Boulder review
A specialized, self-hosted foundation for organizations building an ACME CA service.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Boulder is an open-source certificate authority implementation based on the ACME protocol. It is designed for Web PKI certificate issuance and revocation, making it a fit for organizations building an ACME CA service rather than teams seeking a general-purpose PKI product. The software supports Linux, API-based operation, and self-hosted, on-premises deployment. Its scope centers on ACME workflows, including domain-control validation through ACME challenges.
The architecture divides the system into separate web front-end, registration, validation, certificate authority, storage, publisher, and CRL-update components. These internal services communicate through gRPC, giving organizations a defined component model for operating the CA. Boulder also includes MariaDB-backed storage authority support, Certificate Transparency publishing, and CRL updating and publishing. Integration points include MariaDB, S3, Docker Compose, and gRPC, while the open-source pricing model provides a foundation for organizations that want to manage the software and infrastructure themselves.
Deployment requires careful separation between development and production concerns. Docker Compose is available for development and experimentation, but the published guidance states that this setup is not suitable for production without additional deployment and security work. Organizations should therefore be prepared to manage separately configured services and supporting infrastructure. Boulder is a strong match for teams that need ACME issuance and revocation with a modular, self-hosted architecture. It is less suitable for organizations looking for broad PKI coverage beyond Web PKI and ACME or for a production-ready deployment that requires minimal operational work.
Boulder pros and cons
- Where it wins
- Supports ACME certificate issuance, revocation, and domain validation
- Separates CA, validation, storage, publishing, and other core components
- Includes CT publishing, CRL publishing, MariaDB storage, and gRPC communication
- Where it doesn't
- Focused primarily on Web PKI and ACME use cases
- Docker Compose is intended for development, not production deployment
- Production use requires additional deployment and security work
Boulder fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update