diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dfd39385e..02600590a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,7 +1,7 @@
 # Contributing to Boulder
 
 > **Note:** We are currently in a *General Availability* only merge window, meaning
-> we will only be reviewing & merging patches which close a issue tagged with the *General
+> we will only be reviewing & merging patches which close an issue tagged with the *General
 > Availability* milestone.
 
 Thanks for helping us build Boulder, if you haven't already had a chance to look
diff --git a/DESIGN.md b/DESIGN.md
index c2b46fa0b..7ed53c1dd 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -214,7 +214,7 @@ Notes:
 
 * 7-8: WFE does the following:
   * Create a URL from the certificate's serial number
-  * Return the certificate with it's URL
+  * Return the certificate with its URL
 
 
 ## Revoke Certificate
@@ -244,4 +244,4 @@ Notes:
   * Log the success or failure of the revocation
 
 * 5-6: WFE does the following:
-  * Return an indication of the sucess or failure of the revocation
+  * Return an indication of the success or failure of the revocation
diff --git a/cmd/admin-revoker/main.go b/cmd/admin-revoker/main.go
index 56cf8596e..20f3b6889 100644
--- a/cmd/admin-revoker/main.go
+++ b/cmd/admin-revoker/main.go
@@ -163,7 +163,7 @@ func main() {
 				// 1: serial,  2: reasonCode (3: deny flag)
 				serial := c.Args().First()
 				reasonCode, err := strconv.Atoi(c.Args().Get(1))
-				cmd.FailOnError(err, "Reason code argument must be a integer")
+				cmd.FailOnError(err, "Reason code argument must be an integer")
 				deny := c.GlobalBool("deny")
 
 				cac, auditlogger, dbMap, _ := setupContext(c)
@@ -190,9 +190,9 @@ func main() {
 			Action: func(c *cli.Context) {
 				// 1: registration ID,  2: reasonCode (3: deny flag)
 				regID, err := strconv.ParseInt(c.Args().First(), 10, 64)
-				cmd.FailOnError(err, "Registration ID argument must be a integer")
+				cmd.FailOnError(err, "Registration ID argument must be an integer")
 				reasonCode, err := strconv.Atoi(c.Args().Get(1))
-				cmd.FailOnError(err, "Reason code argument must be a integer")
+				cmd.FailOnError(err, "Reason code argument must be an integer")
 				deny := c.GlobalBool("deny")
 
 				cac, auditlogger, dbMap, sac := setupContext(c)
diff --git a/cmd/config.go b/cmd/config.go
index 2d29a6b55..ee9cb44e4 100644
--- a/cmd/config.go
+++ b/cmd/config.go
@@ -131,7 +131,7 @@ type Config struct {
 
 		Path          string
 		ListenAddress string
-		// MaxAge is the max-age to set in the Cache-Controler response
+		// MaxAge is the max-age to set in the Cache-Control response
 		// header. It is a time.Duration formatted string.
 		MaxAge ConfigDuration
 
diff --git a/cmd/expiration-mailer/main.go b/cmd/expiration-mailer/main.go
index bf56aea75..e84532f5b 100644
--- a/cmd/expiration-mailer/main.go
+++ b/cmd/expiration-mailer/main.go
@@ -110,7 +110,7 @@ func (m *mailer) updateCertStatus(serial string) error {
 
 	err = tx.Commit()
 	if err != nil {
-		m.log.Err(fmt.Sprintf("Error commiting transaction for certificate %s: %s", serial, err))
+		m.log.Err(fmt.Sprintf("Error committing transaction for certificate %s: %s", serial, err))
 		tx.Rollback()
 		return err
 	}
diff --git a/cmd/shell.go b/cmd/shell.go
index 466af0232..cc6a7178f 100644
--- a/cmd/shell.go
+++ b/cmd/shell.go
@@ -157,7 +157,7 @@ func (as *AppShell) Run() {
 	FailOnError(err, "Failed to run application")
 }
 
-// StatsAndLogging constructs a Statter and and AuditLogger based on its config
+// StatsAndLogging constructs a Statter and an AuditLogger based on its config
 // parameters, and return them both. Crashes if any setup fails.
 // Also sets the constructed AuditLogger as the default logger.
 func StatsAndLogging(statConf StatsdConfig, logConf SyslogConfig) (statsd.Statter, *blog.AuditLogger) {
diff --git a/core/objects.go b/core/objects.go
index b8379a89b..2314d84e1 100644
--- a/core/objects.go
+++ b/core/objects.go
@@ -294,7 +294,7 @@ type Challenge struct {
 	// The status of this challenge
 	Status AcmeStatus `json:"status,omitempty"`
 
-	// Contains the error that occured during challenge validation, if any
+	// Contains the error that occurred during challenge validation, if any
 	Error *probs.ProblemDetails `json:"error,omitempty"`
 
