chenhg5/cc-connect · error

EncodingAESKey must be 43 characters, got %d

Error message

EncodingAESKey must be 43 characters, got %d

What it means

Configuration guard in decodeAESKey, called from New: the WeCom EncodingAESKey from config.toml is not exactly 43 characters. WeCom issues these keys as 43-char Base64 (without padding) that decodes, with one appended '=', to the 32-byte AES key; any other length cannot be a valid key and startup is aborted.

Source

Thrown at platform/wecom/wecom.go:740

	return nil
}

// --- Crypto helpers ---

// verifySignature checks SHA1(sort(token, timestamp, nonce, encrypt)).
func (p *Platform) verifySignature(expected, timestamp, nonce, encrypt string) bool {
	parts := []string{p.token, timestamp, nonce, encrypt}
	sort.Strings(parts)
	h := sha1.New()
	h.Write([]byte(strings.Join(parts, "")))
	got := fmt.Sprintf("%x", h.Sum(nil))
	return got == expected
}

// decodeAESKey converts the 43-char Base64 EncodingAESKey to 32 bytes.
func decodeAESKey(encodingAESKey string) ([]byte, error) {
	if len(encodingAESKey) != 43 {
		return nil, fmt.Errorf("EncodingAESKey must be 43 characters, got %d", len(encodingAESKey))
	}
	return base64.StdEncoding.DecodeString(encodingAESKey + "=")
}

// decrypt decodes and decrypts a Base64-encoded AES-256-CBC ciphertext.
// Layout after decryption + PKCS#7 unpad:
//
//	[16 bytes random] [4 bytes msg_len (big-endian)] [msg_len bytes message] [corp_id]
func (p *Platform) decrypt(cipherBase64 string) (string, error) {
	cipherData, err := base64.StdEncoding.DecodeString(cipherBase64)
	if err != nil {
		return "", fmt.Errorf("base64 decode: %w", err)
	}

	block, err := aes.NewCipher(p.aesKey)
	if err != nil {
		return "", fmt.Errorf("aes new cipher: %w", err)
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Copy the EncodingAESKey exactly from the WeCom admin console — no trailing '=' or whitespace
2. Trim stray whitespace/newlines from the config value before validating
3. If the key was regenerated in the console, update config.toml with the new 43-char value
4. Fail fast at startup (as the code does) so misconfiguration is caught before serving

When it happens

Trigger: Thrown at platform/wecom/wecom.go:740 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/709a36a4eb898b47. Report an issue: GitHub.