Skip to content
SPECIFICTION
Get listed

Boulder

github.com

Free plan LinuxAPISelf-hosted
Visit github.com
Spec score 8.0 #9 of 26 in Public Key Infrastructure Software

What it is

Boulder is an open-source ACME certificate authority written in Go and used to run Let’s Encrypt. ACME lets a certificate authority verify control of an identifier and allows subscribers to issue or revoke certificates for identifiers they control. Boulder divides its work among web front ends, registration and validation authorities, a certificate authority, storage authority, publisher, and CRL updater. These boundaries separate CA functions by security context, with the certificate authority receiving instructions from the registration authority. Components communicate through gRPC, and the software stores ACME accounts, authorizations, challenges, orders, and certificates. Boulder is free under the Mozilla Public License 2.0 and is listed for API, Linux, and self-hosted use. Maintainers recommend Docker and Docker Compose for development and experimentation, and document connecting Certbot or another ACME client to a local instance. That Docker environment is not suitable for production: it uses publicly available private key material, exposes debug ports, and is described as brittle when components fail. Boulder is built for Let’s Encrypt and Web PKI baseline requirements; maintainers say it often does not fit other organizations’ production needs.

Spec sheet

Purpose
Boulder is an ACME-based certificate authority written in Go and is the software that runs Let's Encrypt.Read 4 Oct 2026 · github.com
Support
The maintainers prioritize support and development work that advances Let's Encrypt's mission and warn that timely support may not be available for other deployments.Read 4 Oct 2026 · github.com
License
The project is licensed under the Mozilla Public License 2.0.Read 4 Oct 2026 · github.com
Certificate workflow
ACME lets a certificate authority verify control of an identifier and lets subscribers issue and revoke certificates for identifiers they control.Read 4 Oct 2026 · github.com
Client compatibility
The README documents running Certbot or another ACME client against a local Boulder instance.Read 4 Oct 2026 · github.com
Components
Boulder includes web front ends, registration and validation authorities, a certificate authority, storage authority, publisher, and CRL updater.Read 4 Oct 2026 · github.com
Development setup
The maintainers recommend Docker and Docker Compose for development and experimentation, and the README says this setup is unsuitable for production.Read 4 Oct 2026 · github.com
Interfaces and storage
Boulder uses gRPC for communication between components and stores ACME accounts, authorizations, challenges, orders, and certificates.Read 4 Oct 2026 · github.com
Production fit
Boulder is built for Let's Encrypt and Web PKI baseline requirements, and the maintainers say it is often not a good fit for other organizations' production use.Read 4 Oct 2026 · github.com
Production readiness
The Docker development environment uses publicly available private key material, exposes debug ports, and is described as brittle to component failure.Read 4 Oct 2026 · github.com
Production security
The deployment guide says components use mutual TLS issued from a special-purpose CA and describes firewalling components and limiting exposed ports.Read 4 Oct 2026 · github.com
Security design
The component model separates CA functions by security context, with the certificate authority receiving instructions from the registration authority.Read 4 Oct 2026 · github.com

Plans and prices

Open source Free MPL-2.0 licensed · production deployment requires separate implementation and security work Read 4 Oct 2026 · github.com

Every Boulder plan and price →

Strong points and limits

Strong points

  • Free under the Mozilla Public License 2.0.
  • Supports API, Linux, and self-hosted use.
  • Maintainers document local ACME client use.
  • Components are separated by security context.

Limits

  • Docker development setup is unsuitable for production.
  • Development setup exposes debug ports.
  • Development setup uses publicly available private key material.
  • Timely support may not be available for other deployments.

Who it suits

Boulder suits developers experimenting with ACME or working on systems aligned with Let’s Encrypt’s needs. Organizations considering production deployment should account for the maintainers’ warning that it may not fit other deployments and requires separate implementation and security work.

Verdict

Boulder provides a componentized ACME certificate authority, but its documented local Docker setup is for development rather than production. Production use outside Let’s Encrypt may require substantial implementation and security work.

Where Specifiction places it

Alternatives to BoulderAll alternatives →