 	// If successful, the time at which this challenge
@@ -487,7 +487,7 @@ type Certificate struct {
 }
 
 // IdentifierData holds information about what certificates are known for a
-// given identifier. This is used to present Proof of Posession challenges in
+// given identifier. This is used to present Proof of Possession challenges in
 // the case where a certificate already exists. The DB table holding
 // IdentifierData rows contains information about certs issued by Boulder and
 // also information about certs observed from third parties.
diff --git a/core/util.go b/core/util.go
index 7de56a624..4ea7e8026 100644
--- a/core/util.go
+++ b/core/util.go
@@ -460,7 +460,7 @@ func LoadCertBundle(filename string) ([]*x509.Certificate, error) {
 	return bundle, nil
 }
 
-// LoadCert loads a PEM certificate specified by filename or returns a error
+// LoadCert loads a PEM certificate specified by filename or returns an error
 func LoadCert(filename string) (cert *x509.Certificate, err error) {
 	certPEM, err := ioutil.ReadFile(filename)
 	if err != nil {
diff --git a/log/audit-logger.go b/log/audit-logger.go
index 1f6741697..d13f669b8 100644
--- a/log/audit-logger.go
+++ b/log/audit-logger.go
@@ -119,7 +119,7 @@ func SetAuditLogger(logger *AuditLogger) (err error) {
 
 // GetAuditLogger obtains the singleton audit logger. If SetAuditLogger
 // has not been called first, this method initializes with basic defaults.
-// The basic defaults cannot error, and subequent access to an already-set
+// The basic defaults cannot error, and subsequent access to an already-set
 // AuditLogger also cannot error, so this method is error-safe.
 func GetAuditLogger() *AuditLogger {
 	_Singleton.once.Do(func() {
@@ -271,7 +271,7 @@ func (log *AuditLogger) AuditObject(msg string, obj interface{}) (err error) {
 	return log.auditAtLevel(syslog.LOG_NOTICE, formattedEvent)
 }
 
-// InfoObject sends a INFO-severity JSON-serialized object message.
+// InfoObject sends an INFO-severity JSON-serialized object message.
 func (log *AuditLogger) InfoObject(msg string, obj interface{}) (err error) {
 	formattedEvent, logErr := log.formatObjectMessage(msg, obj)
 	if logErr != nil {
diff --git a/mocks/mocks.go b/mocks/mocks.go
index 79446f94a..f15036915 100644
--- a/mocks/mocks.go
+++ b/mocks/mocks.go
@@ -46,7 +46,7 @@ func (mock *DNSResolver) LookupTXT(hostname string) ([]string, error) {
 	return []string{"hostname"}, nil
 }
 
-// TimeoutError returns a a net.OpError for which Timeout() returns true.
+// TimeoutError returns a net.OpError for which Timeout() returns true.
 func TimeoutError() *net.OpError {
 	return &net.OpError{
 		Err: os.NewSyscallError("ugh timeout", timeoutError{}),
diff --git a/publisher/publisher.go b/publisher/publisher.go
index a464d3c34..1d4ce8dc4 100644
--- a/publisher/publisher.go
+++ b/publisher/publisher.go
@@ -25,7 +25,7 @@ type Log struct {
 	verifier *ct.SignatureVerifier
 }
 
-// NewLog returns a initialized Log struct
+// NewLog returns an initialized Log struct
 func NewLog(uri, b64PK string) (*Log, error) {
 	if strings.HasSuffix(uri, "/") {
 		uri = uri[0 : len(uri)-2]
diff --git a/ra/registration-authority.go b/ra/registration-authority.go
index 455c0c5ac..cc1d76fdf 100644
--- a/ra/registration-authority.go
+++ b/ra/registration-authority.go
@@ -274,7 +274,7 @@ func checkPendingAuthorizationLimit(sa core.StorageGetter, limit *cmd.RateLimitP
 	return nil
 }
 
-// NewAuthorization constuct a new Authz from a request. Values (domains) in
+// NewAuthorization constructs a new Authz from a request. Values (domains) in
 // request.Identifier will be lowercased before storage.
 func (ra *RegistrationAuthorityImpl) NewAuthorization(request core.Authorization, regID int64) (authz core.Authorization, err error) {
 	reg, err := ra.SA.GetRegistration(regID)
diff --git a/rpc/amqp-rpc.go b/rpc/amqp-rpc.go
index 9c4a7f397..624bd15e6 100644
--- a/rpc/amqp-rpc.go
+++ b/rpc/amqp-rpc.go
@@ -192,7 +192,7 @@ type rpcError struct {
 	HTTPStatus int    `json:"status,omitempty"`
 }
 
