6 Replies
      Latest reply: Nov 30, 2016 6:34 AM by eywebdeveloperteam RSS
      vmnKCatigbe Level 1 Level 1 (0 points)

        I'm working on implementing Universal Links and Handoff for my domains, and running into some trouble.

         

        I've followed all of the Apple Guides, however I am hitting a roadblock when it comes to apple-app-site-association hosting.

         

        I have valid SSL certs for my domain, a valid apple-app-site-association file - however I am consistently seeing these errors in my logs:

        default 09:15:45.000000 -0500   swcd     2016-11-15 10:15:45.677187 AM [SWC] ### Bad apple-app-site-association server trust: -6754/0xFFFFE59E kAuthenticationErr, 4 (kSecTrustResultUnspecified), {
                "TrustResultValue" : 4
                "TrustEvaluationDate" : 2016-11-15 15:15:45.410148
                "TrustResultDetails" :
                [
                    {},
                    {}
                ]
            }
        
        default 09:15:45.000000 -0500   swcd     2016-11-15 10:15:45.697530 AM [SWC] ### Rejecting URL 'https://<redacted>/.well-known/apple-app-site-association' for auth method 'NSURLAuthenticationMethodServerTrust': -6754/0xFFFFE59E kAuthenticationErr
        default 09:15:46.000000 -0500   swcd     2016-11-15 10:15:46.189794 AM [SWC] ### Denying redirect 'https://<redacted>/.well-known/apple-app-site-association' -> 'http://<redacted>/.well-known/apple-app-site-association'
        default 10:15:46.000000 -0500   swcd     2016-11-15 10:15:46.251853 AM [SWC] ### Bad apple-app-site-association server trust: -6754/0xFFFFE59E kAuthenticationErr, 4 (kSecTrustResultUnspecified), {
                "TrustResultValue" : 4
                "TrustEvaluationDate" : 2016-11-15 15:15:46.241376
                "TrustResultDetails" :
                [
                    {},
                    {}
                ]
            }
        default 10:15:46.000000 -0500   swcd     2016-11-15 10:15:46.253257 AM [SWC] ### Rejecting URL 'https://<redacted>/apple-app-site-association' for auth method 'NSURLAuthenticationMethodServerTrust': -6754/0xFFFFE59E kAuthenticationErr
        Nov 11 09:04:35 iPad-Mini swcd[739] <Notice>: 2016-11-11 09:04:34.376592 AM [SWC] ### Download URL 'https://<redacted>/apple-app-site-association' failed: -6756/0xFFFFE59C kTypeErr
        

         

         

        If I use an unrelated test domain, then I get proper functionality with the same file.

        On my actual domain, the .well-known/apple-app-site-association does not redirect, it's by default a "301 Permanently Moved" response.  I am not sure if this causes any issues with the flow, but I see the app install make the call to .well-known, then the call to the root apple-app-site-association which succeeds.


        I've run the domains through all sorts of SSL validation tools, and they all show that it's properly setup -

        However, the apple universal search validator fails (https://search.developer.apple.com/appsearch-validation-tool), but does not give any good steps to resolve.

         

        If anyone could offer any help, it'd be very much appreciated here.

        • Re: Troubleshooting Universal Links
          eskimo Apple Staff Apple Staff (7,960 points)

          On my actual domain, the .well-known/apple-app-site-association does not redirect, it's by default a "301 Permanently Moved" response.

          I’m confused by this.  A 301 is a redirect, so how can your server both “not redirect” and be giving a “301”?

          default 09:15:46.000000 -0500 swcd 2016-11-15 10:15:46.189794 AM
          [SWC] ### Denying redirect 'https:…' -> 'http:…'

          Some factoids about the above:

          • SWC is shared web credential.

          • swcd is the shared web credential daemon.

          • That daemon uses NSURLSession to fetch the apple-app-site-association file.

          • That message is generated when NSURLSession delivers the -URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler: delegate callback to swcd.

          • When swcd gets this delegate callback and issues this log message, it always calls the completion handler with nil, causing the body of the redirection response to be delivered as the payload of this request.  That doesn’t sound good, eh?

