如何从平台证书切换成微信支付公钥

1// 可以根据实际情况使用publicKeyFromPath或publicKey加载公钥
2Config config =
3    new RSAPublicKeyConfig.Builder()
4        .merchantId("1900007291") //微信支付的商户号
5        .privateKeyFromPath("/Users/yourname/yourpath/apiclient_key.pem") // 商户API证书私钥的存放路径
6        .publicKeyFromPath("/Users/yourname/yourpath/pub_key.pem") //微信支付公钥的存放路径
7        .publicKeyId("PUB_KEY_ID_00000000000000000000000000000000") //微信支付公钥ID
8        .merchantSerialNumber("5157F09EFDC096DE15EBE81A47057A72********") //商户API证书序列号
9        .apiV3Key("F09E**") //APIv3密钥
10        .build();

1NotificationConfig config = new RSACombinedNotificationConfig.Builder()
2        .merchantId(merchantId)
3        .privateKeyFromPath(privateKeyPath)
4        .merchantSerialNumber(merchantSerialNumber)
5        .publicKeyFromPath(wechatpayPublicKeyPath)
6        .publicKeyId(wechatpayPublicKeyId)
7        .apiV3Key(apiV3Key)
8        .build();

1NotificationConfig config = new RSAPublicKeyNotificationConfig.Builder()
2        .publicKeyFromPath(publicKeyPath)
3        .publicKeyId(publicKeyId)
4        .apiV3Key(apiV3Key)
5        .build();

1// 微信支付公钥
2PublicKey wechatPayPublicKey = null; //微信支付公钥
3String plaintext = "";
4PrivacyEncryptor encryptor = new RSAPrivacyEncryptor(wechatPayPublicKey);
5String ciphertext = encryptor.encryptToString(plaintext);

1$platformCertificateContent = \file_get_contents('file:///path/to/wechatpay/certificate.pem');
2$platformPublicKeyInstance = Rsa::from($platformCertificateContent, Rsa::KEY_TYPE_PUBLIC);

1$platformPublicKeyFileFilePath = 'file:///path/to/wechatpay/publickey.pem';
2$platformPublicKeyInstance = Rsa::from($platformPublicKeyFileFilePath, Rsa::KEY_TYPE_PUBLIC);

1// 从本地文件中加载「微信支付平台证书」或者「微信支付平台公钥」，用来验证微信支付应答的签名
2 $platformCertificateOrPublicKeyFilePath = 'file:///path/to/wechatpay/certificate_or_publickey.pem';
3 $platformPublicKeyInstance = Rsa::from($platformCertificateOrPublicKeyFilePath, Rsa::KEY_TYPE_PUBLIC);
4
5// 「微信支付平台证书」的「证书序列号」或者是「微信支付平台公钥ID」
6// 「平台证书序列号」及/或「平台公钥ID」可以从 商户平台 -> 账户中心 -> API安全 直接查询到
7 $platformCertificateSerialOrPublicKeyId = 'PUB_KEY_ID_00000000000000000000000000000000';
8
9// 构造一个 APIv3 客户端实例
10$instance = Builder::factory([
11    'mchid'      => $merchantId,
12    'serial'     => $merchantCertificateSerial,
13    'privateKey' => $merchantPrivateKeyInstance,
14    'certs'      => [
15       $platformCertificateSerialOrPublicKeyId => $platformPublicKeyInstance,
16    ],
17]);

