What does HackerNews think of boulder?

An ACME-based certificate authority, written in Go.

Language: Go

#15 in Go
Operating a private CA is trivial, there are packages to automate it at every level from simple manual scripting to fully-automated ACME servers such as Boulder[0].

For proprietary software it's idiomatic to use a private CA for securing connections to a central server, to avoid the risk of DNS hijacking or a malicious third-party CA. For open-source software it will, definitionally, allow substituting different server key validation options for users who prefer to run their own servers.

The only real problem QUIC's mandatory TLS causes is that localhost development becomes marginally more difficult, but even as someone who loves running my in-development stuff on localhost it's clear that the security of the internet as a whole is of far greater value.

[0] https://github.com/letsencrypt/boulder

GP's post prompted me to look into LE's ACME server implementation, Boulder [1], but it's pretty apparent that Boulder is not suitable for small scale deployments. But the smallstep "certificates" project seems to be a lot more reasonable for this use-case. Thanks for sharing, I'll definitely check it out!

[1]: https://github.com/letsencrypt/boulder

Why are you assuming that their workload includes just one query per emitted certificate?

The reality is that they are storing information during challenges, implementing rate limiting per-account, supporting OCSP validation and a few other things.

You can investigate further if you really want to see the queries that they make against the database since their software (Boulder) is open source [1]. Most queries are in the files in the "sa" (storage authority) folder.

[1] https://github.com/letsencrypt/boulder/

LetsEncrypt provide two reference implementations of an ACME server, in Pebble[0] (not production ready) and Boulder[1]

[0]: https://github.com/letsencrypt/pebble

[1]: https://github.com/letsencrypt/boulder

ACME is currently an IETF draft: https://tools.ietf.org/html/draft-ietf-acme-acme-07

As far as I know there's only one serious server-side implementation right now, and that's Let's Encrypt's open-source Boulder project: https://github.com/letsencrypt/boulder

I'm curious if people other than LE have tried deploying Boulder in production, now that it exists. It seems like probably close to what a public CA wants.

Ideally you'd have some way of tying it into some internal authorization database instead of relying on HTTP challenges, but HTTP challenges would work too.

https://github.com/letsencrypt/boulder

You could use their code/system, if you set up something like: https://github.com/letsencrypt/boulder internally?
For internal test environments, you'd probably want to run your own ACME server[0] and use certs from that if you can. Then you only need to trust your internal CA that you can manager, rather than the test one that LetsEncrypt offer.

[0] https://github.com/letsencrypt/boulder

For testing just use a local install of boulder server, https://github.com/letsencrypt/boulder . It is very straightforward to run one especially when using their Docker scripts. That is how I check my setup against letsencrypt during development/testing on my laptop.
They do! boulder[1], the server software behind Let's Encrypt, is open source.

[1]: https://github.com/letsencrypt/boulder

For private sites just use your own CA.

Also the server for LetsEncrypt is open source [1] and comes with test scripts to run it during development and testing to avoid premature exposure to the public instance of LetsEncrypt.

[1] https://github.com/letsencrypt/boulder

I would imagine most of the money goes towards:

- Development of the official client[1] and boulder[2], the CA server software behind Let's Encrypt. Both are relatively big projects with lots of things to add/improve on.

- Hosting CA servers in two separate data centers. HSMs for key storage are usually rather expensive as well. CRLs and OCSP are quite bandwidth-intensive[3], that's probably where Akamai's sponsorship comes in. Ops teams have to be available 24/7 in case of outages.

- I'd guess the auditing costs are quite substantial as well. I'm not sure what's necessary to get added to the various root programs out there (Microsoft, Mozilla etc.), but I doubt it's free (unless that's part of some sponsorship).

(I'm not affiliated with Let's Encrypt, just my perspective)

[1]: https://github.com/letsencrypt/letsencrypt [2]: https://github.com/letsencrypt/boulder [3]: https://blog.cloudflare.com/the-hard-costs-of-heartbleed/

Glad you like the project!

Contributing to our software is one way to help:

https://github.com/letsencrypt/boulder

https://github.com/letsencrypt/lets-encrypt-preview

Also, if you work for a company that might be interested in sponsoring us, starting that conversation is another great way to help out.

> If they already have the CA stuff ready can they just release that?

While I'm sure they have something ready[0], I'm not sure they have a fully-worked-out policy for running it (required to get into certificate chains), or a production deployment of it, or a third-party vulnerability test of it.

Additionally, ACME verification is a vaguely complicated protocol which will likely need a tool to sign the various messages involved (or you're going to be looking at munging together OpenSSL commands), and you're looking at the developer preview of that.

[0] https://github.com/letsencrypt/boulder