No. 4 of 25 ·Public Key Infrastructure Software

Boulder

Linux · Self-hosted · API

Freedom report

Two barsScore 6.3

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

Boulder is ranked #4 of 25 in public key infrastructure software on Freedom251. It runs on API, Linux, Self-hosted. There is a free plan.

Boulder plans and pricing

All plans

Open source Free MPL-2.0 licensed · production deployment requires separate implementation and security work github.com · 4 Oct 2026

Compared on public key infrastructure software

Deployment model: on_premises
ACME support: Yes

Best Boulder alternatives

See all 20

Two bars OpenCA PKI Free tier No. 1Free6.5 Two bars step-ca Free tier No. 2Free6.5 One bar XiPKI Free tier No. 3Free6.4 One bar SecureW2 Cloud NAC Paid plans No. 5—5.8 One bar KeyTalk CKMS Paid plans No. 6€5/mo5.7 One bar Cloudflare Serverless Registry Paid plans No. 7—5.6

The record

Purpose: Boulder is an ACME-based certificate authority written in Go and is the software that runs Let's Encrypt.
Certificate workflow: ACME lets a certificate authority verify control of an identifier and lets subscribers issue and revoke certificates for identifiers they control.
Components: Boulder includes web front ends, registration and validation authorities, a certificate authority, storage authority, publisher, and CRL updater.
Security design: The component model separates CA functions by security context, with the certificate authority receiving instructions from the registration authority.
Interfaces and storage: Boulder uses gRPC for communication between components and stores ACME accounts, authorizations, challenges, orders, and certificates.
Development setup: The maintainers recommend Docker and Docker Compose for development and experimentation, and the README says this setup is unsuitable for production.
Client compatibility: The README documents running Certbot or another ACME client against a local Boulder instance.
Production fit: Boulder is built for Let's Encrypt and Web PKI baseline requirements, and the maintainers say it is often not a good fit for other organizations' production use.
Production security: The deployment guide says components use mutual TLS issued from a special-purpose CA and describes firewalling components and limiting exposed ports.
Production readiness: The Docker development environment uses publicly available private key material, exposes debug ports, and is described as brittle to component failure.
Support: The maintainers prioritize support and development work that advances Let's Encrypt's mission and warn that timely support may not be available for other deployments.
License: The project is licensed under the Mozilla Public License 2.0.
Price from: Free

Where it ranks on Freedom251

Best Public Key Infrastructure Software in 2026#4 of 25

Is Boulder yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Boulder

Sources

github.com/letsencrypt/boulder· checked 4 Oct 2026
github.com/letsencrypt/boulder/wiki/Deployment-%26· checked 4 Oct 2026