feat: v3支付接线商户证书——请求签名用商户证书序列号（WX_PAY_MCH_CERT_SERIAL），PUB_KEY_ID仅用于应答验签

docker-compose.prod.yml

@@ -45,6 +45,7 @@ services:
       - WX_SECRET=${WX_SECRET:-}
       - WX_PAY_MCH_ID=${WX_PAY_MCH_ID:-}
       - WX_PAY_SERIAL_NO=${WX_PAY_SERIAL_NO:-}
+      - WX_PAY_MCH_CERT_SERIAL=${WX_PAY_MCH_CERT_SERIAL:-}
       - WX_PAY_API_KEY=${WX_PAY_API_KEY:-}
       - WX_PAY_NOTIFY_URL=${WX_PAY_NOTIFY_URL:-}
       - ADMIN_USERNAME=${ADMIN_USERNAME:-admin}

server/src/utils/weixin.js

@@ -46,7 +46,9 @@ class WeChatService {
     signer.update(message)
     signer.end()
     const signature = signer.sign(this.privateKey, 'base64')
-    return `WECHATPAY2-SHA256-RFC4648 mchid="${this.mchId}",nonce_str="${nonce}",signature="${signature}",timestamp="${timestamp}",serial_no="${this.serialNo}"`
+    // 请求头 serial_no 用商户证书序列号；WX_PAY_SERIAL_NO（PUB_KEY_ID_ 开头）是微信支付公钥ID，仅用于验签微信应答
+    const requestSerial = process.env.WX_PAY_MCH_CERT_SERIAL || this.serialNo
+    return `WECHATPAY2-SHA256-RFC4648 mchid="${this.mchId}",nonce_str="${nonce}",signature="${signature}",timestamp="${timestamp}",serial_no="${requestSerial}"`
   }
   
   /**