Boulder vs OpenCA PKI

Boulder is an open-source ACME certificate authority written in Go and used to run Let’s Encrypt. ACME lets a certificate authority verify control of an identifier and allows subscribers to issue or revoke certificates for identifiers they control. Boulder divides its work among web front ends, registration and validation authorities, a certificate authority, storage authority, publisher, and CRL updater. These boundaries separate CA functions by security context, with the certificate authority receiving instructions from the registration authority. Components communicate through gRPC, and the software stores ACME accounts, authorizations, challenges, orders, and certificates. Boulder is free under the Mozilla Public License 2.0 and is listed for API, Linux, and self-hosted use. Maintainers recommend Docker and Docker Compose for development and experimentation, and document connecting Certbot or another ACME client to a local instance. That Docker environment is not suitable for production: it uses publicly available private key material, exposes debug ports, and is described as brittle when components fail. Boulder is built for Let’s Encrypt and Web PKI baseline requirements; maintainers say it often does not fit other organizations’ production needs.

OpenCA PKI is free, open-source software for establishing and managing a public key infrastructure, with an out-of-the-box Certification Authority. It is intended for on-premises deployment and is listed for Linux, macOS, self-hosted, and web environments. The project says it implements commonly used protocols with full-strength cryptography; listed capabilities include SCEP support, HSM integration, and certificate profiles. The download page lists OpenCA PKI (SpecialK) version 1.5.1. Installation requires other software, including OpenLDAP, OpenSSL, Apache, and Apache mod_ssl, and OpenCA Tools version 1.3.0 is listed as a prerequisite to install first. The project dates to 1998 and describes its work as volunteer-driven and managed through collaboration and consensus. Community support is available through mailing lists, forums, and online chat; independent third parties offer paid support. Security concerns can be reported privately by email or publicly through the project issue trackers. The documentation page says downloadable documentation is unavailable and notes that the OpenCA Guide for version 0.9.2 is outdated in some parts.