農行支付介面的PHP實現

阿新 • • 發佈：2019-01-21

農行的支付閘道器提供了PHP的開發說明和相關的程式包。它是利用webservice實現php和java的TrustPayClient提供服務的互動。由於webservice需要執行在tomcat，無法跟php常見的lamp執行環境合用，增加的系統的複雜度，無論從開發還是維護上看都是不好的。還好農行的java包是做到非常棒的，所有關鍵點都做log4j做了記錄，我們可以根據它的log檔案得到它提交和返回的資料報文。我們從log中可以看到農行是採用SHA1withRSA的演算法對資料進行簽名和驗籤。用SHA1withRSA演算法在php中我們可以用openssl擴充套件的openssl_sign()和openssl_verify()實現。下面詳細說明如何用openssl簡化農行介面的開發工作。
提交

發起交易的資料格式是這樣的

<MSG><Message><Merchant><ECMerchantType>B2C</ECMerchantType><MerchantID>233010300330A01</MerchantID></Merchant><TrxRequest><TrxType>PayReq</TrxType><Order><OrderNo>ON200306300001</OrderNo><OrderAmount>280.0</OrderAmount> 
<OrderDesc>Game Card Order</OrderDesc><OrderDate>2003/11/12</OrderDate><OrderTime>23:55:30</OrderTime><OrderURL>http://127.0.0.1/Merchant/MerchantQueryOrder.jsp?ON=ON200306300001&QueryType=1</OrderURL><OrderItems><OrderItem><ProductID>IP000001</ProductID><ProductName>中國移動IP卡</ProductName><UnitPrice>100.0</UnitPrice><Qty>1</Qty></OrderItem><OrderItem><ProductID>IP000002</ProductID><ProductName>網通IP卡</ProductName><UnitPrice>90.0</UnitPrice><Qty>2</Qty></OrderItem></OrderItems></Order><ProductType>1</ProductType><PaymentType>1</PaymentType><NotifyType>0</NotifyType><ResultNotifyURL>http://127.0.0.1/Merchant/MerchantResult.jsp</ResultNotifyURL><MerchantRemarks>Hi!</MerchantRemarks><PaymentLinkType>1</PaymentLinkType></TrxRequest></Message><Signature-Algorithm>SHA1withRSA</Signature-Algorithm><Signature>nfJAveUtLG1YHqsjUdopB8Jl9QX4ZtlQrUn+HoiCy0yS9An19z5IxTIVYOuQXjNnbMGgmZlCwK3dSSnRTLHxZMC3zJUiE58qEwxatOgHNFUhAHTBxkUMO5ikC7C5qm/9L67/Xp7kYvHK9Fo/8CyXckROb+w+eLYcPaYo6+Of2Dg=</Signature></MSG>

資料有以下幾部分構成

1	<MSG><Message>訂單資訊</Message><Signature-Algorithm>SHA1withRSA</Signature-Algorithm><Signature>訂單資訊的簽名</Signature></MSG>

訂單資訊的構造參考：

<Merchant><ECMerchantType>B2C</ECMerchantType><MerchantID>233010300330A01</MerchantID></Merchant><TrxRequest><TrxType>PayReq</TrxType><Order><OrderNo>ON200306300001</OrderNo><OrderAmount>280.0</OrderAmount><OrderDesc>Game Card Order</OrderDesc><OrderDate>2003/11/12</OrderDate><OrderTime>23:55:30</OrderTime><OrderURL>http://127.0.0.1/Merchant/MerchantQueryOrder.jsp?ON=ON200306300001&QueryType=1</OrderURL><OrderItems><OrderItem><ProductID>IP000001</ProductID><ProductName>中國移動IP卡</ProductName><UnitPrice>100.0</UnitPrice><Qty>1</Qty></OrderItem><OrderItem><ProductID>IP000002</ProductID><ProductName>網通IP卡</ProductName><UnitPrice>90.0</UnitPrice><Qty>2</Qty></OrderItem></OrderItems></Order><ProductType>1</ProductType><PaymentType>1</PaymentType><NotifyType>0</NotifyType><ResultNotifyURL>http://127.0.0.1/Merchant/MerchantResult.jsp</ResultNotifyURL><MerchantRemarks>Hi!</MerchantRemarks><PaymentLinkType>1</PaymentLinkType></TrxRequest>

