Features
A complete ACME Certificate Authority with enterprise features, post-quantum security, and operational simplicity.
Standards & Protocol
Complete ACME v2 implementation with extensive challenge support.
RFC 8555 ACME v2
Full protocol implementation — HTTP API, JSON data model, JWS authentication, and the complete challenge framework for automated certificate management.
Six Challenge Types
http-01, dns-01, tls-alpn-01, dns-persist-01 (persistent DNS), onion-csr-01 (Tor .onion), and tkauth-01 (authority tokens).
Subdomain Authorization
RFC 9444 ancestor-domain authorization allows parent-domain validation to cover subdomains, reducing challenge overhead.
IP Identifier Validation
RFC 8738 support for issuing certificates to IPv4 and IPv6 addresses using http-01 and tls-alpn-01 challenges.
Certificate Profiles
Draft ACME profiles specification — advertise named profiles in the directory and let clients select profiles per order.
S/MIME Certificates
RFC 8823 email identifier type with email-reply-00 challenge and DKIM enforcement for S/MIME certificate issuance.
Security
Defense in depth from post-quantum cryptography to hardware key storage.
Post-Quantum Account Keys
ML-DSA-44/65/87 (FIPS 204) account key support via RFC 9964. Future-proof your certificate infrastructure against quantum attacks.
HSM / PKCS#11 CA Keys
Load CA signing keys from hardware security modules via PKCS#11 URI. The private key material never leaves the hardware token.
Mutual TLS
Server TLS with optional client certificate authentication (mTLS), including post-quantum composite certificate support.
CAA Enforcement
RFC 8659/8657 DNS CAA record checking before issuance, with accounturi and validationmethods parameter extensions.
Certificate Transparency
Merkle Tree Certificates (MTC) with append-only transparency log, checkpoint signing, and tile serving for verifiable issuance.
Composite TLS Signatures
18 ML-DSA composite variants as CA signing keys and 11 composite scheme code points for mTLS client authentication.
Enterprise
Scaling from a single instance to multi-node clusters with fine-grained access control.
Multi-Database Backends
SQLite for zero-config single-node deployments. PostgreSQL or MariaDB for production clusters. Switch with one configuration line.
Clustering & Replication
Built-in CRDT gossip protocol for multi-node deployments. Nodes converge automatically with no external coordination.
Role-Based Access Control
Granular RBAC for admin API operations. Define operator roles with specific permissions for accounts, orders, and certificates.
EAB & Kerberos / FreeIPA
External Account Binding with HMAC verification, Kerberos/GSSAPI authentication, and tight integration with FreeIPA (RHEL IdM) for managing certificates across your existing identity infrastructure.
STAR Certificates
RFC 8739 Short-Term, Automatically Renewed certificates for continuous short-lived certificate streams with cancel support.
Renewal Information (ARI)
RFC 9773 renewal window suggestions and certificate replacement tracking for coordinated, CA-guided renewal.
Delegated Certificates
RFC 9115 IdO/NDC delegation model for CDN certificate issuance with CSR template validation and upstream CA integration.
Operations
Straightforward deployment with comprehensive tooling for day-to-day management.
System-Native Crypto
Builds against system-provided OpenSSL for cryptographic operations. Integrates with your distribution's security updates and FIPS-validated modules.
TOML Configuration
Comprehensive, well-documented configuration file with sensible defaults. Every option is explained in the operator guide.
Admin CLI (akamuctl)
Full-featured command-line tool for managing accounts, certificates, profiles, and server configuration.
REST Admin API
Complete HTTP API for programmatic server management. Manage accounts, inspect orders, revoke certificates, and configure profiles.
CRL & OCSP
Built-in CRL distribution and OCSP responder endpoints for revocation status checking.
Performance Tuning
Configurable worker threads, connection pools, and database tuning. Benchmarking guide included in documentation.
Developer Tools
Libraries and tools for building on top of ACME.
Client Library
akamu-client — an async ACME client library for embedding certificate management directly in your applications.
CLI Client
akamu-cli — a full-featured command-line ACME client for requesting, renewing, and revoking certificates from any ACME server.
JWK/JWS Primitives
akamu-jose — a standalone library for JSON Web Key and JSON Web Signature operations, including ML-DSA support.
Tor .onion Support
RFC 9799 onion-csr-01 challenge validation for issuing certificates to Tor hidden service .onion domains.
Authority Token Challenges
RFC 9447/9448 tkauth-01 challenge with JWT authority token validation for STIR/SHAKEN telephony certificates.