Hi Albert, Thanks for your reply. Is there any way we can meet over a call with you or some technical team, who can help us resolve the issue ?

Dear Albert, We verified the firewall policy for the AASA file and it is open for all geo locations and all IP's However, we have observed that the dynamic links is accessible from the USA, but it is not accessible from Oman or nearby countries. Could you please investigate this issue and let us know why access is failing from these regions? If any geo-restrictions, routing issues, CDN, or upstream filtering are involved, kindly share your findings. if possible, can we also get in a meeting together to resolve this issue ?

Hi Albert, Thanks for the reply. The domain “app.ooredoo.om” is currently configured to allow access from all geographic locations and all IP addresses on the Ooredoo WAF. However, we have observed that the application is accessible from the USA, but it is not accessible from Oman or nearby countries. Could you please investigate this issue and let us know why access is failing from these regions? If any geo-restrictions, routing issues, CDN, or upstream filtering are involved, kindly share your findings. if possible, can we also get in a meeting together to resolve this issue ?

Hi Albert, Thanks for the reply. It's good to see that you can see the AASA file but for us here in Oman we are not getting the same response. PFB the curl command response for apple CDN: curl -v https://app-site-association.cdn-apple.com/a/v1/app.ooredoo.om * Host app-site-association.cdn-apple.com:443 was resolved. * IPv6: 2a04:4e42:54::774 * IPv4: 199.232.83.6 * Trying 199.232.83.6:443... * Connected to app-site-association.cdn-apple.com (199.232.83.6) port 443 * ALPN: curl offers h2,http/1.1 * (304) (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/cert.pem * CApath: none * (304) (IN), TLS handshake, Server hello (2): * (304) (IN), TLS handshake, Unknown (8): * (304) (IN), TLS handshake, Certificate (11): * (304) (IN), TLS handshake, CERT verify (15): * (304) (IN), TLS handshake, Finished (20): * (304) (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF * ALPN: server accepted h2 * Server certificate: * subject: C=US; ST=California; O=Apple Inc.; CN=app-site-association.cdn-apple.com * start date: Apr 14 13:58:18 2026 GMT * expire date: Oct 20 18:52:53 2026 GMT * subjectAltName: host "app-site-association.cdn-apple.com" matched cert's "app-site-association.cdn-apple.com" * issuer: CN=Apple Public Server RSA CA 11 - G1; O=Apple Inc.; ST=California; C=US * SSL certificate verify ok. * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://app-site-association.cdn-apple.com/a/v1/app.ooredoo.om * [HTTP/2] [1] [:method: GET] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: app-site-association.cdn-apple.com] * [HTTP/2] [1] [:path: /a/v1/app.ooredoo.om] * [HTTP/2] [1] [user-agent: curl/8.7.1] * [HTTP/2] [1] [accept: */*] > GET /a/v1/app.ooredoo.om HTTP/2 > Host: app-site-association.cdn-apple.com > User-Agent: curl/8.7.1 > Accept: */* > * Request completely sent off < HTTP/2 404 < server: AppleHttpServer/963281774dffbe1fcdda324ab06683f6ca0dc21c < content-type: text/plain; charset=utf-8 < apple-failure-details: {"cause":"Connection timed out"} < apple-failure-reason: SWCERR00301 Timeout < apple-from: https://app.ooredoo.om/.well-known/apple-app-site-association < apple-try-direct: true < cache-control: max-age=3600,public < x-b3-traceid: 60e69a2af1d6b2f9 < strict-transport-security: max-age=31536000 < expires: Thu, 23 Jul 2026 18:10:14 GMT < via: http/1.1 defra2-vp-vst-004.ts.apple.com (acdn/327.16648), http/1.1 defra2-vp-vfe-007.ts.apple.com (acdn/327.16648), 1.1 varnish < cdnuuid: ef43c59e-b379-4946-9165-eb68a0f2c2e3-475851628 < accept-ranges: bytes < age: 2859 < date: Thu, 23 Jul 2026 18:57:33 GMT < x-cdn: fsly < x-served-by: cache-mrs10552-MRS < x-cache: hit-fresh, hit-fresh, MISS < x-cache-hits: 0 < x-timer: S1784833053.068870,VS0,VE67 < vary: Accept-Encoding < content-length: 10 < Not Found