整體上由Merchant商戶資訊段和TrxRequest請求資訊段，兩部分構成。

Signature是採用SHA1withRSA對訂單資訊進行簽名在base64 encode後得到，在php中可以用openssl實現。參考程式碼如下

<?php
 
$cert_file = "D:/user.pem";
$password = '666666';
 
$signature = null;
$toSign = "<Merchant><ECMerchantType>B2C</ECMerchantType><MerchantID>233010300330A01</MerchantID></Merchant><TrxRequest><TrxType>PayReq</TrxType><Order><OrderNo>ON200306300001</OrderNo><OrderAmount>280.0</OrderAmount><OrderDesc>Game Card Order</OrderDesc><OrderDate>2003/11/12</OrderDate><OrderTime>23:55:30</OrderTime><OrderURL>http://127.0.0.1/Merchant/MerchantQueryOrder.jsp?ON=ON200306300001&QueryType=1</OrderURL><OrderItems><OrderItem><ProductID>IP000001</ProductID><ProductName>中國移動IP卡</ProductName><UnitPrice>100.0</UnitPrice><Qty>1</Qty></OrderItem><OrderItem><ProductID>IP000002</ProductID><ProductName>網通IP卡</ProductName><UnitPrice>90.0</UnitPrice><Qty>2</Qty></OrderItem></OrderItems></Order><ProductType>1</ProductType><PaymentType>1</PaymentType><NotifyType>0</NotifyType><ResultNotifyURL>http://127.0.0.1/Merchant/MerchantResult.jsp</ResultNotifyURL><MerchantRemarks>Hi!</MerchantRemarks><PaymentLinkType>1</PaymentLinkType></TrxRequest>";
 
// $toSign簽名後的資料應該是nfJAveUtLG1YHqsjUdopB8Jl9QX4ZtlQrUn+HoiCy0yS9An19z5IxTIVYOuQXjNnbMGgmZlCwK3dSSnRTLHxZMC3zJUiE58qEwxatOgHNFUhAHTBxkUMO5ikC7C5qm/9L67/Xp7kYvHK9Fo/8CyXckROb+w+eLYcPaYo6+Of2Dg=
 
$fp = fopen($cert_file, "rb");
$priv_key = fread($fp, 8192);
fclose($fp);
//獲取pem檔案中的私鑰
$pkeyid = openssl_get_privatekey($priv_key,$password);
//使用使用者私鑰對訊息進行簽名
openssl_sign($toSign, $signature, $pkeyid);
// Free the key.
openssl_free_key($pkeyid);
 
$b64 = base64_encode( $signature );
echo $b64;
 