-// Wraps a error in a rpcError so it can be marshalled to
+// Wraps an error in a rpcError so it can be marshalled to
 // JSON.
 func wrapError(err error) *rpcError {
 	if err != nil {
@@ -298,7 +298,7 @@ func (r rpcResponse) debugString() string {
 	return fmt.Sprintf("%s, RPCERR: %v", ret, r.Error)
 }
 
-// makeAmqpChannel sets a AMQP connection up using SSL if configuration is provided
+// makeAmqpChannel sets an AMQP connection up using SSL if configuration is provided
 func makeAmqpChannel(conf *cmd.AMQPConfig) (*amqp.Channel, error) {
 	var conn *amqp.Connection
 	var err error
diff --git a/sa/storage-authority.go b/sa/storage-authority.go
index 1d8937f0d..f70cb2f41 100644
--- a/sa/storage-authority.go
+++ b/sa/storage-authority.go
@@ -52,7 +52,7 @@ type authzModel struct {
 }
 
 // NewSQLStorageAuthority provides persistence using a SQL backend for
-// Boulder. It will modify the given gorp.DbMap by adding relevent tables.
+// Boulder. It will modify the given gorp.DbMap by adding relevant tables.
 func NewSQLStorageAuthority(dbMap *gorp.DbMap, clk clock.Clock) (*SQLStorageAuthority, error) {
 	logger := blog.GetAuditLogger()
 
@@ -318,7 +318,7 @@ func (t TooManyCertificatesError) Error() string {
 // subdomains. It returns a map from domains to counts, which is guaranteed to
 // contain an entry for each input domain, so long as err is nil.
 // The highest count this function can return is 10,000. If there are more
-// certificates than that matching one ofthe provided domain names, it will return
+// certificates than that matching one of the provided domain names, it will return
 // TooManyCertificatesError.
 func (ssa *SQLStorageAuthority) CountCertificatesByNames(domains []string, earliest, latest time.Time) (map[string]int, error) {
 	ret := make(map[string]int, len(domains))
@@ -336,7 +336,7 @@ func (ssa *SQLStorageAuthority) CountCertificatesByNames(domains []string, earli
 // certificates issued in the given time range for that domain and its
 // subdomains.
 // The highest count this function can return is 10,000. If there are more
-// certificates than that matching one ofthe provided domain names, it will return
+// certificates than that matching one of the provided domain names, it will return
 // TooManyCertificatesError.
 func (ssa *SQLStorageAuthority) countCertificatesByName(domain string, earliest, latest time.Time) (int, error) {
 	var count int64
@@ -633,7 +633,7 @@ func (ssa *SQLStorageAuthority) FinalizeAuthorization(authz core.Authorization)
 
 	// Check that a pending authz exists
 	if !existingPending(tx, authz.ID) {
-		err = errors.New("Cannot finalize a authorization that is not pending")
+		err = errors.New("Cannot finalize an authorization that is not pending")
 		tx.Rollback()
 		return
 	}
@@ -790,7 +790,7 @@ func (ssa *SQLStorageAuthority) CountPendingAuthorizations(regID int64) (count i
 	return
 }
 
-// ErrNoReceipt is a error type for non-existent SCT receipt
+// ErrNoReceipt is an error type for non-existent SCT receipt
 type ErrNoReceipt string
 
 func (e ErrNoReceipt) Error() string {
@@ -817,7 +817,7 @@ func (ssa *SQLStorageAuthority) GetSCTReceipt(serial string, logID string) (rece
 	return
 }
 
-// ErrDuplicateReceipt is a error type for duplicate SCT receipts
+// ErrDuplicateReceipt is an error type for duplicate SCT receipts
 type ErrDuplicateReceipt string
 
 func (e ErrDuplicateReceipt) Error() string {
diff --git a/test/create_db.sh b/test/create_db.sh
index 3c1600f52..783934a8c 100755
--- a/test/create_db.sh
+++ b/test/create_db.sh
@@ -3,7 +3,7 @@ set -o errexit
 cd $(dirname $0)/..
 source test/db-common.sh
 
-# set db connection for if running in a seperate container or not
+# set db connection for if running in a separate container or not
 dbconn="-u root"
 if [[ ! -z "$MYSQL_CONTAINER" ]]; then
 	dbconn="-u root -h 127.0.0.1 --port 3306"
diff --git a/va/validation-authority.go b/va/validation-authority.go
index 2007fcade..8aab57fb4 100644
--- a/va/validation-authority.go
+++ b/va/validation-authority.go
@@ -85,7 +85,7 @@ type verificationRequestEvent struct {
 }
 
