JeffreySu/WeiXinMPSDK · error · CryptographicException

证书中未包含 RSA 公钥。

Error message

证书中未包含 RSA 公钥。

What it means

SecurityHelper.Encrypt encrypts text with the RSA public key taken from the supplied certificate (publicKey string). If the X509Certificate2 built from it has no RSA public key (GetRSAPublicKey() returns null, e.g. it's an EC/SM2 cert), CryptographicException "证书中未包含 RSA 公钥。" is thrown.

Solutions

1. Pass the base64 platform certificate content that contains an RSA public key (GetRSAPublicKey() != null).
2. If using public-key mode, ensure the helper/API variant supports the WeChat public key format instead of an X509 cert.
3. Verify the cert: new X509Certificate2(bytes).GetRSAPublicKey() != null before calling Encrypt.

Example fix

// before
var encrypted = SecurityHelper.Encrypt(sm2PublicKeyPem, "13800138000");
// after
var encrypted = SecurityHelper.Encrypt(Convert.ToBase64String(rsaCertBytes), "13800138000"); // RSA platform certificate

bool HasRsaPublicKey(string certBase64) {
    using var x509 = new X509Certificate2(Convert.FromBase64String(certBase64));
    return x509.GetRSAPublicKey() != null;
}

try { var s = SecurityHelper.Encrypt(publicKey, text); }
catch (CryptographicException ex) { logger.Error(ex, "证书无 RSA 公钥"); }

When it happens

Trigger: Calling Encrypt (e.g. for WeChat Pay field encryption) with a publicKey string containing a certificate whose key algorithm is not RSA (EC/SM2), or an invalid/empty certificate blob that parses without an RSA key.

Common situations: WeChat Pay migrated from platform certificates (RSA) to public-key mode; developers pass an SM2 public key or public-key ID string where a base64 X509 RSA certificate is expected.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• 证书中未包含 RSA 公钥。
• 证书中未包含 RSA 公钥。
• WeixinPayInfoCollection尚未注册Partner：
• TenPayV3InfoCollection尚未注册Mch：
• 没有设置证书加密类型（EncryptionType）

AI-assisted analysis of JeffreySu/WeiXinMPSDK@be573f6f94 (2026-09-12). Data as JSON: /api/errors/3e9735fd91432a5a. Report an issue: GitHub.

Appendix: source

Thrown at src/Senparc.Weixin.TenPay/Senparc.Weixin.TenPayV3/Helpers/SecurityHelper.cs:156

                    var buff = rsa.Encrypt(Encoding.UTF8.GetBytes(text), RSAEncryptionPadding.OaepSHA1);
                    return Convert.ToBase64String(buff);
                }
            }
            #endregion

            if (encryptionType == CertType.SM)
            {
                ECPublicKeyParameters eCPublicKeyParameters = SMPemHelper.LoadPublicKeyToParameters(Encoding.UTF8.GetBytes(publicKey));
                return GmHelper.Sm2Encrypt(eCPublicKeyParameters, text);
            }
            else
            {
                using (var x509 = new X509Certificate2(Encoding.UTF8.GetBytes(publicKey)))
                using (var rsa = x509.GetRSAPublicKey())
                {
                    if (rsa == null)
                    {
                        throw new CryptographicException("证书中未包含 RSA 公钥。");
                    }

                    var buff = rsa.Encrypt(Encoding.UTF8.GetBytes(text), RSAEncryptionPadding.OaepSHA1);
                    return Convert.ToBase64String(buff);
                }
            }
        }

        /// <summary>
        /// 字段加密
        /// </summary>
        /// <param name="request"></param>
        /// <param name="publicKey"></param>
        /// <param name="encryptionType"></param>
        /// <param name="isWeixinPubKey">是否是微信支付公钥</param>
        public static void FieldEncrypt(object request, string publicKey, CertType encryptionType, bool isWeixinPubKey = false)
        {
            if (request == null)

View on GitHub (pinned to be573f6f94)