3

As many already know, Google App Engine by default hosts its apps on an appspot.com subdomain and their wildcard (*.appspot.com) SSL certificate allows any apps to use https over this subdomain.

Enter iOS 9 with Universal Links and Web Markup which now requires hosting a 'signed json file' with designated applinks in it. The key word there is 'signed'. This file needs to be signed with a valid SSL cert and private key. (Listing 2-7 and 2-8)

On twitter, I've been told that the signing certificate does NOT have to match the actual website's domain SSL certificate BUT a self-signed certificate will not work.

So one workaround is to simply buy your own SSL certificate and sign it with this cert.

I'm curious what other options there are to those of us hosting APIs and websites on Google App Engine and/or using Google Cloud Endpoints because I assume Google isn't going to hand over their wildcard ssl cert and private key for us to use ;)

Update 8/5/2015

To host the apple-app-site-association file, I had to manually open it and spit it out when called for using the webapp2 handler like so:

class GetAppleAppSiteAssoc(webapp2.RequestHandler):
    def get(self):
        showAppleAppSiteAssoc(self)

def showAppleAppSiteAssoc(self):
    logging.info("Enter showAppleAppSiteAssoc()")

    path = os.path.join(os.path.dirname(__file__), 'apple-app-site-association')
    fileContents = open(path).read()
    self.response.headers['Content-Type'] = 'application/pkcs7-mime'
    self.response.out.write(fileContents)
    return

app = webapp2.WSGIApplication([('/', MainHandler),
                ('/apple-app-site-association', GetAppleAppSiteAssoc)],
                debug=True)

Currently having issues similar to this post and have tried both signing with my iOS Distribution cert as well as with a valid cert from work.

Update 8/10/2015

Had our dev-ops guy at work sign this with both the CA and intermediate certs from work and uploaded it and it worked!

Still curious about other solutions though.....it does seem odd that the iOS Distribution cert wouldn't have worked.

Community
  • 1
  • 1
valheru
  • 2,552
  • 3
  • 20
  • 40
  • I'm curious as to where you hosted this apple-app-site-association file – st.derrick Sep 10 '15 at 19:46
  • @st.derrick it's just in the same directory as all the code – valheru Sep 10 '15 at 22:47
  • so is it located at yoursite.appspot.com/apple-app-site-association? or is it somewhere else? – st.derrick Sep 11 '15 at 00:02
  • it's located wherever the sandbox where the code is itself. As you can see in the python code, I'm loading it from the same directory that the web app code is. (not the static folder) – valheru Sep 11 '15 at 00:18
  • got it. I'm wondering in production whether Apple queried subdomains when grabbing the apple-app-site-association file or whether it had to be part of the root domain of the website. AKA does https://subdomain.example.com/apple-app-site-association get scraped if you have the entitlement applinks:subdomain.example.com? Or does it scrape https://example.com/apple-app-site-association in this case – st.derrick Sep 11 '15 at 17:34
  • @st.derrick From what I can tell, yes. Wherever the entitlement points to is where it will expect the file. – valheru Sep 11 '15 at 19:26

3 Answers3

4

You don't have to sign apple-app-site-association unless your implementing Activity Continuation for devices running iOS 8. Universal Links are new to iOS 9 and Apple no longer requires apple-app-site-association to be signed.

barsh
  • 450
  • 6
  • 16
  • What documentation are you referring to for Universal Links not requiring SSL signing? – valheru Oct 15 '15 at 22:48
  • At the 14 minute mark of this video from WWDC, the speaker says as of iOS9 beta seed 2, signing is no longer required. https://developer.apple.com/videos/play/wwdc2015-509/ – barsh Oct 16 '15 at 19:38
0

Well one answer to this question points to the fact that any valid domain certificate (with CA cert) can sign the file (even if that certificate is NOT for the domain the file will live on).

I ended up buying one for one of my domains and signing the file for another domain.

valheru
  • 2,552
  • 3
  • 20
  • 40
0

https://developer.apple.com/library/ios/documentation/General/Conceptual/AppSearch/UniversalLinks.html

If your app runs in iOS 9 or later and you use HTTPS to serve the apple-app-site-association file, you can create a plain text file that uses the application/json MIME type and you don’t need to sign it.

Mark Lassau
  • 1