Posting this here because I lost way too many hours on it and hopefully someone finds this before going down the same rabbit hole. Apple Support's support was basically asking me to check the docs and this forum for solutions. I guess it's better than saying "google it yourself", but not much better ;)
The issue was that Apple Pay merchant domain verification kept failing, both automated and manual.
I checked pretty much everything:
domain association file
HTTPS
DNS
TLS
App Service configuration
Merchant ID
openssl verification
The interesting part was that everything looked perfectly healthy. Browsers were happy, OpenSSL reported Verify return code: 0 (ok), and there were no TLS errors.
Turned out the problem was Apple's verification mechanism incompatibility with the new Generation Y cert chain, which is used as default by Let's Encrypt.
My site was using a Let’s Encrypt ECDSA certificate with this chain:
→ YE1
→ Root YE
→ ISRG Root X2
I reissued it as RSA (still Let’s Encrypt), which resulted in:
→ YR2
→ Root YR
→ ISRG Root X1
Apple Pay domain verification started working immediately.
If you’re using Certbot:
sudo certbot certonly
--manual
--preferred-challenges http
--key-type rsa
--rsa-key-size 2048
--force-renewal
--cert-name yourdomain.com
-d yourdomain.com
I don’t know whether Apple Pay currently has an issue with Let’s Encrypt’s newer Generation Y ECDSA hierarchy, or whether something in their merchant validation infrastructure doesn’t like that chain.
If you’ve already checked the usual stuff and everything looks correct, this is definitely worth trying before spending another day debugging.
0
0
465