?>

程式碼中用到的user.pem由農行網銀後臺下載的pfx或則p12檔案轉換而已，pfx轉pem檔案的方法是：

1	openssl pkcs12 -nocerts -nodes -in cert.p12 -out user.pem

返回的資料是POST回來的key為msg，內容是用base64編碼過的：

PE1TRz48TWVzc2FnZT48VHJ4UmVzcG9uc2U+PFJldHVybkNvZGU+MDAwMDwvUmV0dXJuQ29kZT48RXJyb3JNZXNzYWdlPjwvRXJyb3JNZXNzYWdlPjxFQ01lcmNoYW50VHlwZT5CMkM8L0VDTWVyY2hhbnRUeXBlPjxNZXJjaGFudElEPjIzMzAxMDMwMDMzMEEwMTwvTWVyY2hhbnRJRD48VHJ4VHlwZT5QYXlSZXN1bHQ8L1RyeFR5cGU+PE9yZGVyTm8+MTI5ODk1ODQyNTMxODU8L09yZGVyTm8+PEFtb3VudD4wLjAzPC9BbW91bnQ+PEJhdGNoTm8+MDAwMDAxPC9CYXRjaE5vPjxWb3VjaGVyTm8+MDAwMDEyPC9Wb3VjaGVyTm8+PEhvc3REYXRlPjIwMTEvMDMvMDE8L0hvc3REYXRlPjxIb3N0VGltZT4xMzozNjozMDwvSG9zdFRpbWU+PE1lcmNoYW50UmVtYXJrcz5IaSE8L01lcmNoYW50UmVtYXJrcz48UGF5VHlwZT5QQVkwMTwvUGF5VHlwZT48Tm90aWZ5VHlwZT4wPC9Ob3RpZnlUeXBlPjxQYXlJUD42MC4xOTAuNzMuMTIyPC9QYXlJUD48UGF5UmVmZXJlcj5sdXNlbi52aXAuaXNob3BleC5jbjwvUGF5UmVmZXJlcj48aVJzcFJlZj4zNjAzMDExMzkxNTM8L2lSc3BSZWY+PC9UcnhSZXNwb25zZT48L01lc3NhZ2U+PFNpZ25hdHVyZS1BbGdvcml0aG0+U0hBMXdpdGhSU0E8L1NpZ25hdHVyZS1BbGdvcml0aG0+PFNpZ25hdHVyZT5MM0VlQW1yMTdPYTloaHVxU0E5NEFXSEVhVjN5RnFOTHZZQ29qem0xVm5PMWtMSnVhVkZTekdyV0Y3NjhPMUtMelBaY1M1MVFMRko1dUFMUlFtUVM1Ylp3Tm5kZ1FHeUxPZGRaMUpjRGdjazh3RE9UYkJPSTJFQWRhdElGL0czR1QrRENoRkVyVlZMR01oa1VGRTRpVTVrM3YvdXMwM3pZQ1UxbUR4SzFtbGM9PC9TaWduYXR1cmU+PC9NU0c+

base64解碼後是這樣：

<MSG><Message><TrxResponse><ReturnCode>0000</ReturnCode><ErrorMessage></ErrorMes
sage><ECMerchantType>B2C</ECMerchantType><MerchantID>233010300330A01</MerchantID
><TrxType>PayResult</TrxType><OrderNo>12989584253185</OrderNo><Amount>0.03</Amou
nt><BatchNo>000001</BatchNo><VoucherNo>000012</VoucherNo><HostDate>2011/03/01</H
ostDate><HostTime>13:36:30</HostTime><MerchantRemarks>Hi!</MerchantRemarks><PayT
ype>PAY01</PayType><NotifyType>0</NotifyType><PayIP>60.190.73.122</PayIP><PayRef
erer>lusen.vip.ishopex.cn</PayReferer><iRspRef>360301139153</iRspRef></TrxRespon
se></Message><Signature-Algorithm>SHA1withRSA</Signature-Algorithm><Signature>L3
EeAmr17Oa9hhuqSA94AWHEaV3yFqNLvYCojzm1VnO1kLJuaVFSzGrWF768O1KLzPZcS51QLFJ5uALRQm
QS5bZwNndgQGyLOddZ1JcDgck8wDOTbBOI2EAdatIF/G3GT+DChFErVVLGMhkUFE4iU5k3v/us03zYCU
1mDxK1mlc=</Signature></MSG>

我們需要對Message段的資料進行和Signature段的資料進行驗籤。同提交請求時一樣，php有openssl_verify這個函式可以對農行提交過來的資料進行驗證。測試用例見下文：