Hi Albert, Thanks for the reply. It's good to see that you can see the AASA file but for us here in Oman we are not getting the same response. PFB the curl command response for apple CDN: curl -v https://app-site-association.cdn-apple.com/a/v1/app.ooredoo.om Host app-site-association.cdn-apple.com:443 was resolved. IPv6: (none) IPv4: 199.232.59.6 Trying 199.232.59.6:443... Connected to app-site-association.cdn-apple.com (199.232.59.6) port 443 ALPN: curl offers h2,http/1.1 (304) (OUT), TLS handshake, Client hello (1): CAfile: /etc/ssl/cert.pem CApath: none (304) (IN), TLS handshake, Server hello (2): (304) (IN), TLS handshake, Unknown (8): (304) (IN), TLS handshake, Certificate (11): (304) (IN), TLS handshake, CERT verify (15): (304) (IN), TLS handshake, Finished (20): (304) (OUT), TLS handshake, Finished (20): SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF ALPN: server accepted h2 Server certificate: subject: C=US; ST=California; O=Apple Inc.; CN=app-site-association.cdn-apple.com start date: Apr 14 13:58:18 2026 GMT expire date: Oct 20 18:52:53 2026 GMT subjectAltName: host "app-site-association.cdn-apple.com" matched cert's "app-site-association.cdn-apple.com" issuer: CN=Apple Public Server RSA CA 11 - G1; O=Apple Inc.; ST=California; C=US SSL certificate verify ok. using HTTP/2 [HTTP/2] [1] OPENED stream for https://app-site-association.cdn-apple.com/a/v1/app.ooredoo.om [HTTP/2] [1] [:method: GET] [HTTP/2] [1] [:scheme: https] [HTTP/2] [1] [:authority: app-site-association.cdn-apple.com] [HTTP/2] [1] [:path: /a/v1/app.ooredoo.om] [HTTP/2] [1] [user-agent: curl/8.7.1] [HTTP/2] [1] [accept: /] GET /a/v1/app.ooredoo.om HTTP/2 Host: app-site-association.cdn-apple.com User-Agent: curl/8.7.1 Accept: / Request completely sent off < HTTP/2 404 < server: AppleHttpServer/963281774dffbe1fcdda324ab06683f6ca0dc21c < content-type: text/plain; charset=utf-8 < apple-failure-details: {"cause":"Connection timed out"} < apple-failure-reason: SWCERR00301 Timeout < apple-from: https://app.ooredoo.om/.well-known/apple-app-site-association < apple-try-direct: true < cache-control: max-age=3600,public < x-b3-traceid: a48dd639226b9bc0 < strict-transport-security: max-age=31536000 < expires: Thu, 23 Jul 2026 06:09:42 GMT < via: http/1.1 defra2-vp-vst-004.ts.apple.com (acdn/327.16648), http/1.1 defra2-vp-vfe-009.ts.apple.com (acdn/327.16648), 1.1 varnish < cdnuuid: ca87fdc1-7bb0-4de4-afff-353dc6427b9d-376590154 < accept-ranges: bytes < age: 3009 < date: Thu, 23 Jul 2026 06:59:30 GMT < x-cdn: fsly < x-served-by: cache-lon420105-LON < x-cache: hit-fresh, hit-fresh, HIT < x-cache-hits: 0 < x-timer: S1784789971.537579,VS0,VE1 < vary: Accept-Encoding < content-length: 10 < Not Found is there any way to manually cache the AASA file, instead of relying on the Apple Bot.

Hi Albert, The dynamic links were working for many years for our app and now suddenly it stopped working. PFB the configuration of info.plist. This was already live and working for our previous versions of the app. The curl commands which are working and giving 200 curl -i https://app.ooredoo.om/.well-known/apple-app-site-association curl -v https://app.ooredoo.om/.well-known/apple-app-site-association curl -I https://app.ooredoo.om/.well-known/apple-app-site-association the cdn curl command returns 404: curl -v https://app-site-association.cdn-apple.com/a/v1/app.ooredoo.om

