Boulder vs step-ca

Boulder is an open-source ACME certificate authority written in Go and used to run Let’s Encrypt. ACME lets a certificate authority verify control of an identifier and allows subscribers to issue or revoke certificates for identifiers they control. Boulder divides its work among web front ends, registration and validation authorities, a certificate authority, storage authority, publisher, and CRL updater. These boundaries separate CA functions by security context, with the certificate authority receiving instructions from the registration authority. Components communicate through gRPC, and the software stores ACME accounts, authorizations, challenges, orders, and certificates. Boulder is free under the Mozilla Public License 2.0 and is listed for API, Linux, and self-hosted use. Maintainers recommend Docker and Docker Compose for development and experimentation, and document connecting Certbot or another ACME client to a local instance. That Docker environment is not suitable for production: it uses publicly available private key material, exposes debug ports, and is described as brittle when components fail. Boulder is built for Let’s Encrypt and Web PKI baseline requirements; maintainers say it often does not fit other organizations’ production needs.

step-ca is an online Certificate Authority for automating X.509 and SSH certificate management. It issues X.509 certificates for TLS, mutual TLS, document signing and authentication, as well as SSH certificates for users and hosts. Provisioners can authorize issuance through ACME challenges, OIDC tokens, cloud instance identity documents and short-lived JWK tokens. Automated issuance and renewal are supported for clients, servers and Kubernetes workloads, alongside passive revocation. Templates can customize SANs or OIDs, restrict domains or key sizes, and create longer certificate chains. For CA signing-key protection, step-ca integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV. Its intended PKI design uses an offline root CA and a configured intermediate CA that issues end-entity certificates. Installation options include macOS, Windows, Linux, Kubernetes and Docker, and database choices include Badger, BoltDB, MySQL and PostgreSQL. The open-source plan costs nothing. Community help is available through Discord, with dedicated support contracts from Smallstep.