微信支付退款异步通知验签 java.lang.SecurityException: JCE cannot authenticate the provider BC

素颜马尾好姑娘i 2023-06-06 07:54 6阅读 0赞

> **Maven项目**，微信支付退款异步通知验签本机测试没问题，打war包上传到服务器的Tomcat中测试抛出异常。

# 微信服务器返回来的数据
    <xml>
    	<return_code>SUCCESS</return_code>
    	<appid><![CDATA[xxxxxxxxxxx]]></appid>
    	<mch_id><![CDATA[xxxxxxxxxxx]]></mch_id>
    	<nonce_str><![CDATA[9ed0a110d1db9686cde45a46a8b9f695]]></nonce_str>
    	<req_info><![CDATA[36DbbQa7HqJ0etz/6SIVmR96CTm49EgsJjKcMDZ2NBuIqlPG2ZRifAIcGBxlQpO7Jrp5IynSnAOubkyC7rad1i1hVAyf2nBQxi8H6R4h+QyEbV0n55qe28AJh46qOjDZa6enczYDTsJNRNtcR/ymbjPjFR6k2qfhFAeRO/J7DWqG3BVr5IYyJKuvKJi7x4uL4W8WUKGnp5PAYFXPX+s0aFL3Y2aNal77cI11krldSaSyRsNTbAqdiG1P5NYAhQzOATGT93CbxBCSLUtN7v9u5X8bW59clMNeF1/3UBqtZqpwVxMhCZbocCvwYXrzrt6d2MtrS/oYOpkoAvjIMUXJtCqZrNd2lBqN+xx7ylWnhQ7hfVM+hF3iXTM450BcnkvYy0f8UxyVadkZ3WULcQFjJKnDLxWv2t3FjiwGBbtzXJHSRme0fR7TkC4+L8OOilrLn3S+SPWcxgQzkiIwpsYCwQ47fa1edLrdrl8qT7HWB+/XBfDgc4w5TmlmQR5iQRJIF4sHSX839PF+zH4Rjqq+fipqRBoDCF4YW7GWXuRcw81TsR6D8UJc1g5XvipmFa2vtLxmzp3pO+TT3SdRVp1VZKm1+ktvlLqLJSlxcKTOxvBWb4xdBrfuze571uHncCGyBzCSbSbAuZ5+z9kOcrO0b/sVSxq6VEm/l/vMVjj2mFyM6sd6G3Cty7Wu0sPtEJROCvWfWvxSpKQM6vOLONqGIyjM7R1B8QdOZzMLVTkvbabjkrafEgQtxSruPs6Ww45Ri4js9pBKSdz8++Ksc3DIZD1fz4r7ZyC4j0M6Sqt/MlodrwzPfyGVuOpa3DojcovVD2CPkD1NXP2DwKLtIEtb790igxBcSOgyOT3Kpj5hh/g51QReFseLcnNtZE9iW1rfBIIHtXhj+3i068dyEvpi0CwrXRtsmk4/tbAc1bxqpIRFuNtcKCQBvfqvCiEbqrT83TPowNGY9zFkkZawc6xghPszH4aujHb9QFoPjNkmC5nXVMIrTr2DtXHkO2RNhAWh9OZKZQ3eEPjKmG2wPXvg5zrvVXu5Ena1C/rtUOqwbHI=]]></req_info>
    </xml>