The SADDL01 is our internal please ignore that - Kindly investigate the below URLS and let us know why the Apple CDN is not caching the AASA file for our domain (app.ooredoo.om). To verify our configuration, we tested the AASA file by executing the following curl requests, and the responses appear to be as expected: Scenario 1: HTTP GET request to our domain's AASA file. curl -i https://app.ooredoo.om/.well-known/apple-app-site-association HTTP/1.1 200 Server: nginx Date: Sun, 12 Jul 2026 05:06:10 GMT Content-Type: application/json Content-Length: 434 Connection: keep-alive X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=63072000; includeSubDomains Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' Permissions-Policy: geolocation=(), camera=(), microphone=() { "applinks": { "apps": [ ], "details": [ { "appIDs": [ "ZU837R8FZZ.om.nawras.mynawras", "E2T3WF7746.com.cts.selfcare.ooredoo", "C4CVJ2YLUC.com.testNawras" ], "components": [ { "/": "/og/*", "exclude": true }, { "/": "/*" } ] } ] } } Scenario 2: HTTP HEAD request to our domain's AASA file. curl -I https://app.ooredoo.om/.well-known/apple-app-site-association HTTP/1.1 200 Server: nginx Date: Sun, 12 Jul 2026 05:29:51 GMT Content-Type: application/json Content-Length: 434 Connection: keep-alive X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=63072000; includeSubDomains Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' Permissions-Policy: geolocation=(), camera=(), microphone=() Set-Cookie: cookiesession1=678B28D2C0D04C8F3D1D3EBEA3352FAF;Expires=Mon, 12 Jul 2027 05:29:51 GMT;Path=/;HttpOnly Scenario 3: HTTP request to our domain's AASA file using verbose (-v) mode. curl -v https://app.ooredoo.om/.well-known/apple-app-site-association Host app.ooredoo.om:443 was resolved. IPv6: (none) IPv4: 10.125.120.101 Trying 10.125.120.101:443... schannel: disabled automatic use of client certificate ALPN: curl offers http/1.1 ALPN: server accepted http/1.1 Established connection to app.ooredoo.om (10.125.120.101 port 443) from 127.0.0.1 port 59690 using HTTP/1.x GET /.well-known/apple-app-site-association HTTP/1.1 Host: app.ooredoo.om User-Agent: curl/8.19.0 Accept: / Request completely sent off < HTTP/1.1 200 < Server: nginx < Date: Sun, 12 Jul 2026 12:12:46 GMT < Content-Type: application/json < Content-Length: 434 < Connection: keep-alive < X-Content-Type-Options: nosniff < X-Frame-Options: DENY < X-XSS-Protection: 1; mode=block < Strict-Transport-Security: max-age=63072000; includeSubDomains < Referrer-Policy: no-referrer < Content-Security-Policy: default-src 'self' < Permissions-Policy: geolocation=(), camera=(), microphone=() < Set-Cookie: cookiesession1=678B28D2A6B4CEA0CA982D821C182EC7;Expires=Mon, 12 Jul 2027 12:12:46 GMT;Path=/;HttpOnly < { "applinks": { "apps": [ ], "details": [ { "appIDs": [ "ZU837R8FZZ.om.nawras.mynawras", "E2T3WF7746.com.cts.selfcare.ooredoo", "C4CVJ2YLUC.com.testNawras" ], "components": [ { "/": "/og/*", "exclude": true }, { "/": "/*" } ] } ] } }* Connection #0 to host app.ooredoo.om:443 left intact Please review the issue and advise why the Apple CDN is not caching the AASA file despite the above request responses.

