Skip to content

Fix WeChat Pay V3 public key transfer signature verification failure #3731

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft

Copilot wants to merge 2 commits into develop

from copilot/fix-4b01bcaa-a8cf-4c15-9292-4fcacd0d4c0a

Draft

Fix WeChat Pay V3 public key transfer signature verification failure #3731

Changes from all commits

Commits

Show all changes

Select commit Hold shift + click to select a range

Copilot Oct 3, 2025

Fix WeChat Pay V3 public key transfer signature verification failure

Copilot Oct 3, 2025

File filter

Filter by extension

Conversations

Jump to

Jump to file

Failed to load files.

Loading

Diff view

Diff view

10 changes: 9 additions & 1 deletion ...java-pay/src/main/java/com/github/binarywang/wxpay/v3/auth/PublicCertificateVerifier.java

Show comments View file Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -24,9 +24,17 @@ public void setOtherVerifier(Verifier verifier) {

		@Override
		public boolean verify(String serialNumber, byte[] message, String signature) {
	// 如果序列号不包含"PUB_KEY_ID"且有证书验证器,先尝试证书验证
		if (!serialNumber.contains("PUB_KEY_ID") && this.certificateVerifier != null) {
	return this.certificateVerifier.verify(serialNumber, message, signature);
	try {
	if (this.certificateVerifier.verify(serialNumber, message, signature)) {
	return true;
	}
	} catch (Exception e) {
	// 证书验证失败,继续尝试公钥验证
	}
		}
	// 使用公钥验证(兜底方案,适用于公钥转账等场景)
		try {
		Signature sign = Signature.getInstance("SHA256withRSA");
		sign.initVerify(publicKey);
Expand Down