binarywang/WxJava · error · WxErrorException

请配置会话存档解密方式

Error message

请配置会话存档解密方式

What it means

Thrown as WxErrorException when the pkcs1 parameter (decryption method selector) is null in WxCpCryptUtil.decryptPriKey(). This parameter must be 1 (PKCS1) or 2 (PKCS8) to select the RSA decryption mode for chat session archive (会话存档). A null value means the decryption mode was never configured.

Source

Thrown at weixin-java-cp/src/main/java/me/chanjar/weixin/cp/util/crypto/WxCpCryptUtil.java:55

    String corpId = wxCpConfigStorage.getCorpId();

    this.token = token;
    this.appidOrCorpid = corpId;
    this.aesKey = Base64.getDecoder().decode(StringUtils.remove(encodingAesKey, " "));
  }

  /**
   * 判断使用PKCS8或者PKCS1进行解密
   *
   * @param encryptRandomKey 使用PUBLICKEY_VER指定版本的公钥进行非对称加密后base64加密的内容
   * @param msgAuditPriKey   会话存档私钥
   * @param pkcs1            使用什么方式进行解密，1代表使用PKCS1进行解密，2代表PKCS8进行解密 ...
   * @return string
   * @throws Exception the exception
   */
  public static String decryptPriKey(String encryptRandomKey, String msgAuditPriKey, Integer pkcs1) throws Exception {
    if (Objects.isNull(pkcs1)) {
      throw new WxErrorException("请配置会话存档解密方式");
    }

    if (Objects.equals(pkcs1, 1)) {
      return decryptPriKeyByPKCS1(encryptRandomKey, msgAuditPriKey);
    }

    return decryptPriKeyByPKCS8(encryptRandomKey, msgAuditPriKey);
  }

  /**
   * PKCS8 解密私钥
   *
   * @param encryptRandomKey the encrypt random key
   * @param msgAuditPriKey   the msg audit pri key
   * @return string
   * @throws Exception the exception
   */
  public static String decryptPriKeyByPKCS8(String encryptRandomKey, String msgAuditPriKey) throws Exception {

View on GitHub (pinned to 1c43293a3c)

Solutions

1. Pass pkcs1 = 1 for PKCS1 keys or pkcs1 = 2 for PKCS8 keys
2. Configure the chat archive decryption mode in your application config and pass it through to decryptPriKey
3. Verify that the pkcs1 value is sourced from a non-null configuration property

Example fix

// before
String key = WxCpCryptUtil.decryptPriKey(encryptRandomKey, priKey, null);

// after
String key = WxCpCryptUtil.decryptPriKey(encryptRandomKey, priKey, 2); // PKCS8

// Validate pkcs1 before calling decryptPriKey
if (pkcs1 == null || (pkcs1 != 1 && pkcs1 != 2)) {
  throw new IllegalArgumentException("pkcs1 must be 1 (PKCS1) or 2 (PKCS8)");
}
WxCpCryptUtil.decryptPriKey(encryptRandomKey, msgAuditPriKey, pkcs1);

private static boolean isValidPkcsMode(Integer pkcs1) {
  return pkcs1 != null && (pkcs1 == 1 || pkcs1 == 2);
}

try {
  WxCpCryptUtil.decryptPriKey(encryptRandomKey, msgAuditPriKey, pkcs1);
} catch (WxErrorException e) {
  if (e.getMessage().contains("解密方式")) {
    log.error("Chat archive decryption mode not configured; set pkcs1 to 1 or 2");
  }
  throw e;
}

When it happens

Trigger: Calling WxCpCryptUtil.decryptPriKey(encryptRandomKey, msgAuditPriKey, null) without specifying the decryption method.

Common situations: Chat archive feature newly enabled without completing decryption config; version upgrade where the pkcs1 parameter was added but existing caller code was not updated; missing msgAuditDecryptMode setting in application configuration.

Related errors

• uri参数中不允许有suite_access_token: {}
• 解析AES KEY失败，请检查ApiSignatureAesKey是否正确
• 解析RSA KEY失败，请检查ApiSignatureRsaPrivateKey是否正确，需要PKCS8格式私钥
• HmacSHA256 signature failed
• AES CBC encrypt failed

AI-assisted analysis of binarywang/WxJava@1c43293a3c (2026-08-14). Data as JSON: /api/errors/deddd11393c91921. Report an issue: GitHub.