Boulder
What it is
Boulder is an ACME certificate authority written in Go and used to run Let’s Encrypt. ACME enables a certificate authority to verify control of an identifier, then lets subscribers issue or revoke certificates for identifiers they control. Boulder divides the work among web front ends, registration and validation authorities, a certificate authority, storage authority, publisher, and CRL updater. Its component boundaries separate CA functions by security context, with the certificate authority receiving instructions from the registration authority. Components communicate through gRPC, and the software stores accounts, authorizations, challenges, orders, and certificates. Boulder is free and open source under the Mozilla Public License 2.0, with API, Linux, and self-hosted use listed. Maintainers recommend Docker and Docker Compose for development and experimentation, and document using Certbot or another ACME client with a local instance. That development setup is not suitable for production. Boulder is built for Let’s Encrypt and Web PKI baseline requirements, and its maintainers caution that it may not suit other organizations’ production needs.
For and against
For
- Free, open-source software under MPL 2.0
- Supports API, Linux, and self-hosted use
- Documents Certbot and other ACME clients
- Separates certificate authority functions by security context
Against
- Docker development setup is unsuitable for production
- Other organizations may find it a poor production fit
- Production deployment requires separate implementation and security work
- Timely support may not be available for other deployments
The verdict
Boulder provides a component-based ACME certificate authority, with a documented local development path and client compatibility. Its production guidance and support priorities are centered on Let’s Encrypt, so other deployments should account for additional security and implementation work.
Who it suits
Boulder suits developers experimenting with ACME certificate workflows or organizations specifically building for Let’s Encrypt’s use case. Other production deployments require separate implementation and security work, and timely support may not be available.
Plans and prices
Open source
MPL-2.0 licensed · production deployment requires separate implementation and security work
Read 4 Oct 2026 · github.com
On the record
- Certificate workflow
- ACME lets a certificate authority verify control of an identifier and lets subscribers issue and revoke certificates for identifiers they control.github.com · read 4 Oct 2026
- Client compatibility
- The README documents running Certbot or another ACME client against a local Boulder instance.github.com · read 4 Oct 2026
- Components
- Boulder includes web front ends, registration and validation authorities, a certificate authority, storage authority, publisher, and CRL updater.github.com · read 4 Oct 2026
- Development setup
- The maintainers recommend Docker and Docker Compose for development and experimentation, and the README says this setup is unsuitable for production.github.com · read 4 Oct 2026
- Interfaces and storage
- Boulder uses gRPC for communication between components and stores ACME accounts, authorizations, challenges, orders, and certificates.github.com · read 4 Oct 2026
- License
- The project is licensed under the Mozilla Public License 2.0.github.com · read 4 Oct 2026
- Production fit
- Boulder is built for Let's Encrypt and Web PKI baseline requirements, and the maintainers say it is often not a good fit for other organizations' production use.github.com · read 4 Oct 2026
- Production readiness
- The Docker development environment uses publicly available private key material, exposes debug ports, and is described as brittle to component failure.github.com · read 4 Oct 2026
- Production security
- The deployment guide says components use mutual TLS issued from a special-purpose CA and describes firewalling components and limiting exposed ports.github.com · read 4 Oct 2026
- Purpose
- Boulder is an ACME-based certificate authority written in Go and is the software that runs Let's Encrypt.github.com · read 4 Oct 2026
- Security design
- The component model separates CA functions by security context, with the certificate authority receiving instructions from the registration authority.github.com · read 4 Oct 2026
- Support
- The maintainers prioritize support and development work that advances Let's Encrypt's mission and warn that timely support may not be available for other deployments.github.com · read 4 Oct 2026
