456...",
  "p7s_hash": "789abc...",
  "timestamped": true,
  "certificate": "desktop",
  "duration_ms": 287
}

# Verify a signed file
$ curl -X POST https://sign.quantumnexus.com/api/v1/verify \
    -F "file=@signed.exe"
{
  "signature_valid": true,
  "chain_valid": true,
  "timestamped": true,
  "signer_subject": "CN=QuantumNexus Code Signing, O=QuantumNexus",
  "algorithm": "RSA-SHA256"
}

# Hot-reload certificates (admin)
$ curl -X POST https://sign.quantumnexus.com/admin/reload \
    -H "Authorization: Bearer <admin-token>"
{ "status": "reloaded", "certificates_loaded": 2 }

# List loaded certificates (admin)
$ curl https://sign.quantumnexus.com/admin/certs \
    -H "Authorization: Bearer <admin-token>"

Authentication

Four authentication modes, configured via auth_mode in sign.toml:

LDAP Certificate Groups

Map LDAP groups to signing certificates. Users can only sign with certificates their group allows:

[ldap.cert_groups]
desktop = "CN=Desktop Signers,OU=Groups,DC=corp,DC=quantumnexus,DC=com"
server  = "CN=Server Signers,OU=Groups,DC=corp,DC=quantumnexus,DC=com"

Certificate Management

Multiple signing certificates can be loaded simultaneously. Certificates can be hot-reloaded without restarting the server.

TSA Server (RFC 3161)

Standalone Time-Stamp Authority server. Runs on IANA-assigned port 3318. Compatible with signtool.exe, openssl ts, or this tool's own --tsa flag.

$ pki-sign tsa serve \
    --cert /etc/pki/tsa/tsa.pem \
    --key /etc/pki/tsa/tsa-key.pem \
    --policy-oid 1.3.6.1.4.1.56266.1.30.1 \
    --port 3318
INFO TSA server listening on http://0.0.0.0:3318
INFO Policy OID: 1.3.6.1.4.1.56266.1.30.1
INFO Certificate: CN=QuantumNexus TSA

TSA Configuration

Client Compatibility

Architecture

                        pki-sign (single binary)
                        +--------------------------------------------+
                        |                                            |
  CLI users ---------->|  sign | sign-detached | verify | tsa        |
                        |                                            |
  HTTP clients -------->|  /api/v1/sign          REST API            |
  (curl, CI/CD)        |  /api/v1/sign-detached  (axum)             |
                        |  /api/v1/verify                            |
                        |                                            |
  TSA clients --------->|  :3318                 RFC 3161 TSA        |
  (signtool, openssl)   |                                            |
                        |  +--------------------------------------+  |
                        |  |  Signer (orchestrator)                |  |
                        |  |  PFX --> key + cert --> hash --> sign |  |
                        |  +------------------+-------------------+  |
                        |                     |                      |
                        |     +---------------+----------------+     |
                        |     |               |                |     |
                        |  PE Parser    PKCS#7/CMS     Timestamper   |
                        |  Authenticode  SignedData     RFC 3161      |
                        |  hash+embed    DigestedData   TSA client   |
                        |               EnvelopedData   failover     |
                        +--------------------------------------------+

Modules

Signing Pipeline

Cryptography

All pure Rust. No OpenSSL. No liboqs. cargo-deny explicitly blocks openssl, openssl-sys, and native-tls. TLS via rustls with aws-lc-rs backend.

Signature Algorithms

Post-Quantum Cryptography

Digest Algorithms

Security

Production Deployment

systemd Service

# /etc/systemd/system/pki-sign.service
[Unit]
Description=PKI Signing Service
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/pki-sign serve --config /etc/pki/sign.toml
Restart=on-failure
User=pki-sign
Group=pki-sign
EnvironmentFile=/etc/pki/sign.env

[Install]
WantedBy=multi-user.target

$ sudo systemctl enable pki-sign
$ sudo systemctl start pki-sign
$ sudo systemctl status pki-sign
● pki-sign.service - PKI Signing Service
     Loaded: loaded (/etc/systemd/system/pki-sign.service; enabled)
     Active: active (running)
   Main PID: 12345 (pki-sign)
      Tasks: 8 (limit: 4915)
     Memory: 24.0M
        CPU: 120ms

Environment File

# /etc/pki/sign.env
PFX_PASSWORD_DESKTOP=change-me-desktop
PFX_PASSWORD_SERVER=change-me-server
PKI_SIGN_LOG_LEVEL=info

Platform Support

CLI Reference

pki-sign 0.3.0-beta.2
PKI Signing Service - Pure Rust Code Signing Engine

USAGE:
    pki-sign <COMMAND>

COMMANDS:
    serve            Start the web server for Code Signing as a Service
    sign             Sign a file using Authenticode
    sign-detached    Create a detached CMS/PKCS#7 signature (.p7s)
    verify           Verify an Authenticode signature
    verify-detached  Verify a detached CMS/PKCS#7 signature
    setup            Interactive setup wizard
    tsa              Time-Stamp Authority (RFC 3161) server commands
    help             Print help