          Share and Enjoy

          Quinn “The Eskimo!”
          Apple Developer Relations, Developer Technical Support, Core OS/Hardware
          let myEmail = "eskimo" + "1" + "@apple.com"

            • Re: Troubleshooting Universal Links
              vmnKCatigbe Level 1 Level 1 (0 points)

              So to followup, and apologies for the late response - I've removed all redirects, made sure they are static files with the correct content-types,  and still no luck.

               

              the errors regarding denying the redirect are resolved, but this issue still remains:

               

              default 22:51:58.815436 -0500   swcd    ### Download URL 'https://<redacted>/.well-known/apple-app-site-association' failed: -6756/0xFFFFE59C kTypeErr
              default 22:51:58.815971 -0500   swcd    Started request for domain '<redacted>', URL 'https://<redacted>/apple-app-site-association'
              default 22:51:58.871038 -0500   swcd    ### Download URL 'https://<redacted>/apple-app-site-association' failed: -6756/0xFFFFE59C kTypeErr
              default 22:51:58.871516 -0500   swcd    Completing request for 'https://<redacted>/apple-app-site-association', status -6756/0xFFFFE59C kTypeErr
              

               

               

              I see this when the app installs, when I launch safari on the device to the <redacted> site

                • Re: Troubleshooting Universal Links
                  eskimo Apple Staff Apple Staff (7,960 points)

                  In this context kTypeErr means that the apple-app-site-association JSON (either inside the CMS or standalone) is valid JSON but has an invalid internal structure.  There are lots of checks done on that structure, more than I can reasonably outline here.  If you post the JSON you’re using, I can take a quick look at it (feel free to redact the identifying details).

                  Share and Enjoy

                  Quinn “The Eskimo!”
                  Apple Developer Relations, Developer Technical Support, Core OS/Hardware
                  let myEmail = "eskimo" + "1" + "@apple.com"

                    • Re: Troubleshooting Universal Links
                      eywebdeveloperteam Level 1 Level 1 (0 points)

                      - There are a way to use "Multi-domain" certificates (SAN Certificates) for universal links? The certificate is expedited for .com as base and the other domains are .fr, .es, .de...

                      - For the .com all is ok, an universal links are working, but for the other domains, the log console show me a fail:

                      <Notice>: ### Bad apple-app-site-association server trust: -6754/0xFFFFE59E kAuthenticationErr, 5 (kSecTrustResultRecoverableTrustFailure), {

                                              "TrustResultDetails" :

                                                  [

                                                      {

                                                          "SSLHostname" : false,

                                                      },

                                                      {},

                                                      {}

                                                  ],

                                                  "TrustResultValue" : 5,

                                                  "TrustEvaluationDate" : 2016-11-22 05:52:49.792425,

                                                  "TrustCertificateTransparency" : true,

                      }

                      • Re: Troubleshooting Universal Links
                        vmnKCatigbe Level 1 Level 1 (0 points)

                        here's the json:

                         

                         

                        Raw:

                         

                        {"activitycontinuation":{"apps":["TEAM_ID.com.app.bundleid","ALT_TEAM_ID.com.app.bundleid-develop"]},"applinks":{"apps":[],"details":[{"appID":"TEAM_ID.com.app.bundleid","paths":[["\/shows\/","\/full-episodes\/","\/video-clips\/"]]},{"appID":"ALT_TEAM_ID.com.app.bundleid-develop","paths":[["\/shows\/","\/full-episodes\/","\/video-clips\/"]]}]}}
                        

                         

                         

                        Formatted:

                         

                        {
                            "activitycontinuation": {
                                "apps": ["TEAM_ID.com.app.bundleid", "ALT_TEAM_ID.com.app.bundleid-develop"]
                            },
                            "applinks": {
                                "apps": [],
                                "details": [{
                                    "appID": "TEAM_ID.com.app.bundleid",
                                    "paths": [
                                        ["\/shows\/", "\/full-episodes\/", "\/video-clips\/"]
                                    ]
                                }, {
                                    "appID": "ALT_TEAM_ID.com.app.bundleid-develop",
                                    "paths": [
                                        ["\/shows\/", "\/full-episodes\/", "\/video-clips\/"]
                                    ]
                                }]
                            }
                        }