apple-app-site-association 403

Question

jmt1966 OP

Created 4d

Replies 2

Boosts 0

Participants 2

Hi There, hopefully someone can help me here, we weren’t aware but our universal links stopped working sometime last year, as they are not used often on the apps, it wasn’t noticed. We checked all the elements and this is the situation:

Our apple-app-site-association file is located at

https://ourdomain.com.au/.well-known/apple-app-site-association And it is accessible and can be downloaded.

We have Associated Domain services enabled for our app Bundle Id: au.com.identifier.app
The Entitlements.plist in our app contains the list of associated domains - the second is the full url, the portal won't let me write it as such as it's not the real address.

<array> <string>applinks:ourdomain.com.au</string> <string>applinks:wwwdotourdomain.com.au</string> <string>applinks:ourdomain-prod-ourdomainwebsite.azurewebsites.net</string> </array>

But links for the first two, …ourdomain.com.au domains don’t work Request https://ourdomain.com.au/.well-known/apple-app-site-association downloads the file and returns status code:403

While checking the availability with https://app-site-association.cdn-apple.com/a/v1/ourdomain.com.au we get the error: ourdomain.com.au: Failed to load resource: the server responded with a status of 404 (Not Found)

Going directly to the hosted website: https://app-site-association.cdn-apple.com/a/v1/ourdomain-prod-ourdomainwebsite.azurewebsites.net Returns the json: { "activitycontinuation": { "apps": [ "99ABCD88***.au.com.identifier.app", "99ABCD88***.au.com.identifier.server.adhoc", "99ABCD88***.au.com.identifier.server.dev" ] }, "applinks": { "apps": [], "details": [ { "appID": "99ABCD88***.au.com.identifier.app", "paths": [ "/m/" ] }, { "appID": "99ABCD88***.au.com.identifier.server.adhoc", "paths": [ "/mt/" ] }, { "appID": "99ABCD88***.au.com.identifier.server.dev", "paths": [ "/md/*" ] } ] } }

It appears to be something in the redirect from the url but debugging shows nothing obvious. Has anyone experienced this before?

Thanks

Boost

Answer 1

DTS Engineer OP

Apple

3d

There is a certificate issue and a normal curl -v https://ourdomain.com.au/.well-known/apple-app-site-association should return the AASA file, the request returns an error message, you'll have to fix that before anything else to make it work. Check your SSL certificate and redirects:

curl: (60) SSL: no alternative certificate subject name matches target host name 'ourdomain.com.au' More details here: https://curl.se/docs/sslcerts.html

 curl -v https://ourdomain.com.au/.well-known/apple-app-site-association 
* Host ourdomain.com.au:443 was resolved.
* IPv6: (none)
* IPv4: 27.124.125.173
*   Trying 27.124.125.173:443...
* Connected to ourdomain.com.au (27.124.125.173) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 / [blank] / UNDEF
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=*.ds.network
*  start date: Dec 11 00:00:00 2024 GMT
*  expire date: Jan 11 23:59:59 2026 GMT
*  subjectAltName does not match host name ourdomain.com.au
* SSL: no alternative certificate subject name matches target host name 'ourdomain.com.au'
* Closing connection
* TLSv1.2 (OUT), TLS alert, close notify (256):
curl: (60) SSL: no alternative certificate subject name matches target host name 'ourdomain.com.au'
More details here: https://curl.se/docs/sslcerts.html
 
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Please check to Ensure your SSL cert validation passes.

Hope this helps.

Albert Pascual   Worldwide Developer Relations.

0

Answer 2

jmt1966 OP

3d

Sorry Albert, I should have been clearer - ourdomain isn't the actual address, our CISO insisted I use an alias (over-zealous)

If I run Curl against the Azure Web server, I get the correct response - I have cleared out specific details, but you'll get the idea:

Screenshot 2025-03-26 095353.png

Now if I go to the URL, I see this:

Screenshot 2025-03-26 095600.png

Sorry again for the confusion and thank you for your response.

0

	curl -v https://ourdomain.com.au/.well-known/apple-app-site-association
	* Host ourdomain.com.au:443 was resolved.
	* IPv6: (none)
	* IPv4: 27.124.125.173
	* Trying 27.124.125.173:443...
	* Connected to ourdomain.com.au (27.124.125.173) port 443
	* ALPN: curl offers h2,http/1.1
	* (304) (OUT), TLS handshake, Client hello (1):
	* CAfile: /etc/ssl/cert.pem
	* CApath: none
	* (304) (IN), TLS handshake, Server hello (2):
	* TLSv1.2 (IN), TLS handshake, Certificate (11):
	* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
	* TLSv1.2 (IN), TLS handshake, Server finished (14):
	* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
	* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
	* TLSv1.2 (OUT), TLS handshake, Finished (20):
	* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
	* TLSv1.2 (IN), TLS handshake, Finished (20):
	* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 / [blank] / UNDEF
	* ALPN: server accepted http/1.1
	* Server certificate:
	* subject: CN=*.ds.network
	* start date: Dec 11 00:00:00 2024 GMT
	* expire date: Jan 11 23:59:59 2026 GMT
	* subjectAltName does not match host name ourdomain.com.au
	* SSL: no alternative certificate subject name matches target host name 'ourdomain.com.au'
	* Closing connection
	* TLSv1.2 (OUT), TLS alert, close notify (256):
	curl: (60) SSL: no alternative certificate subject name matches target host name 'ourdomain.com.au'
	More details here: https://curl.se/docs/sslcerts.html

	curl failed to verify the legitimacy of the server and therefore could not
	establish a secure connection to it. To learn more about this situation and
	how to fix it, please visit the web page mentioned above.