# Deploying Boulder in my machine
**URL:** https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296
**Category:** Help
**Created:** [July 1, 2020, 5:17am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296 "2020-07-01T05:17:14Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@jibinnajeeb](https://community.letsencrypt.org/u/jibinnajeeb)
#### Post date: [July 1, 2020, 5:17am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/1 "2020-07-01T05:17:14Z")
I am trying to study boulder([https://github.com/letsencrypt/boulder](https://github.com/letsencrypt/boulder)) in my machine. This is for studying Certificate Authority and boulder to be implemented for our current project in our company.
I am facing issue in getting certificate from boulder using certbot client. The below explains step by step procedures I did
1, Added hostname in /etc/hosts -\> 0.0.0.0 [www.example.com](http://www.example.com)
2, Started boulder using sudo docker-compose up
3, sudo certbot certonly --standalone -d [www.example.com](http://www.example.com) --server [http://localhost:4000/directory](http://localhost:4000/directory)
After this I am getting below unauthorized error
Domain: [www.example.com](http://www.example.com)
Type: unauthorized
Detail: The key authorization file from the server did not match
this challenge
“jMcIS2vo4mZQtX2NiwJ8ZtGnIv9dIcQLJrNeqETstYY.OpMfxcxRo1pl4KT4GbITXwEtBRZfPOxFO9Zcwu9y2S4”
!= “”
I tried changing FakeDNS address to 172.17.0.1(docker ip), which is causing connection refused error.
Please help me solve this case as I am new to certificate authority and boulder
---
### Author:  [@\_az](https://community.letsencrypt.org/u/_az)
#### Post date: [July 1, 2020, 5:41am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/2 "2020-07-01T05:41:14Z")
> [@jibinnajeeb](#):
>
> I tried changing FakeDNS address to 172.17.0.1(docker ip), which is causing connection refused error.
I think you were on the right track here. The "connection refused" is probably because Boulder is configured by default to connect to non-standard HTTP/HTTPS ports. You'll want to change them to the standard ports:
```
$ jq .va.portConfig test/config/va.json
{
"httpPort": 5002,
"httpsPort": 5001,
"tlsPort": 5001
}
```
---
### Author:  [@jibinnajeeb](https://community.letsencrypt.org/u/jibinnajeeb)
#### Post date: [July 1, 2020, 5:59am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/3 "2020-07-01T05:59:33Z")
Thanks for the immediate help. I changed the config to
{
“httpPort”: 80,
“httpsPort”: 443,
“tlsPort”: 5001
}
Then restarted boulder and executed
sudo certbot certonly --standalone -d [www.example.com](http://www.example.com) --server [http://localhost:4000/directory](http://localhost:4000/directory)
Now getting below error
Domain: [www.example.com](http://www.example.com)
Type: connection
Detail: During secondary validation: Fetching
[http://www.example.com/.well-known/acme-challenge/MLPl4D9RD1WRhjxv5uFNQle-efjtI8opmZrkfB7bu0s:](http://www.example.com/.well-known/acme-challenge/MLPl4D9RD1WRhjxv5uFNQle-efjtI8opmZrkfB7bu0s:)
---
### Author:  [@\_az](https://community.letsencrypt.org/u/_az)
#### Post date: [July 1, 2020, 6:00am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/4 "2020-07-01T06:00:47Z")
Ah yeah, you need to make the same change to `va-remote-a.json` and `va-remote-b.json`.
It seems there have been some big changes to Boulder since I last used it.
---
### Author:  [@jibinnajeeb](https://community.letsencrypt.org/u/jibinnajeeb)
#### Post date: [July 1, 2020, 6:25am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/5 "2020-07-01T06:25:37Z")
Thanks \_az. I think its working, I got two files
/etc/letsencrypt/live/www.example.com/fullchain.pem
/etc/letsencrypt/live/www.example.com/privkey.pem
It will be good help if you can provide some info in how to use boulder as CA in intranet with n number of host. I am looking solution for mutual secured communication between host and not browser based
Any help appreciated.
Thanks
---
### Author:  [@\_az](https://community.letsencrypt.org/u/_az)
#### Post date: [July 1, 2020, 6:39am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/6 "2020-07-01T06:39:39Z")
Well, TLS is certainly a good way to create a system of mutual secure communication.
