JeffreySu/WeiXinMPSDK · error · TenpayApiRequestException

未获取到用于安全探测的微信支付公钥或平台证书。

Error message

未获取到用于安全探测的微信支付公钥或平台证书。

What it means

CreateSecurityRequestAsync in SecurityEchoApis encrypts sensitive fields before the WeChat Pay security/echo API call. It needs a WeChat Pay public key or platform certificate for field encryption; when none is resolvable (SelectPaymentPublicKey returns empty / no keys), it throws TenpayApiRequestException.

Solutions

1. Configure TenPayV3_TenPayPubKey (the WeChat Pay public key from the merchant platform) in TenPayV3Setting.
2. Ensure platform certificates are downloaded/refreshed so GetPublicKeysAsync returns at least one key.
3. Check Weixin's certificate/auto-update mode and network access to WeChat Pay certificate endpoint.

Example fix

// before
var setting = new TenPayV3Setting(appId, mchId, subMchId, tenPayV3_Key, certPath, certPassword);
// after
var setting = new TenPayV3Setting(appId, mchId, subMchId, tenPayV3_Key, certPath, certPassword,
    tenPayV3_TenPayPubKey: "PUB_KEY_ID_xxx|<public key content>");

var hasKey = !string.IsNullOrWhiteSpace(setting.TenPayV3_TenPayPubKey);
// or confirm GetPublicKeysAsync returns at least one key before calling sensitive APIs

try { await securityApis.CreateSecurityRequestAsync(...); }
catch (TenpayApiRequestException ex) when (ex.Message.Contains("公钥"))
{ logger.Error(ex, "未配置微信支付公钥/平台证书"); }

When it happens

Trigger: Calling security echo/sensitive-info encryption APIs (request) when _tenpayV3Setting has no usable public key: TenPayV3_TenPayPubKey not configured and no platform certificate is available via GetPublicKeysAsync.

Common situations: New merchants using public-key mode who haven't downloaded the WeChat Pay public key, or merchants whose platform certificate expired/was never fetched, so the key dictionary is empty.

Related errors

• WeixinPayInfoCollection尚未注册Partner：
• TenPayV3InfoCollection尚未注册Mch：
• 未获取到用于加密分账接收方姓名的微信支付公钥或平台证书。
• 没有设置证书加密类型（EncryptionType）
• 没有设置证书加密类型（EncryptionType）

AI-assisted analysis of JeffreySu/WeiXinMPSDK@be573f6f94 (2026-09-12). Data as JSON: /api/errors/a4386f99460a9282. Report an issue: GitHub.

Appendix: source

Thrown at src/Senparc.Weixin.TenPay/Senparc.Weixin.TenPayV3/Apis/Security/SecurityEchoApis.cs:72

                $"{Senparc.Weixin.Config.TenPayV3Host}/{{0}}v3/security/echo");
            return await request.RequestAsync<SecurityEchoReturnJson>(url, data, timeOut)
                .ConfigureAwait(false);
        }

        private async Task<TenPayApiRequest> CreateSecurityRequestAsync(object target)
        {
            var publicKey = GetConfiguredPaymentPublicKey();
            if (string.IsNullOrWhiteSpace(publicKey.Key))
            {
                var publicKeys = await new BasePayApis(_setting)
                    .GetPublicKeysAsync().ConfigureAwait(false);
                publicKey = SelectPaymentPublicKey(publicKeys);
            }

            if (string.IsNullOrWhiteSpace(publicKey.Key) ||
                string.IsNullOrWhiteSpace(publicKey.Value))
            {
                throw new TenpayApiRequestException(
                    "未获取到用于安全探测的微信支付公钥或平台证书。");
            }

            SecurityHelper.FieldEncrypt(target, publicKey.Value,
                _setting.EncryptionType.Value,
                _setting.TenPayV3_TenPayPubKeyEnable);
            return new TenPayApiRequest(_setting, httpClient =>
                httpClient.DefaultRequestHeaders.Add("Wechatpay-Serial", publicKey.Key));
        }

        private KeyValuePair<string, string> GetConfiguredPaymentPublicKey()
        {
            if (!_setting.TenPayV3_TenPayPubKeyEnable)
            {
                return default;
            }

            return new KeyValuePair<string, string>(

View on GitHub (pinned to be573f6f94)