{"record":{"id":"d77c539ef754360f","repo":"JeffreySu/WeiXinMPSDK","slug":"rsa-sha256withrsaverifier","errorCode":null,"errorMessage":"证书中未包含 RSA 公钥。","messagePattern":"证书中未包含 RSA 公钥。","errorType":"exception","errorClass":"CryptographicException","httpStatus":null,"severity":"error","filePath":"src/Senparc.Weixin.TenPay/Senparc.Weixin.TenPayV3/TenPayHttpClient/Verifier/SHA256WithRSAVerifier.cs","lineNumber":70,"sourceCode":"                    //对比签名\n                    byte[] compareByte = sha256.ComputeHash(Encoding.UTF8.GetBytes(contentForSign));\n                    //验证签名\n                    return df.VerifySignature(compareByte, signature);\n                }\n            }\n            else\n            {\n\n                //Base64 解码 pubKey（必须已经使用 ApiSecurityHelper.GetUnwrapCertKey() 方法进行 Unwrap）\n                var bs = Convert.FromBase64String(pubKey);\n                //使用 X509Certificate2 证书\n                using (var x509 = new X509Certificate2(bs))\n                using (var key = x509.GetRSAPublicKey())\n                using (var sha256 = SHA256.Create())\n                {\n                    if (key == null)\n                    {\n                        throw new CryptographicException(\"证书中未包含 RSA 公钥。\");\n                    }\n\n                    //RSAPKCS1SignatureDeformatter 对象\n                    RSAPKCS1SignatureDeformatter df = new RSAPKCS1SignatureDeformatter(key);\n                    //指定 SHA256\n                    df.SetHashAlgorithm(\"SHA256\");\n                    //应答签名\n                    byte[] signature = Convert.FromBase64String(wechatpaySignatureBase64);\n                    //对比签名\n                    byte[] compareByte = sha256.ComputeHash(Encoding.UTF8.GetBytes(contentForSign));\n                    //验证签名\n                    return df.VerifySignature(compareByte, signature);\n                }\n            }\n        }\n    }\n}\n","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/JeffreySu/WeiXinMPSDK/blob/be573f6f94bdbf718dd5f6cdecb137fbc7ff651e/src/Senparc.Weixin.TenPay/Senparc.Weixin.TenPayV3/TenPayHttpClient/Verifier/SHA256WithRSAVerifier.cs#L52-L88","documentation":"SHA256WithRSAVerifier.Verify loads the platform certificate bytes into an X509Certificate2 and calls GetRSAPublicKey(); if the certificate does not contain an RSA public key (e.g. it is an SM2/国密 certificate), a CryptographicException '证书中未包含 RSA 公钥。' is thrown instead of proceeding with RSA signature verification.","triggerScenarios":"Verifying a WeChat Pay response signature with an RSA verifier while the supplied certificate/public key material is an SM2 (国密) certificate, or the certificate blob is otherwise not RSA-capable.","commonSituations":"Merchant enrolled in the 国密 pilot but the code path still uses CertType.RSA / SHA256WithRSAVerifier; downloading platform certificates from the SM endpoint; passing the wrong certificate file to the verifier.","solutions":["Set EncryptionType to CertType.SM so TenPayCertFactory wires SM3WithSM2Verifier for 国密 certificates.","Verify you downloaded the standard RSA platform certificate if you intend to use RSA mode.","Check that the certificate bytes passed to Verify belong to the certificate matching the Wechatpay-Serial header."],"exampleFix":"// before\n EncryptionType = CertType.RSA // but cert is SM2\n// after\n EncryptionType = CertType.SM // uses SM3WithSM2Verifier","handlingStrategy":"validation","validationCode":"using var x509 = new X509Certificate2(certBytes);\nif (x509.GetRSAPublicKey() == null)\n    throw new InvalidOperationException(\"Certificate is not RSA; configure EncryptionType = SM instead.\");","typeGuard":"bool IsRsaCertificate(X509Certificate2 c) => c.GetRSAPublicKey() != null;","tryCatchPattern":"try { var ok = verifier.Verify(ts, nonce, sig, content, cert, enablePubKey); }\ncatch (CryptographicException ex) { logger.LogError(ex, \"Certificate lacks RSA public key — check CertType\"); }","preventionTips":["Match CertType to the certificate family actually issued by WeChat Pay (RSA vs SM2).","Inspect downloaded platform certificates (thumbprint/key algorithm) before wiring them into the verifier."],"tags":["certificate","rsa","signature-verification","wechat-pay"],"backgroundTag":"incompatible-source-type","analyzedSha":"be573f6f94bdbf718dd5f6cdecb137fbc7ff651e","analyzedAt":"2026-09-12T10:01:50.733Z","contentChangedAt":"2026-09-12T10:01:50.733Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}