Introducing the Akāmu ACME Framework

What is the Akāmu ACME Framework?

The Akāmu ACME framework is a self-hosted ACME (RFC 8555) Certificate Authority. The name is Akkadian for mist or dust cloud — fitting for a framework that issues a myriad of certificates.

It is designed for deployment inside private networks or behind reverse proxies, where you need automated certificate management but don’t want to depend on a public CA.

Why Another ACME Server?

Existing ACME servers are excellent, but we wanted something that:

Integrates with enterprise identity — External Account Binding with Kerberos/GSSAPI authentication and tight integration with FreeIPA (RHEL IdM) for managing certificates across your existing identity infrastructure.
Implements the full RFC landscape — not just the basics, but STAR certificates, ARI renewal, subdomain authorization, IP identifiers, .onion support, and more.
Takes post-quantum seriously — ML-DSA account keys and composite TLS signatures are supported today, not on a roadmap.
Runs anywhere — builds against system-provided OpenSSL and supports SQLite out of the box, from a Raspberry Pi to a multi-node cluster with PostgreSQL.
Protects your CA keys — first-class PKCS#11/HSM support means the CA private key never has to touch disk.

Key Features

Full RFC 8555 ACME v2 protocol
Six challenge types: http-01, dns-01, tls-alpn-01, dns-persist-01, onion-csr-01, tkauth-01
Post-quantum account keys (ML-DSA-44/65/87)
HSM/PKCS#11 CA key storage
Multi-database support (SQLite, PostgreSQL, MariaDB)
Multi-node clustering with CRDT gossip replication
Merkle Tree Certificate transparency
Role-based access control with EAB and Kerberos/GSSAPI
Comprehensive admin CLI and REST API

Getting Started

Check out the quickstart guide to install the Akāmu ACME framework, generate a CA, and issue your first certificate in under five minutes.

What’s Next

We’re actively working on expanding RFC coverage and improving the developer experience. Follow the project on Codeberg and check back here for updates.