1// 预先已知的 平台证书序列号 => 平台证书实例 或者 平台公钥ID => 平台公钥实例 数据结构体
2$platformPublicKeyMap = [
3    '7132D72A03E93CDDF8C03BBD1F37EEDF********' => $platformCertificateInstance,
4    'PUB_KEY_ID_00000000000000000000000000000000' => $platformPublicKeyInstance,
5];
6
7// 从回调通知请求头上获取声明的 平台公钥实例标识
8$inWechatpaySerial = '';
9
10// 判断预先已知的 `$platformPublicKeyMap` 是否存在，不存在则按照开发文档响应非20x状态码及负载JSON
11if (!\array_key_exists($inWechatpaySerial, $platformPublicKeyMap) {
12    // 例如：以异常形式「中断」后续程序处理逻辑，交由上层统一做异常处理
13    throw new \UnexpectedValueException('未知的wechatpay-serial请求头');
14}
15
16// 加载平台公钥实例
17$platformPublicKeyInstance = Rsa::from($platformPublicKeyMap[$inWechatpaySerial], Rsa::KEY_TYPE_PUBLIC);
18// 其他逻辑按需处理
19// ...

1    'headers' => [
2       'Wechatpay-Serial' => $platformCertificateSerialOrPublicKeyId,
3    ],

1var (
2	wechatpayPublicKeyID       string = "PUB_KEY_ID_00000000000000000000000000000000"          // 微信支付公钥ID，注意微信支付公钥ID带有PUB_KEY_ID_前缀
3)
4
5wechatpayPublicKey, err = utils.LoadPublicKeyWithPath("/path/to/wechatpay/pub_key.pem")
6if err != nil {
7	panic(fmt.Errorf("load wechatpay public key err:%s", err.Error()))
8}
9    
10// 初始化 Client
11opts := []core.ClientOption{
12	option.WithWechatPayPublicKeyAuthCipher(
13		mchID, //商户号
14		mchCertificateSerialNumber, mchPrivateKey, 
15		wechatpayPublicKeyID, wechatpayPublicKey),
16}
17client, err := core.NewClient(ctx, opts...)
18
19// 初始化 notify.Handler
20handler := notify.NewNotifyHandler(
21	mchAPIv3Key, 
22	verifiers.NewSHA256WithRSAPubkeyVerifier(wechatpayPublicKeyID, *wechatPayPublicKey))

1// 初始化 notify.Handler
2handler := notify.NewNotifyHandler(
3	mchAPIv3Key,
4	verifiers.NewSHA256WithRSACombinedVerifier(certificateVisitor, wechatpayPublicKeyID, *wechatPayPublicKey))

1package utils
2
3// EncryptOAEPWithPublicKey 使用公钥加密
4func EncryptOAEPWithPublicKey(message string, publicKey *rsa.PublicKey) (ciphertext string, err error)
5// EncryptOAEPWithCertificate 使用证书中的公钥加密
6func EncryptOAEPWithCertificate(message string, certificate *x509.Certificate) (ciphertext string, err error)
7
8// DecryptOAEP 使用私钥解密
9func DecryptOAEP(ciphertext string, privateKey *rsa.PrivateKey) (message string, err error)

1curl -X GET \
2https://api.mch.weixin.qq.com/v3/xxx \
3-H "Authorization: WECHATPAY2-SHA256-RSA2048 mchid=\"1900000001\",..." \
4-H "Accept: application/json" \
5-H "Wechatpay-Serial: PUB_KEY_ID_00000000000000000000000000000000" // 需要增加Wechatpay-Serial请求头，且注意微信支付公钥ID带有PUB_KEY_ID_前缀

