Android Digital Asset Link verification fails for site using LetsEncrypt SSL cert

Question

I had just about started implementing support for App Links into my app, when I bumped into this unusual issue.

Following the steps in the Android Studio app links tool, I was quickly able to make the necessary changes. However, when I came to the step of verifying the Digital Asset Link files' association with my website, I got an error.

Initially, I thought there might be some error accessing the link. I tried accessing the link using multiple browsers, and there was no error.

When I looked around for anyone facing a similar issue, I came across this post. The site I was trying to associate with was also using a LetsEncrypt generated SSL cert. So, I tried another site I had that used LetsEncrypt SSL — same result. Then I used a site which used RapidSSL generated SSL, and bingo - it worked!

I'm not sure whether the App Links team has taken notice of this. But can anyone help get an answer on this?

Thanks!

Answer 1

I have got the same issues of SSL certificate is not verified. This is because of the server where you host over there u have to verify SSL certificate

So the file is generate name assertlinks.json

This file you have to place over your server domain by creating folder .well-known/ inside this json file

https://sub.subdomain.example.com/.well-known/assetlinks.json

in mainfiest I have this code

    <intent-filter>
        <action android:name="android.intent.action.VIEW" />

        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />

        <data
            android:host="www.example.com"
            android:path="/aboutus"
            android:scheme="http" />

    </intent-filter>

Follow this steps to get it working my deep linking is working https://developer.android.com/studio/write/app-link-indexing.html

Answer 2

Say, if you are running flask server in production with nginx and gunicorn, then this assetlinks.json file will not be serve by your flask app or gunicorn software. This file must have to be served by nginx.

For this you have to make following change in your nginx configuration file:

location /.well-known {
    default_type "text/plain";
    alias /home/user/project/app/.well-known;
}

You will make change here:

server {
server_name www.example.com example.com;

location /static {
    alias /home/user/project/app/static;
}
#################EDITED PORTION START################
location /.well-known {
    default_type "text/plain";
    alias /home/user/project/app/.well-known;
}
#################EDITED PORTION END################
location / {
    proxy_pass http://localhost:8000;
    include /etc/nginx/proxy_params;
    proxy_redirect off;
}

listen 443 ssl; # managed by Certbot
ssl_certificate 
 /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
 ssl_certificate_key 
 /etc/letsencrypt/live/example.com.bd/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

Answer 3

Somewhat older already, but hopefully still relevant. I came across the same issue today and figured out that the problem is with the .well-known folder. Depending on how you set up the Let's Encrypt SSL certificate, it is very likely you have an alias now on your server that points .well-known to the folder /var/www/html/.well-known on your server. That's also where you will have to place you assetlinks.json file. Copying the file there fixed the issue for me.

Note however, this may well pose problems down the road if you have multiple domains on your server and if you have the need to link apps to different domains. I do not know if you can have different assetlinks.json files in this set up.

Answer 4

I have this problem too when I use Android Studio 2.3.

One of Let's encrypt Certificate root CA is "DST Root CA X3", So you can check if your root CA for Let's encrypt is it.

When I use wireshark capture the ssl packets, It shows that "Certificate unknown". So I think Android Stuido 2.3 not include "DST Root CA X3" in it root CA list.

So, you'd better try another certificate that published by other root CA.