Running Boulder in production

[cpu]

Hi @JonahAragon,

@JonahAragon

I can't really tell so correct me if I'm wrong, but it seems to me that CFSSL is more suited towards internal networks in companies, etc where we had reasonable control over all the hostnames and endpoints. Whereas our network is more similar to an entire alternate internet. We allow anybody to register domains on our system and host them wherever (basically we have a bunch of domain registries that just aren't recognised by ICANN roots) so the user base is spread out and not necessarily trustworthy.

That's correct - when we typically get this question it's for internal networks and Boulder/ACME don't really bring much value to that environment. For your use case it sounds like Boulder could be more applicable.

@JonahAragon

That's why I was looking into ACME clients and Boulder as a method of verification, because certbot has a --server flag I believe

It does We use the same flag for testing against local Boulder instances.

@JonahAragon

As @pfg said, I'll probably have to find someone within our community that understands Go a bit more/look into it myself in greater detail. Obviously Boulder is very Let's Encrypt centric, but when the ideal end goal is to build "Let's Encrypt for OpenNIC" so to speak, it seems like a good option to try and get working.

Please feel free to open issues on the repo if you find things that cause you headache. Our primary focus will always be Let's Encrypt centric but generally speaking good software is flexible so I'd hope we can help you out as well.