// 验签时抛出的异常
    java.lang.SecurityException: JCE cannot authenticate the provider BC
            at javax.crypto.Cipher.getInstance(Cipher.java:656)
            at javax.crypto.Cipher.getInstance(Cipher.java:595)
            at com.kkcode.kkclass.common.utils.WxDecodeUtil.decryptData(WxDecodeUtil.java:40)
            at com.kkcode.kkclass.wechat.pay.service.impl.WxPayServiceImpl.refundAsyncNotify(WxPayServiceImpl.java:260)
            at com.kkcode.kkclass.wechat.pay.controller.WxPayController.refundAsyncNotify(WxPayController.java:50)
            at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
            at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
            at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
            at java.lang.reflect.Method.invoke(Method.java:498)
            at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189)
            at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138)
            at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
            at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895)
            at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800)
            at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
            at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038)
            at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942)
            at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005)
            at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:908)
            at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
            at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:882)
            at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.springframework.boot.actuate.web.trace.servlet.HttpTraceFilter.doFilterInternal(HttpTraceFilter.java:90)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:320)
            at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)
            at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at com.kkcode.kkclass.security.JwtTokenAuthenticationFilter.doFilterInternal(JwtTokenAuthenticationFilter.java:37)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
            at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
            at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
            at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
            at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:130)
            at org.springframework.boot.web.servlet.support.ErrorPageFilter.access$000(ErrorPageFilter.java:66)
            at org.springframework.boot.web.servlet.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:105)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:123)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:117)
            at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:106)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
            at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
            at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
            at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490)
            at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
            at psiprobe.Tomcat90AgentValve.invoke(Tomcat90AgentValve.java:35)
            at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
            at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678)
            at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
            at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
            at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
            at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
            at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:853)
            at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1587)
            at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
            at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
            at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
            at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
            at java.lang.Thread.run(Thread.java:748)
    Caused by: java.lang.SecurityException: Cannot verify jar:file:/opt/apache-tomcat-9.0.21/webapps/kkclass/WEB-INF/lib/bcprov-jdk15on-1.60.jar!/
            at javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:448)
            at javax.crypto.JarVerifier.verifyJars(JarVerifier.java:363)
            at javax.crypto.JarVerifier.verify(JarVerifier.java:289)
            at javax.crypto.JceSecurity.verifyProviderJar(JceSecurity.java:164)
            at javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:190)
            at javax.crypto.Cipher.getInstance(Cipher.java:652)
            ... 109 more
    Caused by: java.security.PrivilegedActionException: java.io.FileNotFoundException: /opt/apache-tomcat-9.0.21/webapps/kkclass/WEB-INF/lib/bcprov-jdk15on-1.60.jar (没有那个文件或目录)
            at java.security.AccessController.doPrivileged(Native Method)
            at javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:426)
            ... 114 more
    Caused by: java.io.FileNotFoundException: /opt/apache-tomcat-9.0.21/webapps/kkclass/WEB-INF/lib/bcprov-jdk15on-1.60.jar (没有那个文件或目录)
            at java.util.zip.ZipFile.open(Native Method)
            at java.util.zip.ZipFile.<init>(ZipFile.java:225)
            at java.util.zip.ZipFile.<init>(ZipFile.java:155)
            at java.util.jar.JarFile.<init>(JarFile.java:166)
            at java.util.jar.JarFile.<init>(JarFile.java:103)
            at sun.net.www.protocol.jar.URLJarFile.<init>(URLJarFile.java:93)
            at sun.net.www.protocol.jar.URLJarFile.getJarFile(URLJarFile.java:69)
            at sun.net.www.protocol.jar.JarFileFactory.get(JarFileFactory.java:99)
            at sun.net.www.protocol.jar.JarURLConnection.connect(JarURLConnection.java:122)
            at sun.net.www.protocol.jar.JarURLConnection.getJarFile(JarURLConnection.java:89)
    	at javax.crypto.JarVerifier$2.run(JarVerifier.java:440)
            at javax.crypto.JarVerifier$2.run(JarVerifier.java:427)
            ... 116 more

> **话不多说，直接上解决的方法**  
> 1、下载和maven依赖中相同版本号的bcprov-jdk15on的jar包，我下载的为bcprov-jdk15on-1.60.jar。因为我的pom中依赖的为：

<dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcprov-jdk15on</artifactId>
        <version>1.60</version>
    </dependency>

> 2、修改该依赖的作用域为`<scope>provider</scope>`  
> 3、将此jar包加入到`$JAVA_HOME/jre/lib/ext` 文件夹下  
> ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNjkzMTUw_size_16_color_FFFFFF_t_70]4、在`$JAVA_HOME/jre/lib/security`文件夹下找到 `java.security` 文件，再次文件中加入`security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider`  
> 有可能你不是10，看看当前你的这个文件中security.provider.序号最大的为多少，在它的基础上+1即可  
> ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNjkzMTUw_size_16_color_FFFFFF_t_70 1]  
> 5、最最最重要的一步，记得重启你的Tomcat。

> **猜测该异常出现的原因**：在网上看到说bcprov-jdk15on这个包是带有签名的，不可以对他进行解压或压缩等等操作，所以我猜测出现此异常的原因：maven项目在打包时破坏了这个Jar包的签名，所以导致此异常的出现。  
> 所以说我们将该Jar包直接加入到$JAVA\_HOME/jre/lib/ext目录下，这样不会破坏该Jar包的签名，并且在JVM启动时将该Jar包等下的类进行加载。

> [有兴趣的可以再看一下该链接中的内容，IBM一位大牛对`BouncyCastle`一点阐述][IBM_BouncyCastle]  
> BouncyCastle is a great name for a product and provides cryptography using the Java Cryptography Extensions. It has been around long before there were standards in JSE or JEE for cryptography. WAS has its own security for cryptography and can be updated from here: http://www.ibm.com/developerworks/java/jdk/security/index.html.  
> Since there are many different companies that make cryptography extensions, Sun/Oracle added to the Java specification how new ones could be added to the JVM. To do so the java.security file needs to be updated with the security providers that are available to the JVM. This is the same for all JVMs, whether it is Oracle, IBM, OpenJDK, etc. This tells the JVM that it is permitted to load security from the list in the file only. The reason it needs to be added is so that malicious code cannot be run as a security provider.  
> Adding the jar to the ext directory allows the JVM to load the security classes when the JVM starts.

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNjkzMTUw_size_16_color_FFFFFF_t_70]: /images/20230601/09d5647965ef4913b4ffd2659fba5d7d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNjkzMTUw_size_16_color_FFFFFF_t_70 1]: /images/20230601/e478575342564fb1b5a724f8d220a8dc.png
[IBM_BouncyCastle]: https://www.ibm.com/developerworks/community/forums/html/topic?id=fc2e0edb-8e2e-44b2-93cb-505941d5a157