Boulder

At a glance

• Editor score
  7.1 / 10
• Pricing
  Open source
• Best for
  Organizations building an ACME CA service
• Paid from
  Free
• Deployment model
  On_premises
• Facts checked
  21 Sep 2026

• Where it wins

  • Supports ACME certificate issuance, revocation, and domain validation
  • Separates CA, validation, storage, publishing, and other core components
  • Includes CT publishing, CRL publishing, MariaDB storage, and gRPC communication

• Where it doesn't

  • Focused primarily on Web PKI and ACME use cases
  • Docker Compose is intended for development, not production deployment
  • Production use requires additional deployment and security work

Our verdict on Boulder

Boulder is an open-source certificate authority implementation based on the ACME protocol. It is designed for Web PKI certificate issuance and revocation, making it a fit for organizations building an ACME CA service rather than teams seeking a general-purpose PKI product. The software supports Linux, API-based operation, and self-hosted, on-premises deployment. Its scope centers on ACME workflows, including domain-control validation through ACME challenges.

The architecture divides the system into separate web front-end, registration, validation, certificate authority, storage, publisher, and CRL-update components. These internal services communicate through gRPC, giving organizations a defined component model for operating the CA. Boulder also includes MariaDB-backed storage authority support, Certificate Transparency publishing, and CRL updating and publishing. Integration points include MariaDB, S3, Docker Compose, and gRPC, while the open-source pricing model provides a foundation for organizations that want to manage the software and infrastructure themselves.

Deployment requires careful separation between development and production concerns. Docker Compose is available for development and experimentation, but the published guidance states that this setup is not suitable for production without additional deployment and security work. Organizations should therefore be prepared to manage separately configured services and supporting infrastructure. Boulder is a strong match for teams that need ACME issuance and revocation with a modular, self-hosted architecture. It is less suitable for organizations looking for broad PKI coverage beyond Web PKI and ACME or for a production-ready deployment that requires minimal operational work.

Your product? Our editors can test Boulder in depth and publish a review, labelled as paid · from $149/mo →

Boulder pricing

Boulder fact sheet

Boulder integrations

Boulder lists 4 integrations on its own site.

• MariaDB
• S3
• Docker Compose
• gRPC

Alternatives to Boulder

• EJBCAA broad, self-hosted PKI platform with deep certificate and deployment support.9.4
• DigiCert Private CAA flexible private CA for enterprises managing certificates across hybrid and air-gapped environments.9.2
• SSL.com Private Enterprise PKIManaged private PKI with broad enrollment protocols, lifecycle controls, and published plan pricing.9.1

See all Boulder alternatives →

Featured on iTechGuides

Boulder is listed in our Public Key Infrastructure Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/boulder/"><img src="https://www.itechguides.com/best/badge/boulder.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update