 // getAddr will query for all A records associated with hostname and return the
-// prefered address, the first net.IP in the addrs slice, and all addresses resolved.
+// preferred address, the first net.IP in the addrs slice, and all addresses resolved.
 // This is the same choice made by the Go internal resolution library used by
 // net/http, except we only send A queries and accept IPv4 addresses.
 // TODO(#593): Add IPv6 support
@@ -118,7 +118,7 @@ func (d *dialer) Dial(_, _ string) (net.Conn, error) {
 	return realDialer.Dial("tcp", net.JoinHostPort(d.record.AddressUsed.String(), d.record.Port))
 }
 
-// resolveAndConstructDialer gets the prefered address using va.getAddr and returns
+// resolveAndConstructDialer gets the preferred address using va.getAddr and returns
 // the chosen address and dialer for that address and correct port.
 func (va *ValidationAuthorityImpl) resolveAndConstructDialer(name string, port int) (dialer, *probs.ProblemDetails) {
 	d := dialer{
diff --git a/va/validation-authority_test.go b/va/validation-authority_test.go
index 6b94a74d2..2c622a20e 100644
--- a/va/validation-authority_test.go
+++ b/va/validation-authority_test.go
@@ -122,7 +122,7 @@ func httpSrv(t *testing.T, token string) *httptest.Server {
 			test.AssertNotError(t, err, "failed to get server test port")
 			http.Redirect(w, r, fmt.Sprintf("http://other.valid:%d/path", port), 302)
 		} else if strings.HasSuffix(r.URL.Path, pathReLookupInvalid) {
-			t.Logf("HTTPSRV: Got a redirect req to a invalid hostname\n")
+			t.Logf("HTTPSRV: Got a redirect req to an invalid hostname\n")
 			http.Redirect(w, r, "http://invalid.invalid/path", 302)
 		} else if strings.HasSuffix(r.URL.Path, pathLooper) {
 			t.Logf("HTTPSRV: Got a loop req\n")
@@ -868,7 +868,7 @@ func TestDNSValidationOK(t *testing.T) {
 }
 
 // TestDNSValidationLive is an integration test, depending on
-// the existance of some Internet resources. Because of that,
+// the existence of some Internet resources. Because of that,
 // it asserts nothing; it is intended for coverage.
 func TestDNSValidationLive(t *testing.T) {
 	stats, _ := statsd.NewNoopClient()
diff --git a/wfe/web-front-end.go b/wfe/web-front-end.go
index 4a2566bab..e083d9a9c 100644
--- a/wfe/web-front-end.go
+++ b/wfe/web-front-end.go
@@ -296,7 +296,7 @@ const (
 // the key in the JWS headers, and return the key plus a dummy registration if
 // successful. If a caller passes regCheck = false, it should plan on validating
 // the key itself.  verifyPOST also appends its errors to requestEvent.Errors so
-// code calling it does not need to if they imediately return a response to the
+// code calling it does not need to if they immediately return a response to the
 // user.
 func (wfe *WebFrontEndImpl) verifyPOST(logEvent *requestEvent, request *http.Request, regCheck bool, resource core.AcmeResource) ([]byte, *jose.JsonWebKey, core.Registration, *probs.ProblemDetails) {
 	// TODO: We should return a pointer to a registration, which can be nil,
@@ -608,7 +608,7 @@ func (wfe *WebFrontEndImpl) NewAuthorization(logEvent *requestEvent, response ht
 // RevokeCertificate is used by clients to request the revocation of a cert.
 func (wfe *WebFrontEndImpl) RevokeCertificate(logEvent *requestEvent, response http.ResponseWriter, request *http.Request) {
 
-	// We don't ask verifyPOST to verify there is a correponding registration,
+	// We don't ask verifyPOST to verify there is a corresponding registration,
 	// because anyone with the right private key can revoke a certificate.
 	body, requestKey, registration, prob := wfe.verifyPOST(logEvent, request, false, core.ResourceRevokeCert)
 	if prob != nil {
diff --git a/wfe/web-front-end_test.go b/wfe/web-front-end_test.go
index 4fa20474d..830cca842 100644
--- a/wfe/web-front-end_test.go
+++ b/wfe/web-front-end_test.go
@@ -605,7 +605,7 @@ func TestIssueCertificate(t *testing.T) {
 		responseWriter.Body.String(),
 		`{"type":"urn:acme:error:malformed","detail":"Error unmarshaling certificate request","status":400}`)
 
-	// Valid, signed JWS body, payload has a invalid signature on CSR and no authorizations:
+	// Valid, signed JWS body, payload has an invalid signature on CSR and no authorizations:
 	// alias b64url="base64 -w0 | sed -e 's,+,-,g' -e 's,/,_,g'"
 	// openssl req -outform der -new -nodes -key wfe/test/178.key -subj /CN=foo.com | \
 	// sed 's/foo.com/fob.com/' | b64url