🎨 【微信支付】服务商模式-支持公钥以及灰度切换

binarywang · binarywang · Mar 17, 2025 · Feb 17, 2025 · Feb 20, 2025 · Feb 28, 2025
commit 2e1b55391e9b82e3064e9832853da87dd7e7ff85
diff --git a/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/config/WxPayConfig.java b/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/config/WxPayConfig.java
@@ -320,16 +320,7 @@ public CloseableHttpClient initApiV3HttpClient() throws WxPayException {
       //构造Http Proxy正向代理
       WxPayHttpProxy wxPayHttpProxy = getWxPayHttpProxy();
 
-      Verifier certificatesVerifier;
-      if (publicKey == null) {
-        certificatesVerifier =
-          new AutoUpdateCertificatesVerifier(
-            new WxPayCredentials(mchId, new PrivateKeySigner(certSerialNo, merchantPrivateKey)),
-            this.getApiV3Key().getBytes(StandardCharsets.UTF_8), this.getCertAutoUpdateTime(),
-            this.getPayBaseUrl(), wxPayHttpProxy);
-      } else {
-        certificatesVerifier = new PublicCertificateVerifier(publicKey, publicKeyId);
-      }
+      Verifier certificatesVerifier = getVerifier(merchantPrivateKey, wxPayHttpProxy, publicKey);
 
       WxPayV3HttpClientBuilder wxPayV3HttpClientBuilder = WxPayV3HttpClientBuilder.create()
         .withMerchant(mchId, certSerialNo, merchantPrivateKey)
@@ -355,6 +346,19 @@ public CloseableHttpClient initApiV3HttpClient() throws WxPayException {
     }
   }
 
+  private Verifier getVerifier(PrivateKey merchantPrivateKey, WxPayHttpProxy wxPayHttpProxy, PublicKey publicKey) {
+    Verifier certificatesVerifier = new AutoUpdateCertificatesVerifier(
+      new WxPayCredentials(mchId, new PrivateKeySigner(certSerialNo, merchantPrivateKey)),
+      this.getApiV3Key().getBytes(StandardCharsets.UTF_8), this.getCertAutoUpdateTime(),
+      this.getPayBaseUrl(), wxPayHttpProxy);
+    if (publicKey != null) {
+      Verifier publicCertificatesVerifier = new PublicCertificateVerifier(publicKey, publicKeyId);
+      publicCertificatesVerifier.setOtherVerifier(certificatesVerifier);
+      certificatesVerifier = publicCertificatesVerifier;
+    }
+    return certificatesVerifier;
+  }
+
   /**
    * 初始化一个WxPayHttpProxy对象
    *
@@ -382,7 +386,7 @@ private InputStream loadConfigInputStream(String configString, String configPath
     if (configContent != null) {
       return new ByteArrayInputStream(configContent);
     }
-    
+
     if (StringUtils.isNotEmpty(configString)) {
       configContent = Base64.getDecoder().decode(configString);
       return new ByteArrayInputStream(configContent);

diff --git a/...java-pay/src/main/java/com/github/binarywang/wxpay/v3/auth/PublicCertificateVerifier.java b/...java-pay/src/main/java/com/github/binarywang/wxpay/v3/auth/PublicCertificateVerifier.java
@@ -9,15 +9,24 @@ public class PublicCertificateVerifier implements Verifier{
 
     private final PublicKey publicKey;
 
+    private Verifier certificateVerifier;
+
     private final X509PublicCertificate publicCertificate;
 
     public PublicCertificateVerifier(PublicKey publicKey, String publicId) {
         this.publicKey = publicKey;
         this.publicCertificate = new X509PublicCertificate(publicKey, publicId);
     }
 
+   public void setOtherVerifier(Verifier verifier) {
+      this.certificateVerifier = verifier;
+   }
+
     @Override
     public boolean verify(String serialNumber, byte[] message, String signature) {
+        if (!serialNumber.contains("PUB_KEY_ID")) {
+            return this.certificateVerifier.verify(serialNumber, message, signature);
+        }
         try {
             Signature sign = Signature.getInstance("SHA256withRSA");
             sign.initVerify(publicKey);

diff --git a/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/v3/auth/Verifier.java b/weixin-java-pay/src/main/java/com/github/binarywang/wxpay/v3/auth/Verifier.java
@@ -7,4 +7,6 @@ public interface Verifier {
 
 
   X509Certificate getValidCertificate();
+
+  default void setOtherVerifier(Verifier verifier) {};
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -7,4 +7,6 @@ public interface Verifier {


		X509Certificate getValidCertificate();

		default void setOtherVerifier(Verifier verifier) {};
		}