修修改支付宝证书逐张解析

backend/app/alipay_provider.py

@@ -76,10 +76,24 @@ def _load_certificate_bundle(path_value: str, label: str):
         raise AlipayTransferError(f"{label}文件不存在，请检查对应 .env 绝对路径")
     content = Path(path_value).read_bytes()
     blocks = re.findall(rb"-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----", content, re.DOTALL)
-    try:
+    certificates = []
-        return [x509.load_pem_x509_certificate(block) for block in blocks]
+    parse_errors = []
-    except Exception as exc:
+    for block in blocks:
-        raise AlipayTransferError(f"{label}格式无效，应为 PEM 编码的 X.509 证书集合") from exc
+        try:
+            certificates.append(x509.load_pem_x509_certificate(block))
+        except (TypeError, ValueError) as exc:
+            # Alipay's root bundle contains RSA, SM2 and ECC certificates.
+            # Some cryptography/OpenSSL builds cannot decode the SM2
+            # certificate even though the RSA certificates needed for RSA2
+            # are valid.  Parse each PEM independently so one unsupported
+            # non-RSA certificate does not prevent the service from starting.
+            parse_errors.append(exc)
+    if not certificates:
+        cause = parse_errors[0] if parse_errors else None
+        raise AlipayTransferError(
+            f"{label}格式无效，应为包含有效 RSA 证书的 PEM X.509 证书集合"
+        ) from cause
+    return certificates
 
 
 def _certificate_serial(certificate) -> str:

backend/tests/test_alipay_provider.py

@@ -149,3 +149,23 @@ def test_root_certificate_serial_ignores_non_rsa_certificates():
     expected = md5(b"CN=Alipay,O=Example,C=CN41259").hexdigest()
 
     assert alipay_provider._root_certificate_serial([sm2, rsa, ecc]) == expected
+
+
+def test_certificate_bundle_keeps_valid_certificates_when_one_block_is_unsupported(monkeypatch, tmp_path):
+    bundle = tmp_path / "alipayRootCert.crt"
+    bundle.write_bytes(
+        b"-----BEGIN CERTIFICATE-----\nBAD\n-----END CERTIFICATE-----\n"
+        b"-----BEGIN CERTIFICATE-----\nGOOD\n-----END CERTIFICATE-----\n"
+    )
+    valid_certificate = object()
+
+    class FakeX509:
+        @staticmethod
+        def load_pem_x509_certificate(block):
+            if b"BAD" in block:
+                raise ValueError("unsupported SM2 certificate")
+            return valid_certificate
+
+    monkeypatch.setitem(__import__("sys").modules, "cryptography.x509", FakeX509)
+
+    assert alipay_provider._load_certificate_bundle(str(bundle), "支付宝根证书") == [valid_certificate]