JeffreySu/WeiXinMPSDK · critical · TenpayApiRequestException

未获取到用于加密分账接收方姓名的微信支付公钥或平台证书。

Error message

未获取到用于加密分账接收方姓名的微信支付公钥或平台证书。

What it means

Before serializing receivers, CreateSensitiveRequestAsync must encrypt receiver names with WeChat Pay's public key or platform certificate. When the resolved publicKey key/value is null or whitespace — i.e. no public key or platform certificate is available from configuration — TenpayApiRequestException is thrown.

Solutions

1. Configure the WeChat Pay public key (public key ID + key content) in TenpayV3Setting, or ensure the platform certificate is downloaded and available.
2. Verify certificate files exist on disk and are readable by the app process.
3. Re-trigger certificate/platform-cert refresh after key rotation, then retry the request.

Example fix

// before
var setting = new TenpayV3SenparcWeixinSetting { AppId = appId, MchId = mchId, Secret = secret }; // no key material
// after
var setting = new TenpayV3SenparcWeixinSetting {
    AppId = appId, MchId = mchId, Secret = secret,
    TenPayV3_PublicKey = pubKeyValue, TenPayV3_PublicKeyId = pubKeyId
};

var setting = Config.SenparcWeixinSetting.TenpayV3Setting;
bool keyReady = !string.IsNullOrWhiteSpace(setting.TenPayV3_PublicKey) || File.Exists(certPath);
if (!keyReady) throw new InvalidOperationException("No WeChat Pay public key or platform certificate configured.");

try { await apis.AddReceiverAsync(data); }
catch (TenpayApiRequestException ex) when (ex.Message.Contains("公钥或平台证书"))
{ await certificateManager.RefreshAsync(); await apis.AddReceiverAsync(data); }

When it happens

Trigger: Calling AddReceiverAsync/CreateOrderAsync (which route through CreateSensitiveRequestAsync) when the TenpayV3Setting lacks WechatPayPublicKey or platform certificate configuration, or certificate download/refresh failed so the certificate store is empty.

Common situations: New WeChat merchants configured with public-key mode but the public key ID/value not filled in; certificate files not deployed to the server; SDK not refreshed certificates after rotation; switching between public-key and platform-certificate modes without updating config.

Related errors

• 没有设置证书加密类型（EncryptionType）
• 没有设置证书加密类型（EncryptionType）
• 接收方类型为 MERCHANT_ID 时，name 必填。
• 未获取到用于加密收款用户姓名的微信支付公钥或平台证书。
• 当 为 时， 必填！

AI-assisted analysis of JeffreySu/WeiXinMPSDK@be573f6f94 (2026-09-12). Data as JSON: /api/errors/deb90914fcbc23a7. Report an issue: GitHub.

Appendix: source

Thrown at src/Senparc.Weixin.TenPay/Senparc.Weixin.TenPayV3/Apis/ChainBrandProfitsharing/ChainBrandProfitsharingApis.cs:342

                .Where(target => target != null)
                .ToArray() ?? Array.Empty<object>();
            if (targetList.Length == 0)
            {
                return new TenPayApiRequest(_setting);
            }

            var publicKey = GetConfiguredPaymentPublicKey();
            if (string.IsNullOrWhiteSpace(publicKey.Key))
            {
                var publicKeys = await new BasePayApis(_setting)
                    .GetPublicKeysAsync().ConfigureAwait(false);
                publicKey = SelectPublicKey(publicKeys);
            }

            if (string.IsNullOrWhiteSpace(publicKey.Key) ||
                string.IsNullOrWhiteSpace(publicKey.Value))
            {
                throw new TenpayApiRequestException(
                    "未获取到用于加密分账接收方姓名的微信支付公钥或平台证书。");
            }

            foreach (var target in targetList)
            {
                SecurityHelper.FieldEncrypt(target, publicKey.Value,
                    _setting.EncryptionType.Value,
                    _setting.TenPayV3_TenPayPubKeyEnable);
            }

            return new TenPayApiRequest(_setting, httpClient =>
            {
                httpClient.DefaultRequestHeaders.Add("Wechatpay-Serial",
                    publicKey.Key);
            });
        }

        private KeyValuePair<string, string>

View on GitHub (pinned to be573f6f94)