Usage of DynamoDB as DB

Record Format

When using DynamoDB as a database, it is designed to handle multiple partitions in a single table. Prease refer overview documentation for details about certificate revocation data in DyOCSP.

Table Design

Attribute Definitions And Key Schema

AttributeName	AttributeType	KeyType
ca	S	HASH
serial	S	RANGE

This key is not used in DyOCSP, but it is useful for managing revocation information.

Global Secondary Index

AttributeName	AttributeType	KeyType
ca	S	HASH

DyOCSP uses this global secondary index for utilizing the Scan API.

Required Attributes for An Items

AttributeName	AttributeType	Description
ca	S	CA Name
serial	S	Serial Number
rev_type	S	Revocation Type
exp_date	S	Expiration Date
rev_date	S	Revoked Date
crl_reason	S	CRL Reason

These attributes are required, and since DyOCSP only requires mandatory attributes, any other attributes necessary for the management of private CAs may be attached.

Basic Usage

1. Create Table On AWS Console

Since the creation of a table involves a lot of configuration, only the necessary parts will be explained. The instructions will be illustrated with an image of the AWS console.

Set up keys of table as follows.

Set up global secondary index as follows.

Create IAM Policy

The following IAM policy will suffice for DyOCSP:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:Scan"
            ],
            "Resource": "arn:aws:dynamodb:your-region:your-aws-id:table/ca_db"
        }
    ]
}

2. Prepare CA and Certificate

The following certificates are used here as an example.

server.crt

example-ca.crt

ocsp.crt

ocsp.key

2. Put Item

Create an item indicating that the certificate is currently valid, as follows: This item is represented in JSON format:

{
  "ca": {
    "S": "example-ca"
  },
  "serial": {
    "S": "C9718DB00D60FF95A22A868AEF7357EB"
  },
  "rev_type": {
    "S": "V"
  },
  "exp_date": {
    "S": "330912010907Z"
  },
  "rev_date": {
    "S": ""
  },
  "crl_reason": {
    "S": ""
  }
}

3. Prepare DyOCSP Configuration

Create a configuration file for DynamoDB:

dyocsp.yml

version: 0.1
log:
  level: "info"
  format: "pretty"
responder:
  ca: "example-ca"
  responder_certificate: "ocsp.crt"
  responder_key: "ocsp.key"
  issuer_certificate: "example-ca.crt"
cache:
  interval: 30
  delay: 8
db:
  dynamodb:
    region: "your-region"
    table_name: "ca_db"
    ca_gsi: "ca-index"
    retry_max_attempts: 2
    timeout: 120
http:
  addr: "localhost"
  port: 9080

4. Run DyOCSP

First, set the authentication information.

export AWS_ACCESS_KEY_ID=your-key-id
export AWS_SECRET_ACCESS_KEY=your-secret-access-key

or

aws configure set aws_access_key_id dummyaccesskey
aws configure set aws_secret_access_key dummysecretkey

Second, run dyocsp.

dyocsp -c dyocsp.yml

Test OCSP Request.

openssl ocsp -CAfile example-ca.crt  -issuer example-ca.crt -cert server.crt -no_nonce -url http://localhost:9080

5. Update Item to Revoke the Certificate

To update an item indicating that the certificate is currently revoked:

This item is represented in JSON format:

{
  "ca": {
    "S": "example-ca"
  },
  "serial": {
    "S": "C9718DB00D60FF95A22A868AEF7357EB"
  },
  "crl_reason": {
    "S": "unspecified"
  },
  "exp_date": {
    "S": "330912010907Z"
  },
  "rev_date": {
    "S": "231012010907Z"
  },
  "rev_type": {
    "S": "R"
  }

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dynamodb.md

dynamodb.md

Usage of DynamoDB as DB

Record Format

Table Design

Attribute Definitions And Key Schema

Global Secondary Index

Required Attributes for An Items

Basic Usage

1. Create Table On AWS Console

Create IAM Policy

2. Prepare CA and Certificate

2. Put Item

3. Prepare DyOCSP Configuration

4. Run DyOCSP

5. Update Item to Revoke the Certificate

Files

dynamodb.md

Latest commit

History

dynamodb.md

File metadata and controls

Usage of DynamoDB as DB

Record Format

Table Design

Attribute Definitions And Key Schema

Global Secondary Index

Required Attributes for An Items

Basic Usage

1. Create Table On AWS Console

Create IAM Policy

2. Prepare CA and Certificate

2. Put Item

3. Prepare DyOCSP Configuration

4. Run DyOCSP

5. Update Item to Revoke the Certificate