picky

picky is a portable, pure-Rust cryptography and public-key-infrastructure toolkit maintained by Devolutions. It brings X.509 certificate parsing and generation, PKCS#12 handling, JOSE (JWT/JWS/JWE/JWK) support, SSH and PuTTY key formats, and HTTP request signatures under a single, dependency-light crate.

Built on the sibling picky-asn1 stack for ASN.1/DER encoding, it targets developers who need standards-compliant PKI and token handling without pulling in a heavyweight OpenSSL binding, making it suitable for microservices, agents, and cross-platform tools.

What You Get

• X.509 certificate parsing, building, and validation with a fluent certificate builder
• JOSE support covering JWT, JWS, JWE, and JWK for token issuance and verification
• Key handling for RSA, EC, and Ed25519 plus PEM, PKCS#12, SSH, and PuTTY formats
• HTTP signature creation and verification for signed API requests

Common Use Cases

• Issuing and validating X.509 certificates inside a Rust PKI service
• Signing and verifying JWTs and JOSE tokens for authentication flows
• Reading and converting private/public keys across PEM, SSH, and PuTTY formats

Under The Hood

Architecture - picky is the top-level crate of the picky-rs Cargo workspace, organised in src/ by domain: x509/, jose/, key/, pkcs12/, ssh/, putty/, http/, plus shared hash, pem, and signature modules. It delegates ASN.1/DER encoding to the sibling picky-asn1, picky-asn1-der, and picky-asn1-x509 crates, keeping the public API focused on high-level PKI, token, and key operations while low-level serialization lives in dedicated crates.

Tech Stack - Written in Rust (edition 2024, MSRV 1.85), it builds on serde, base64, thiserror 2, hex, and zeroize for secure memory handling, with optional chrono/time, http, and cab features gated behind Cargo feature flags. RSA/EC/Ed25519 support is layered over the RustCrypto ecosystem rather than OpenSSL.

Code Quality - The crate carries integration tests (tests/mkcert_all_stars.rs, fuzzer_regressions.rs) and a fuzz/ harness, uses thiserror-based typed errors throughout, and applies zeroize to sensitive key material. Domain modules are cleanly separated and the workspace maintains per-crate CHANGELOG files.

API Design - The public surface favors builder-style constructors (certificate builder, JWT/JWS builders) and format-specific parsers, giving ergonomic, discoverable entry points. Feature flags let consumers pull in only the formats they need. Documentation lives largely on docs.rs with tested examples, so the learning curve depends on familiarity with X.509/JOSE concepts more than the API itself.