配置App与网站的Universal Link时，AASA文件是否需使用HTTPS？

Hey there, this is a super important detail when rolling out Universal Links, so I’m glad you’re seeking definitive confirmation instead of relying on unofficial sources.

To cut straight to the point: Yes, Apple requires that requests for the apple-app-site-association (AASA) file are made over HTTPS—and this isn’t just a recommendation, it’s a hard requirement outlined in Apple’s official Universal Links documentation.

Here’s the breakdown of the key rules from Apple’s guidelines:

• The domain hosting your Universal Links must be secured with HTTPS (no HTTP allowed for production environments).
• The AASA file must be accessible at https://<your-domain>/.well-known/apple-app-site-association (or directly at the root domain, but the .well-known path is the standard now).
• Your server must return the AASA file with a valid, trusted SSL certificate (self-signed certificates won’t work for production; you’ll need a certificate from a recognized certificate authority).
• Apple’s crawler will not follow HTTP redirects to fetch the AASA file—so it needs to be directly accessible via HTTPS without any redirect hops.

The reason behind this strict requirement is security: Universal Links allow your app to handle web links directly, so Apple needs to ensure that the AASA file (which maps links to your app) hasn’t been tampered with during transit. HTTPS encrypts the connection, preventing man-in-the-middle attacks and ensuring the file Apple fetches is exactly the one you published.

For development testing, you might get away with using localhost (since it’s considered a secure context by Apple’s tools), but once you’re ready to deploy to production or test with real devices over a network, HTTPS is non-negotiable.

If your current website is on HTTP, your first step will be migrating it to HTTPS (getting a valid SSL certificate, updating server configurations, etc.) before you can successfully set up Universal Links.

Hope this clears up any confusion—feel free to ask if you have follow-up questions about the migration or AASA file setup!

内容的提问来源于stack exchange，提问作者LampPost