Kindly investigate and let us know why the Apple CDN is not caching the AASA file for our domain (app.ooredoo.om). To verify our configuration, we tested the AASA file by executing the following curl requests, and the responses appear to be as expected: curl -i http://saddlpr01/.well-known/apple-app-site-association HTTP/1.1 200 Server: nginx Date: Sun, 12 Jul 2026 05:06:10 GMT Content-Type: application/json Content-Length: 434 Connection: keep-alive X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=63072000; includeSubDomains Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' Permissions-Policy: geolocation=(), camera=(), microphone=() { "applinks": { "apps": [ ], "details": [ { "appIDs": [ "ZU837R8FZZ.om.nawras.mynawras", "E2T3WF7746.com.cts.selfcare.ooredoo", "C4CVJ2YLUC.com.testNawras" ], "components": [ { "/": "/og/*", "exclude": true }, { "/": "/*" } ] } ] } } Scenario 2: HTTP HEAD request to our domain's AASA file. url -I https://app.ooredoo.om/.well-known/apple-app-site-association HTTP/1.1 200 Server: nginx Date: Sun, 12 Jul 2026 05:29:51 GMT Content-Type: application/json Content-Length: 434 Connection: keep-alive X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=63072000; includeSubDomains Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' Permissions-Policy: geolocation=(), camera=(), microphone=() Set-Cookie: cookiesession1=678B28D2C0D04C8F3D1D3EBEA3352FAF;Expires=Mon, 12 Jul 2027 05:29:51 GMT;Path=/;HttpOnly Scenario 3: HTTP request to our domain's AASA file using verbose (-v) mode. curl -v https://app.ooredoo.om/.well-known/apple-app-site-association Host app.ooredoo.om:443 was resolved. IPv6: (none) IPv4: 10.125.120.101 Trying 10.125.120.101:443... schannel: disabled automatic use of client certificate ALPN: curl offers http/1.1 ALPN: server accepted http/1.1 Established connection to app.ooredoo.om (10.125.120.101 port 443) from 127.0.0.1 port 59690 using HTTP/1.x GET /.well-known/apple-app-site-association HTTP/1.1 Host: app.ooredoo.om User-Agent: curl/8.19.0 Accept: / Request completely sent off < HTTP/1.1 200 < Server: nginx < Date: Sun, 12 Jul 2026 12:12:46 GMT < Content-Type: application/json < Content-Length: 434 < Connection: keep-alive < X-Content-Type-Options: nosniff < X-Frame-Options: DENY < X-XSS-Protection: 1; mode=block < Strict-Transport-Security: max-age=63072000; includeSubDomains < Referrer-Policy: no-referrer < Content-Security-Policy: default-src 'self' < Permissions-Policy: geolocation=(), camera=(), microphone=() < Set-Cookie: cookiesession1=678B28D2A6B4CEA0CA982D821C182EC7;Expires=Mon, 12 Jul 2027 12:12:46 GMT;Path=/;HttpOnly < { "applinks": { "apps": [ ], "details": [ { "appIDs": [ "ZU837R8FZZ.om.nawras.mynawras", "E2T3WF7746.com.cts.selfcare.ooredoo", "C4CVJ2YLUC.com.testNawras" ], "components": [ { "/": "/og/*", "exclude": true }, { "/": "/*" } ] } ] } }* Connection #0 to host app.ooredoo.om:443 left intact Please review the issue and advise why the Apple CDN is not caching the AASA file despite the above request responses.

Hi Albert, thanks for the reply. We are still facing the Not Found error on Apple CDN. Even AASA bot has received 200 status code from our network. [root@saddlpr01 giri]# grep "apple-app-site-association" /var/log/nginx/access.log 10.125.2.254 - - [07/Jul/2026:05:00:08 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 434 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [07/Jul/2026:05:10:07 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 434 "-" "swcd (unknown version) CFNetwork/1126 Darwin/19.5.0" "-" 10.125.2.254 - - [07/Jul/2026:07:33:53 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 434 "-" "swcd (unknown version) CFNetwork/1128.0.1 Darwin/19.6.0" "-" 10.125.2.254 - - [07/Jul/2026:07:36:35 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 434 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [07/Jul/2026:08:31:30 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 434 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [07/Jul/2026:09:17:46 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 434 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.3.1 Safari/605.1.15" "-" Why is the caching still not working. Please help us here as it's causing user impact. This URL is returning 404. https://app-site-association.cdn-apple.com/a/v1/app.ooredoo.om

Hi Albert, New AASA format is live now. Please validate once at the same URL. Will the APPLE CDN face issues while caching the AASA if it's in OLD format ?

Hi Albert, URL - https://app.ooredoo.om/.well-known/apple-app-site-association is the url where we hosted AASA file. AASA BOT will access this URL. Will old format cause caching issues. We will update to the new format today. Regards,

Hi Albert, Thanks for the reply. I have informed the network team to open traffic and to not block any IP's. Still CDN returns Not found. PFB the logs which I received from network team related to AASA Bot. We are returning 200 still CDN returns not found. Can you please check the issue once and if anything is needed further from our side 10.125.2.254 - - [02/Jul/2026:03:26:16 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [02/Jul/2026:03:30:42 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [02/Jul/2026:04:17:08 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [02/Jul/2026:04:26:33 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [02/Jul/2026:07:59:35 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "swcd (unknown version) CFNetwork/1128.0.1 Darwin/19.6.0" "-" 10.125.2.254 - - [02/Jul/2026:09:30:48 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [02/Jul/2026:09:31:24 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [02/Jul/2026:09:52:14 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "swcd (unknown version) CFNetwork/1125.2 Darwin/19.4.0" "-" 10.125.2.254 - - [02/Jul/2026:10:20:02 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "AASA-Bot/1.0.0" "-" 10.125.2.254 - - [02/Jul/2026:10:42:35 +0400] "GET /.well-known/apple-app-site-association HTTP/1.1" 200 337 "-" "AASA-Bot/1.0.0" "-"