But Boulder is not a suitable tool for that. Boulder is created specifically to address the needs of a WebPKI CA with millions of subscribers. It is not a good fit for anything else.
There are friendlier tools that can create a private PKI/CA with client certificates and everything you need for mutual secure communication. For example [https://github.com/smallstep/certificates](https://github.com/smallstep/certificates) ([https://smallstep.com/docs/getting-started/](https://smallstep.com/docs/getting-started/)) can do all of this for you, and is pretty well documented. It even supports the same ACME protocol as Boulder/Let’s Encrypt, though I’m not sure whether you really need that at all.
The simplest thing:
- Create your own private PKI/CA with smallstep.
- Issue some client certificates for each of your hosts, from that CA.
- Configure each host’s webserver (or any kind of server, doesn’t need to be HTTP) to require TLS client certificate authentication, and verify against the CA certificate. You should be able to find ample examples for Apache or nginx or whatever webserver you use.
and there you go, mutual secure communication! Mould to your needs.
---
### Author:  [@jibinnajeeb](https://community.letsencrypt.org/u/jibinnajeeb)
#### Post date: [July 1, 2020, 1:39pm UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/7 "2020-07-01T13:39:30Z")
Hi Thanks for the detailed info about small step. It is very simple and it really helped me in understanding lot of things.
In smart step the root key is stored in ~/.step/certs/root\_ca.crt. This key I have to install in every host machine in order to trust CA(below code). Am I right
> $ sudo cp root-ca.crt /usr/share/ca-certificates/
> $ sudo dpkg-reconfigure ca-certificates
I am checking where the root certificate authority key in boulder also. But couldnt find the correct one. Could you please help in this one too?
Thanks
---
### Author:  [@\_az](https://community.letsencrypt.org/u/_az)
#### Post date: [July 1, 2020, 10:20pm UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/8 "2020-07-01T22:20:16Z")
You probably don’t want the entire system to trust the CA certificate. That is potentially quite dangerous.
Say you are trying to create a mutually authenticated secure channel - mutual TLS. The purpose of the CA certificate would be to verify that the host you are talking to has a certificate signed by that CA, and vice-versa. Everybody else is unauthorized.
How you actually configure that comes down to what server software you are using. There are some pretty good examples on this page: [https://smallstep.com/hello-mtls](https://smallstep.com/hello-mtls) . Maybe start with one of the simple examples, like nginx (server) + curl (client).
---
### Author:  [@jibinnajeeb](https://community.letsencrypt.org/u/jibinnajeeb)
#### Post date: [July 2, 2020, 7:01am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/9 "2020-07-02T07:01:58Z")
Hi \_az thanks for the info.
What I understand is either we need to add CA’s certificate in trust store which in your case is dangerous or we need to add “–cacert” for each request like shown below.
```auto
curl --cert client.crt --key client.key --cacert ca.crt https://myserver.internal.net:443
```
Is my understanding correct?
Thanks
---
### Author:  [@\_az](https://community.letsencrypt.org/u/_az)
#### Post date: [July 2, 2020, 8:30am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/10 "2020-07-02T08:30:13Z")
Yes. It’s hard to tell if any of this is good advice as you’ve been a bit vague about what you’re trying to do.
---
### Author:  [@jibinnajeeb](https://community.letsencrypt.org/u/jibinnajeeb)
#### Post date: [July 2, 2020, 10:46am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/11 "2020-07-02T10:46:12Z")
```auto
curl --cert fullchain.pem --key privkey.pem --cacert ca.crt https://myserver.internal.net:443
```
Where can I find the root CA certificate in case of boulder to use with above code?
---
### Author:  [@jibinnajeeb](https://community.letsencrypt.org/u/jibinnajeeb)
#### Post date: [July 3, 2020, 10:05am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/12 "2020-07-03T10:05:58Z")
Found the root certificate inside docker container --\> /tmp/root-cert-rsa.pem
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [August 2, 2020, 10:06am UTC](https://community.letsencrypt.org/t/deploying-boulder-in-my-machine/127296/13 "2020-08-02T10:06:00Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.