<?php
 
$ret = array (
  'MSG' => 'PE1TRz48TWVzc2FnZT48VHJ4UmVzcG9uc2U+PFJldHVybkNvZGU+MDAwMDwvUmV0dXJuQ29kZT48RXJyb3JNZXNzYWdlPjwvRXJyb3JNZXNzYWdlPjxFQ01lcmNoYW50VHlwZT5CMkM8L0VDTWVyY2hhbnRUeXBlPjxNZXJjaGFudElEPjIzMzAxMDMwMDMzMEEwMTwvTWVyY2hhbnRJRD48VHJ4VHlwZT5QYXlSZXN1bHQ8L1RyeFR5cGU+PE9yZGVyTm8+MTI5ODk1ODQyNTMxODU8L09yZGVyTm8+PEFtb3VudD4wLjAzPC9BbW91bnQ+PEJhdGNoTm8+MDAwMDAxPC9CYXRjaE5vPjxWb3VjaGVyTm8+MDAwMDEyPC9Wb3VjaGVyTm8+PEhvc3REYXRlPjIwMTEvMDMvMDE8L0hvc3REYXRlPjxIb3N0VGltZT4xMzozNjozMDwvSG9zdFRpbWU+PE1lcmNoYW50UmVtYXJrcz5IaSE8L01lcmNoYW50UmVtYXJrcz48UGF5VHlwZT5QQVkwMTwvUGF5VHlwZT48Tm90aWZ5VHlwZT4wPC9Ob3RpZnlUeXBlPjxQYXlJUD42MC4xOTAuNzMuMTIyPC9QYXlJUD48UGF5UmVmZXJlcj5sdXNlbi52aXAuaXNob3BleC5jbjwvUGF5UmVmZXJlcj48aVJzcFJlZj4zNjAzMDExMzkxNTM8L2lSc3BSZWY+PC9UcnhSZXNwb25zZT48L01lc3NhZ2U+PFNpZ25hdHVyZS1BbGdvcml0aG0+U0hBMXdpdGhSU0E8L1NpZ25hdHVyZS1BbGdvcml0aG0+PFNpZ25hdHVyZT5MM0VlQW1yMTdPYTloaHVxU0E5NEFXSEVhVjN5RnFOTHZZQ29qem0xVm5PMWtMSnVhVkZTekdyV0Y3NjhPMUtMelBaY1M1MVFMRko1dUFMUlFtUVM1Ylp3Tm5kZ1FHeUxPZGRaMUpjRGdjazh3RE9UYkJPSTJFQWRhdElGL0czR1QrRENoRkVyVlZMR01oa1VGRTRpVTVrM3YvdXMwM3pZQ1UxbUR4SzFtbGM9PC9TaWduYXR1cmU+PC9NU0c+',
);
 
$msg = base64_decode($ret['MSG']);
 
preg_match("/\<Message\>(.*)\<\/Message\>.*\<Signature\>(.*)\<\/Signature\>/i",$msg,$match);
$contents = $match[1];
$signature = $match[2];
 
$pub_cert_file = "TrustPay.pem";
verify($contents,$signature,$pub_cert_file );          
 
function verify($data,$signature,$cert_file){
    $fp = fopen($cert_file, "r");
    $cert = fread($fp, 8192);
    fclose($fp);
    $pubkeyid = openssl_get_publickey($cert);
    $signature = base64_decode($signature);
    // state whether signature is okay or not
    $ok = openssl_verify($data, $signature, $pubkeyid);
    openssl_free_key($pubkeyid);
    return $ok;
}
 
?>

程式碼中TrustPay.pem可以這麼生成

1	openssl x509 -inform DER -in TrustPay.cer -out TrustPay.pem

-EOF-

農行支付介面的PHP實現

業務程式碼:基於spring的銀行支付介面模型實現

支付寶APP支付介面-PHP

農行支付介面的PHP實現

PHP實現RSA簽名生成訂單功能【支付寶示例】

php實現支付寶授權登錄

PHP實現 APP端微信支付功能

php微信支付介面開發，獲取php微信掃碼支付返回結果，php開發微信支付demo原始碼

php實現base64圖片上傳方式例項程式碼前端介面問題

php 實現app微信支付

php 支付寶支付介面

PHP學習——28 PHP面向物件(抽象類與抽象方法、介面的實現)

App介面設計之token的php實現

PHP開發支付寶微信個人免籤支付介面例項

PHP實現微信支付(微信小程式版)

PHP呼叫支付寶支付介面操作步驟

PHP實現微信支付(jsapi支付)和退款(無需整合支付SDK

django2.0呼叫微信支付介面實現PC端掃碼支付

PHP支付寶APP支付介面

php實現base64圖片上傳方式例項程式碼前端介面問題

PHP實現支付寶小程式使用者授權的工具類

農行支付介面的PHP實現

相關推薦