I have the same problem about automatic renovations, but in my case the answer has been that the URL for the main page of the domain is redirected, which shouldn't be. Doesn't matter if the specific URL for the file ../apple-developer-merchantid-domain-association.txt isn't redirected, if the main page / is then it fails. I've given up. At least now the manual renovation it's every 9 months instead of just 3.

Same problem here, and I confirm the URL (ie https://yourdomain.com/.well-known/apple-developer-merchantid-domain-association) works and the SSL is always renewed 2 months before its expiration.