binarywang/WxJava · error · WxErrorException

请配置会话存档私钥【msgAuditPriKey】

Error message

请配置会话存档私钥【msgAuditPriKey】

What it means

Thrown as WxErrorException (checked) in decryptChatData() when configStorage.getMsgAuditPriKey() returns null or empty. The msgAuditPriKey is the RSA private key that the enterprise generated for decrypting conversation archive data. WeCom encrypts the encrypt_random_key with the enterprise's public key; the private key is required to decrypt it before passing the result to Finance.DecryptData.

Source

Thrown at weixin-java-cp/src/main/java/me/chanjar/weixin/cp/api/impl/WxCpMsgAuditServiceImpl.java:200

    String plainText = this.decryptChatData(sdk, chatData, pkcs1);
    return WxCpChatModel.fromJson(plainText);
  }

  /**
   * Decrypt chat data string.
   *
   * @param sdk      the sdk
   * @param chatData the chat data
   * @param pkcs1    the pkcs 1
   * @return the string
   * @throws Exception the exception
   */
  public String decryptChatData(long sdk, WxCpChatDatas.WxCpChatData chatData, Integer pkcs1) throws Exception {
    // 企业获取的会话内容，使用企业自行配置的消息加密公钥进行加密，企业可用自行保存的私钥解开会话内容数据。
    // msgAuditPriKey 会话存档私钥不能为空
    String priKey = cpService.getWxCpConfigStorage().getMsgAuditPriKey();
    if (StringUtils.isEmpty(priKey)) {
      throw new WxErrorException("请配置会话存档私钥【msgAuditPriKey】");
    }

    String decryptByPriKey = WxCpCryptUtil.decryptPriKey(chatData.getEncryptRandomKey(), priKey, pkcs1);
    // 每次使用DecryptData解密会话存档前需要调用NewSlice获取一个slice，在使用完slice中数据后，还需要调用FreeSlice释放。
    long msg = Finance.NewSlice();

    // 解密会话存档内容
    // sdk不会要求用户传入rsa私钥，保证用户会话存档数据只有自己能够解密。
    // 此处需要用户先用rsa私钥解密encrypt_random_key后，作为encrypt_key参数传入sdk来解密encrypt_chat_msg获取会话存档明文。
    int ret = Finance.DecryptData(sdk, decryptByPriKey, chatData.getEncryptChatMsg(), msg);
    if (ret != 0) {
      Finance.FreeSlice(msg);
      throw new WxErrorException("msg err ret " + ret);
    }

    // 明文
    String plainText = Finance.GetContentFromSlice(msg);
    Finance.FreeSlice(msg);

View on GitHub (pinned to 1c43293a3c)

Solutions

1. Generate an RSA key pair, upload the public key to WeCom admin (会话内容存档 settings), and set the private key: config.setMsgAuditPriKey("-----BEGIN RSA PRIVATE KEY-----\n...").
2. Ensure you are setting the private key (not the public key) in msgAuditPriKey.
3. Store the private key securely (e.g., in a vault or environment variable) and load it at startup.

Example fix

// before
WxCpDefaultConfigImpl config = new WxCpDefaultConfigImpl();
config.setCorpId("corpId");
config.setMsgAuditSecret("audit_secret");
config.setMsgAuditLibPath("/opt/wecom/finance/libWeWorkFinanceSdk_Java.so");
// msgAuditPriKey not set
cpService.getMsgAuditService().getDecryptData(sdk, chatData, 1); // throws

// after
config.setMsgAuditPriKey(privateKeyPem); // your RSA private key PEM string
cpService.getMsgAuditService().getDecryptData(sdk, chatData, 1);

String priKey = cpService.getWxCpConfigStorage().getMsgAuditPriKey();
if (StringUtils.isEmpty(priKey)) {
    throw new IllegalStateException("msgAuditPriKey is not configured; generate an RSA key pair and set the private key");
}

When it happens

Trigger: Calling cpService.getMsgAuditService().decryptChatData(sdk, chatData, pkcs1) or getDecryptData() without having set msgAuditPriKey on the config storage. This fires before any decryption attempt.

Common situations: Developer configures the Finance SDK library path and secret but forgets to generate and configure the RSA key pair for conversation archive decryption. Or they set the public key instead of the private key.

Related errors

• 请配置会话存档sdk文件的路径，不要配错了！！
• getchatdata err ret {}
• 请仔细配置会话存档文件路径！！
• init sdk err ret {}
• 请先设置WebhookKey

AI-assisted analysis of binarywang/WxJava@1c43293a3c (2026-08-14). Data as JSON: /api/errors/50bb47fa0ae35c6d. Report an issue: GitHub.