Hello team, Thanks for the reply. We have a few questions which will help us in resolving the issue. Can you please help us with the ip details from where the request is being sent. Please share the NSlookup result for the same. Thanks.

Hi Albert, Thanks for the reply when I try the same command from Oman, I am getting Not found error. What can be the reason for this ? Will caching across regions take time ? PFB the logs. madhurmohta@Mac ~ % curl -v https://app-site-association.cdn-apple.com/a/v1/app.ooredoo.om Host app-site-association.cdn-apple.com:443 was resolved. IPv6: 2a04:4e42:4b::774 IPv4: 199.232.59.6 Trying [2a04:4e42:4b::774]:443... Trying 199.232.59.6:443... Connected to app-site-association.cdn-apple.com (2a04:4e42:4b::774) port 443 ALPN: curl offers h2,http/1.1 (304) (OUT), TLS handshake, Client hello (1): CAfile: /etc/ssl/cert.pem CApath: none (304) (IN), TLS handshake, Server hello (2): (304) (IN), TLS handshake, Unknown (8): (304) (IN), TLS handshake, Certificate (11): (304) (IN), TLS handshake, CERT verify (15): (304) (IN), TLS handshake, Finished (20): (304) (OUT), TLS handshake, Finished (20): SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF ALPN: server accepted h2 Server certificate: subject: C=US; ST=California; O=Apple Inc.; CN=app-site-association.cdn-apple.com start date: Apr 14 13:58:18 2026 GMT expire date: Oct 20 18:52:53 2026 GMT subjectAltName: host "app-site-association.cdn-apple.com" matched cert's "app-site-association.cdn-apple.com" issuer: CN=Apple Public Server RSA CA 11 - G1; O=Apple Inc.; ST=California; C=US SSL certificate verify ok. using HTTP/2 [HTTP/2] [1] OPENED stream for https://app-site-association.cdn-apple.com/a/v1/app.ooredoo.om [HTTP/2] [1] [:method: GET] [HTTP/2] [1] [:scheme: https] [HTTP/2] [1] [:authority: app-site-association.cdn-apple.com] [HTTP/2] [1] [:path: /a/v1/app.ooredoo.om] [HTTP/2] [1] [user-agent: curl/8.7.1] [HTTP/2] [1] [accept: /] GET /a/v1/app.ooredoo.om HTTP/2 Host: app-site-association.cdn-apple.com User-Agent: curl/8.7.1 Accept: / Request completely sent off < HTTP/2 404 < server: AppleHttpServer/eb904970583abcdbe15e2c72bed201585ca041bc < content-type: text/plain; charset=utf-8 < apple-failure-details: {"cause":"Connection timed out"} < apple-failure-reason: SWCERR00301 Timeout < apple-from: https://app.ooredoo.om/.well-known/apple-app-site-association < apple-try-direct: true < cache-control: max-age=3600,public < x-b3-traceid: 0fd6691326c8dcf3 < strict-transport-security: max-age=31536000 < expires: Wed, 24 Jun 2026 05:02:07 GMT < via: http/1.1 defra2-vp-vst-004.ts.apple.com (acdn/302.16436), http/1.1 defra2-vp-vfe-020.ts.apple.com (acdn/302.16436), 1.1 varnish < cdnuuid: 3f1f8d26-281a-482c-92a1-2f25283a43da-593319714 < accept-ranges: bytes < age: 747 < date: Wed, 24 Jun 2026 05:14:14 GMT < x-cdn: fsly < x-served-by: cache-lon4252-LON < x-cache: hit-fresh, hit-fresh, MISS < x-cache-hits: 0 < x-timer: S1782278055.885982,VS0,VE39 < vary: Accept-Encoding < content-length: 10 < Not Found Connection #0 to host app-site-association.cdn-apple.com left intact