iflytek/astron-agent · error · AesException

-40003

-40003

Error message

SHA encryption signature generation failed

What it means

getSHA1 builds the WeChat callback signature by SHA-1 hashing the sorted concatenation of token, timestamp, nonce and encrypt content. If any exception occurs during message-digest computation or hex conversion it throws AesException -40003 (ComputeSignatureError) after printing the stack trace.

Solutions

  1. Validate that token, timeStamp, nonce and encrypt are non-null, non-empty strings before calling getSHA1.
  2. Check the JDK/JCE provider supports SHA-1 (virtually all do) and that no custom Security provider removes it.
  3. Read the printed stack trace (e.printStackTrace) to identify the exact underlying exception.
  4. Replace printStackTrace with proper logging and rethrow context in production.

Example fix

// before
wxCrypt.getSHA1(token, timestamp, nonce, encrypt); // timestamp may be null
// after
if (token == null || timestamp == null || nonce == null || encrypt == null) {
    throw new IllegalArgumentException("signature inputs required");
}
wxCrypt.getSHA1(token, timestamp, nonce, encrypt);
Defensive patterns

Strategy: validation

Validate before calling

boolean ok = token != null && timestamp != null && nonce != null && encrypt != null;
if (!ok) throw new IllegalArgumentException("all four signature inputs are required");

Try / catch

try { return crypto.getSHA1(token, ts, nonce, enc); } catch (AesException e) { if (e.getCode() == -40003) { log.error("SHA-1 computation failed", e); throw new IllegalStateException("signature computation unavailable", e); } throw e; }

Prevention

When it happens

Trigger: Calling getSHA1 (directly or via verifyUrl/decryptMsg/signature) when MessageDigest.getInstance("SHA-1") fails, a digest/update/digest call throws, or an input is null causing an unexpected exception inside the try block.

Common situations: Null token/timestamp/nonce/encrypt arguments reaching the method (e.g. missing query parameters bound as null); a JCE provider problem or restricted JDK environment lacking SHA-1; corrupted build/deployment of the crypto utility.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/8ee8c906b15329ad. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java:297

            String str = sb.toString();
            // SHA1 signature generation
            MessageDigest md = MessageDigest.getInstance("SHA-1");
            md.update(str.getBytes(CHARSET));
            byte[] digest = md.digest();

            StringBuilder hexstr = new StringBuilder();
            String shaHex = "";
            for (int i = 0; i < digest.length; i++) {
                shaHex = Integer.toHexString(digest[i] & 0xFF);
                if (shaHex.length() < 2) {
                    hexstr.append(0);
                }
                hexstr.append(shaHex);
            }
            return hexstr.toString();
        } catch (Exception e) {
            e.printStackTrace();
            throw new AesException(AesException.ComputeSignatureError);
        }
    }

    /**
     * Byte group utility class
     */
    static class ByteGroup {
        java.util.ArrayList<Byte> byteContainer = new java.util.ArrayList<Byte>();

        public byte[] toBytes() {
            byte[] bytes = new byte[byteContainer.size()];
            for (int i = 0; i < byteContainer.size(); i++) {
                bytes[i] = byteContainer.get(i);
            }
            return bytes;
        }

        public void addBytes(byte[] bytes) {

View on GitHub (pinned to 5e758547a8)