1
2
3
4
5
6
7
# openssl genrsa -des3 -out mytest.joinc.co.kr.key 2048
Generating RSA private key, 2048 bit long modulus
.........................................................+++
.............................................+++
e is 65537 (0x10001)
Enter pass phrase for ssl.key: 
Verifying - Enter pass phrase for ssl.key: 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
5
# openssl rsa -in mytest.joinc.co.kr.key -out mytest.joinc.co.kr.key.nopass
Enter pass phrase for ssl.key: 위에서 입력한 패스워드 입력 
writing RSA key
# cp mytest.joinc.co.kr.key.nopass mytest.joinc.co.kr.key
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
5
6
7
8
9
10
11
# openssl req -new -key mytest.joinc.co.kr.key -out mytest.joinc.co.kr.csr
Enter pass phrase for ssl.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
....
....
....
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
# openssl x509 -req -days 36500 -in mytest.joinc.co.kr.csr -signkey mytest.joinc.co.kr.key -out mytest.joinc.co.kr.crt
Signature ok
subject=/C=KR/ST=Seoul/L=Seocho/O=Joinc/OU=Joinc/CN=mytest.joinc.co.kr/emailAddress=yundream@gmail.com
Getting Private key
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# PHP-FPM Local bind 주소
upstream serverpool {
    server localhost:8000;
}
# HTTP 설정
server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;
    # 생략
}
server {
    listen 443 ssl;
    root /var/www/mytest;
    index index.html index.htm index.php;
    server_name mytest.joinc.co.kr;
    ssl_certificate     /etc/nginx/ssl/mytest.joinc.co.kr.crt;
    ssl_certificate_key /etc/nginx/ssl/mytest.joinc.co.kr.key;
    ssl_protocols       SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;
}
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
{
   "web" : {
      "auth_uri" : "https://accounts.google.com/o/oauth2/auth",
      "redirect_uris" : [
         "https://mytest.joinc.co.kr/oauth2callback.php"
      ],
      "client_id" : "xxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com",
      "client_secret" : "xxxxxxxxxxxxxxxx_DU_p-EPL",
      "client_email" : "xxxxxxxxxxxx@developer.gserviceaccount.com",                
      "token_uri" : "https://accounts.google.com/o/oauth2/token",
      "auth_provider_x509_cert_url" : "https://www.googleapis.com/oauth2/v1/certs",
      "client_x509_cert_url" : "https://www.googleapis.com/robot/v1/metadata/x509/xxxxxxxxxxxxxxxxxxx@developer.gserviceaccount.com",
      "javascript_origins" : [
         "https://mytest.joinc.co.kr"
      ]
   }
}
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
<?php
# 구글 sign in 페이지로 보내기 위한 uri다. 
# 구글에서 발급받은 애플리케이션 정보를 이용해서 만들면 된다. 
$uri="https://accounts.google.com/o/oauth2/auth?".
    "scope=email%20profile&".
    "state=%2Fprofile&".
    "redirect_uri=https%3A%2F%2Fmytest.joinc.co.kr%2Foauth2callback.php&".
    "response_type=code&".
    "client_id=xxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com&".
    "approval_prompt=force";
?>
<!-- 
mytest 회원 로그인을 위한 입력 인터페이스
유저 로그인 시스템을 구축하진 않을거다. 
그냥 인터페이스 테스트 목적이다. 
-->
<input type=text size=20 placeholder="ID"><br />
<input type=text size=20 placeholder="Password"><br />
<input type=submit value="회원 로그인">
<!-- 구글 로그인 사용자를 위한 google sign in 링크 -->
<a href="<?=$uri?>">구글로 로그인</a>
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
print_r($_GET);
# Array ( [state] => /profile [code] => 4/k-jIedafxxxxxxxxOg3gKr3.ea03emCooXBdaK_BAOPQDXXXXXX) 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# 유저는 콜백 URI를 호출하면서, 구글 서버로 부터 받은 authorization code를 GET으로 넘긴다. 
$code = $_GET['code'];
# Authorization code와 client id/secret를 이용해서 
# 토큰 발급 요청을 만든다. 
$postdata="code={$code}&". 
    "client_id={$client_id}&".
    "client_secret={$client_secret}&".
    "redirect_uri={$redirect_uri}&".
    "grant_type=authorization_code";
$opts = array('http' =>
    array(
        'method'  => 'POST',
        'header'  => 'Content-type: application/x-www-form-urlencoded',
        'content' => $postdata
    )
);
# Google oAuth endpoint로 요청한다.
$context  = stream_context_create($opts);
$response = file_get_contents('https://accounts.google.com/o/oauth2/token', false,$context);
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
  "access_token" : "ya29.XAxxxxxxxxxxxxxxxxxxxxxxxxxxLLJCMZUSU-XXXXXXXXXXXX",
  "token_type" : "Bearer",
  "expires_in" : 3600,
  "id_token" : "XXXXXXXXXXXXXX...."
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX




1
2
3
4
5
6
7
8
9
10
11
12
13
    [iss] => accounts.google.com
    [id] => 10070000000000000000
    [sub] => 100700000000000000000
    [azp] => 271xxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com
    [email] => yundream@gmail.com
    [at_hash] => Rxxxxxxxxxxxxxxxxxxxxx
    [email_verified] => 1
    [aud] => 271xxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com
    [token_hash] => Rxxxxxxxxxxxxxxxxxxx
    [verified_email] => 1
    [cid] => 2xxxxxxxxxxxxxxxx.apps.googleusercontent.com
    [iat] => 1400000000
    [exp] => 1400000000
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX