Boulder

Boulder is a production-grade implementation of the ACME (Automated Certificate Management Environment) protocol, built around the same infrastructure that powers Let's Encrypt. It functions as a full certificate authority that automates the issuance, renewal, and revocation of TLS certificates, supporting multiple key algorithms including RSA, ECDSA, and experimental post-quantum ML-DSA keys.

The project distinguishes itself through its multi-algorithm PKI hierarchy, which builds separate RSA and ECDSA root chains with cross-signing to support dual-algorithm trust paths. It includes a CRL-based revocation model that generates and publishes Certificate Revocation Lists to S3-compatible storage for offline revocation checking, and implements gRPC service authentication by issuing per-service certificates with multiple Subject Alternative Names for internal microservice communication. Private keys are managed through SoftHSM, a software PKCS#11 module that provides hardware-like security without requiring physical HSM hardware.

Boulder provides a complete certificate lifecycle management system, handling domain ownership validation through automated challenges, certificate issuance, revocation processing, and CRL publishing. The project includes a local development CA that runs inside Docker containers for testing ACME client workflows against a real certificate authority, and generates test PKI hierarchies with deterministic key regeneration to avoid redundant creation across test runs. It also supports experimental post-quantum cryptography testing by generating ML-DSA keys and certificates for hybrid cryptographic readiness evaluation.

Features

ACME Server Implementations - Implements the ACME protocol server that acts as a certificate authority for automated certificate lifecycle management.

TLS Certificate Management - Automates TLS certificate issuance by processing ACME client requests through domain validation and signing.

gRPC Service Certificates - Issues per-service certificates with multiple Subject Alternative Names for mutual TLS authentication in internal microservice communication.

ACME Implementations - Provides a full ACME protocol implementation for automated certificate issuance and management, powering Let's Encrypt.

Multi-Algorithm Certificate Issuers - Issues X.509 certificates with support for RSA, ECDSA, and experimental ML-DSA key algorithms.

Certificate Revocations - Processes revocation requests for issued certificates, updating status and publishing to certificate transparency logs.

CRL Distributors - Publishes and distributes Certificate Revocation Lists to enable offline revocation checking for issued certificates.

CRL Publishers - Generates and publishes Certificate Revocation Lists to S3-compatible storage for offline revocation checking.

Multi-Algorithm Root Hierarchies - Builds separate RSA and ECDSA root chains with cross-signing to support dual-algorithm trust paths.

Domain Validation Protocols - Verifies domain ownership through automated challenges before certificate issuance proceeds.

S3-Compatible CRL Publishers - Generates and publishes CRLs to an S3-compatible store so relying parties can check certificate revocation status.

Multi-Algorithm Issuing Intermediates - Requires at least one RSA and one ECDSA issuing intermediate certificate for the certificate authority to operate.

Software HSM Emulators - Stores private keys in a software PKCS#11 module for hardware-like security without physical HSM hardware.

Multi-Algorithm PKI Hierarchies - Builds separate RSA and ECDSA root chains with cross-signing to support dual-algorithm trust paths.

Public Key Infrastructure - Generates and manages certificate hierarchies including roots, intermediates, and cross-signed certificates for testing and production.

Service-to-Service Certificate Authenticators - Generates certificates for service-to-service authentication, including multi-name certificates for replicated services and internal auth.

Internal Service Certificate Generators - Creates per-service certificates with multiple names for gRPC authentication, plus certificates for DNS, Redis, and API TLS handlers.

gRPC Service Certificate Generators - Generates per-service certificates with multiple Subject Alternative Names for internal gRPC mutual TLS authentication.

Test Certificate Generation - Generates collections of keys and certificates for integration tests, skipping regeneration if the directory already exists.

Test Certificate Hierarchies - Creates RSA and ECDSA roots, intermediates, cross-signed certs, and CRLs for integration test end-entity certificates.

SoftHSM Key Stores - Stores private keys in a software PKCS#11 module for hardware-like security without physical HSM hardware.

ML-DSA Key Generators - Generates ML-DSA keys and certificates for testing hybrid or post-quantum cryptographic readiness.

ML-DSA Certificate Generators - Generates ML-DSA keys and certificates to test hybrid or post-quantum cryptographic readiness in certificate issuance.

letsencryptboulder

Features

Star history