1Content-Type: application/json; charset=utf-8
2Cache-Control: no-cache, must-revalidate
3X-Content-Type-Options: nosniff
4Request-ID: 0880F1CAB9061075189FCBC055209CEXXXXXX
5Content-Language: zh-CN
6Wechatpay-Nonce: 7b236aa106a17544dc15642ddaaaaaaa
7Wechatpay-Signature: aaaa0D5n+3rQI4Rk0+n4r0j1Fl2QmirVCNkHxjMo2z+oXnQMgnSg4SrP/BV8+MD2mjmA7Pd3JHjQAyNxypgvyolAhABXYPV4tfmgcc1L2YkTM6ooadlm8uLnmyJZx1B45CMSndrWJ1fGViCNeWT5Mi/bAaxjFeTLwKZCHWz11Bp7e7HegvcDqEsw7eeHJdTAbB8cBDdYbW8MqIQvPAeRTvsLJZDkF4jFoKuPA8nzCHSUSpCo9YPVOEUawufs/ozDr5CZowCUiqImv9Ylu1Q0ywhX35qEWqRqJYZaRvb36CWhWuWsq/l1PMJcHQSzEZKGmX14yjeilyG2rihb9aaaa==
8Wechatpay-Timestamp: 1731377280
9Wechatpay-Serial: PUB_KEY_ID_00000000000000000000000000000000 //微信支付的应答也会带上，Wechatpay-Serial请求头，且注意微信支付公钥ID带有PUB_KEY_ID_前缀
10Wechatpay-Signature-Type: WECHATPAY2-SHA256-RSA2048

1Content-Type: application/json
2Wechatpay-Nonce: gWTNBVLvZys67ruVWtY8F4cA20rplzA0
3Wechatpay-Timestamp: 1731465272 
4Wechatpay-Serial: 4DF076AC5A7D968D4A8B0B9C599A74CB4CF8EE8A  //平台证书ID
5Wechatpay-Signature: K8aa5KTKSWHYbhLMtUpRJIC2g+9YnCGmEeeGOgz7bQQGFhh7skof/Yi6Vr6OAApoEdipRZ9kIrZ61Ur5mXcRyWyXGiKdk/WXe7muBLSKAJcUHE4i1cV3K0UVXeOsIF3d/k+wCUkpUjHmyyX1wGUFNGFqHhooQj1EZXagGrkpsTUbMK1d9vPrVSFz0i89GEgTYkyuxxLfylfvZL85zUxZOa/4sus72DaGhf04yrFI5R9tFJ75p7p2FPKZuYbGdaehT9R7mrNePW/NYV6I/dzIuHs3ERYWB86LjaK2k0ER3KZKkGeGYXnAMeX/rN/LUZ+fZa1kA7hgoM8cR1pLohdiCg==
6Wechatpay-Signature-Type: WECHATPAY2-SHA256-RSA2048

1Content-Type: application/json
2Wechatpay-Nonce: gWTNBVLvZys67ruVWtY8F4cA20rplzA0
3Wechatpay-Timestamp: 1731465272 
4Wechatpay-Serial: PUB_KEY_ID_0115635139512024101100397200000006  //微信支付的应答也会带上，Wechatpay-Serial请求头，且注意微信支付公钥ID带有PUB_KEY_ID_前缀
5Wechatpay-Signature: K8aa5KTKSWHYbhLMtUpRJIC2g+9YnCGmEeeGOgz7bQQGFhh7skof/Yi6Vr6OAApoEdipRZ9kIrZ61Ur5mXcRyWyXGiKdk/WXe7muBLSKAJcUHE4i1cV3K0UVXeOsIF3d/k+wCUkpUjHmyyX1wGUFNGFqHhooQj1EZXagGrkpsTUbMK1d9vPrVSFz0i89GEgTYkyuxxLfylfvZL85zUxZOa/4sus72DaGhf04yrFI5R9tFJ75p7p2FPKZuYbGdaehT9R7mrNePW/NYV6I/dzIuHs3ERYWB86LjaK2k0ER3KZKkGeGYXnAMeX/rN/LUZ+fZa1kA7hgoM8cR1pLohdiCg==
6Wechatpay-Signature-Type: WECHATPAY2-SHA256-RSA2048

1curl -X GET \
2https://api.mch.weixin.qq.com/v3/xxx \
3-H "Authorization: WECHATPAY2-SHA256-RSA2048 mchid=\"1900000001\",..." \
4-H "Accept: application/json" \
5-H "Wechatpay-Serial: PUB_KEY_ID_00000000000000000000000000000000" // 需要增加Wechatpay-Serial请求头，且注意微信支付公钥ID带有PUB_KEY_ID_前缀