Self-hosted ACME
Certificate Authority
A standards-compliant, post-quantum ready CA for private networks.
Built for Private Infrastructure
Everything you need to run a production ACME certificate authority on your own terms.
RFC 8555 ACME v2
Full implementation of the ACME protocol — accounts, orders, authorizations, challenges, and revocation.
Post-Quantum Ready
ML-DSA account keys (FIPS 204) and composite TLS signatures for quantum-resistant certificate management.
HSM / PKCS#11
Load CA private keys from hardware security modules via PKCS#11 URI. Key material never leaves the token.
Multi-Database
SQLite for single-node simplicity, PostgreSQL or MariaDB for production scale. Switch with one config line.
Clustering & Replication
Built-in CRDT gossip protocol for multi-node deployments with automatic state convergence.
EAB & Kerberos / FreeIPA
External Account Binding with Kerberos/GSSAPI authentication and tight FreeIPA (RHEL IdM) integration.
Up and Running in Minutes
Configure, start, and issue your first certificate.
$ akamu /etc/akamu/config.toml
INFO akamu: loading config from '/etc/akamu/config.toml'
INFO akamu: opening database '/var/lib/akamu/akamu.db'
INFO akamu::ca::init: Generating new CA key (ec:P-256)
INFO akamu::ca::init: Generated CA certificate (ec:P-256, 10 years)
INFO akamu: ACME server listening on 0.0.0.0:8080
(base_url=https://acme.example.com)The Akāmu Ecosystem
A server, a client library, and a CLI — everything you need for automated certificate management.
Akāmu Server
Full ACME CA with admin API, challenge validation, CRL/OCSP, and certificate profiles.
Client Library
Async ACME client library (akamu-client) for embedding certificate management directly in your applications.
CLI Tool
Command-line certificate management with akamu-cli. Request, renew, and revoke certificates from your terminal.
23
IETF RFCs and standards implemented — and counting
From RFC 8555 (ACME v2) to RFC 9964 (ML-DSA) and draft MTC transparency, The Akāmu ACME framework tracks the standards so you don't have to.
View RFC Compliance →