Merchant validation fails in Local PC and ngrok

[sampathbillava]

Expected behaviour

Must get a token from apple pay (Which has to be decrypted for payment)

Actual behaviour

I get the following error (in Local)
System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
---> System.ComponentModel.Win32Exception: The credentials supplied to the package were not recognized

Error comes on the following line:
merchantSession = await _ApplePayServieBusiness.GetMerchantSessionAsync(requestUri, request, cancellationToken);

request URi -> https://apple-pay-gateway-cert.apple.com/paymentservices/startSession
DisplayName -> "Store Name"
Initiative -> "web"
InitiativeContext -> tried local host and also hard coded the domain "www.services.something.ae"
MerchantIdentifier -> F**************************************************************D
PFX file is present in the project root and apple-developer-merchantid-domain-association is present in .wellKnow folder

Steps to reproduce

I have tested in 2 different ways:

1. Debugged in local PC. I got an apple pay button(due to polyfill). On click of the button i get the above mentioned error. (Maybe because of local host?)
2. I have used ngrok to host the application. Accessed the URL from an iPhone. I am getting the button. On click of the button, the sheet is displayed but it just show processing and fails.
   

Please not the I tried with Sand-Box test account. I get error like this "this website does not accept Visa".

Any help on why i am getting these issues or a suggestion on how apple pay has to be tested would be great.

Thanks!

[martincostello]

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
---> System.ComponentModel.Win32Exception: The credentials supplied to the package were not recognized

This error suggests to me that your PFX file is incorrect in some way or the SSL/TLS protocols on your machine aren't compatible with the Apple Pay servers. For example, this commented-out line of code exists for older Windows Server operating systems:

https://github.com/justeat/ApplePayJSSample/blob/d8931f017638d57c9a3484e0d96a4d41f538aef1/src/ApplePayJS/Startup.cs#L68-L71

I'm not familiar with ngrok, but maybe it needs additional configuration to be able to use PFX certificates similar to how Azure App Service does.

[sampathbillava]

Thank you for the quick reply.
I have done the following step for testing today (In my local machine, using polyfill).

1. I have moved all the controller related code to a separate API project.
2. I have created an ngrok URL for this API
3. The request was as follows: Request URI -> https://apple-pay-gateway-cert.apple.com/paymentservices/startSession, DisplayName -> "Store Name", Initiative -> "web", InitiativeContext -> LocalHost and MerchantIdentifier -> F**************************************************************D
4. I was able to get an OK status in this line :
   var response = await _httpClient.PostAsync(requestUri, content, cancellationToken);
   

Once i was successfully getting a response, I tried the following steps:

1. Created an ngrok URL for the front end (please remember that the controller logic is in the new API project and using a diffrent ngrok URL)
2. I accessed the front end ngrok URL from an Iphone.
3. All parameters were same except for the validation URL which was https://apple-pay-gateway.apple.com/paymentservices/startSession
4. Here I get a bad request error (400 status code)
   

Do you have any idea on what is creating an this error?

[martincostello]

My guess would be that one of the hosts is the Apple Pay test/sandbox infrastructure (the cert one maybe?) and the other is the production infrastructure.

Are you mixing and matching test/sandbox and production infrastructure maybe?

This looks like more of a configuration issue than an issue with the sample code, so I'm not sure I can help you any further.

[tlatforlz]

I got the same issue and don't know how to fix it 😂

[sampathbillava]

Sorry for the late response. I was trying to fix the issue. Here are the steps that I used to get a 200 response in ValidateMerchant method.

Rather than using the "Load from disk method", i used "Load from Store". This seems to fix the issue.
You can find the steps here for ading your .pfx to MMC.

Debugging in Local:
Just by switching to the other method, i was able to get a 200 response for https://apple-pay-gateway-cert.apple.com/paymentservices/startSession

Next, i moved the code to IIS server:
I had previously mentioned that I had created 2 separate ngrok URL for front-end and the controller API. I hosted the web API part in the IIS server and registered the domain in the the Apple Pay account. (the apple-developer-merchantid-domain-association.txt file should be accessible from the browser. i.e when https://<hostname.com>/.well-known/apple-developer-merchantid-domain-association.txt is hit in the browser, it should display the txt file). The domain will be shown as Verified in the Apple pay portal. Please provide the necessary permission to IIS as specified here

Now I used the ngrok URL that i had used for the front end to hit the hosted API.
I got a 200 response here too for https://apple-pay-gateway.apple.com/paymentservices/startSession validation URL.

I am getting the ajax response and session.completeMerchantValidation(merchantSession) is hit in site.js.
However, session.onpaymentauthorized function is not called.

The ApplePaySession initialization is not changed in the code. The PaymentRequest and initialization is as follows:

var paymentRequest = {
                applicationData: btoa("Custom application-specific data"),
                countryCode: countryCode,
                currencyCode: currencyCode,
                merchantCapabilities: ["supports3DS"],
                supportedNetworks: ["amex", "masterCard", "visa"],
                lineItems: lineItemsForDelivery,
                total: totalForDelivery,
                requiredBillingContactFields: ["email", "name", "phone", "postalAddress"],
                requiredShippingContactFields: ["email", "name", "phone", "postalAddress"],
                shippingType: "delivery",
                shippingMethods: [
                    { label: "Delivery", amount: delivery, identifier: "delivery", detail: "Delivery to you" },
                    { label: "Collection", amount: "0.00", identifier: "collection", detail: "Collect from the store" }
                ],
                supportedCountries: [countryCode]
            };
var session = new ApplePaySession(10, paymentRequest);

Have i done any mistake in initializing the Session? What could be the possible reason for the function session.onpaymentauthorized not being hit?

[martincostello]

Regarding IIS, that sounds similar to the set up for Azure App Service mentioned here in the README.

Your payment request looks correct - maybe it's a configuration issue? Are you getting any details from the Apple Pay JS APIs in the browser error console?

I have the exact code from this repo deployed to Azure App Service for test purposes, and it works as expected so I'm not sure what it could be if it's a code issue with what's here.

[tlatforlz]

Hi @sampathbillava , In ValidateMerchant request to Apple from Server,
The initiativeContext value should be your <hostname.com> not include https.

I got the same issue with you, the session.onpaymentauthorized not being hit, so I try to change initiativeContext, it's working well.
Hope this helps.

[sampathbillava]

@tlatforlz I can confirm that the validation method is working fine, because I am getting a response with 200 status code in merchant validation method and the host name does not contain https.

@martincostello As suggested by you I will check the console error.
As I have split the application into 2 (front-end and API project), now only the API project's domain is verified in the Apple pay portal. Do I have to verify the front end project too? Does the apple pay session creation depend on that?

[martincostello]

I believe that only the front-end needs to be verified with regards to the domain. It also needs to have a TLS certificate that meets Apple requirements. I'm sure yours does, but might be worth double-checking against their documentation.

[tlatforlz]

When you got the response 200 when validating it doesn't mean you put the correct request. You can try to payment, check the source, and request/respond at https://applepaydemo.apple.com/ Vào Th 5, 11 thg 3, 2021 vào lúc 11:49 sampathbillava < notifications@github.com> đã viết:

…

@tlatforlz <https://github.com/tlatforlz> I can confirm that the validation method is working fine, because I am getting a response with 200 status code in merchant validation method and the host name does not contain https. @martincostello <https://github.com/martincostello> As suggested by you I will check the console error. As I have split the application into 2 (front-end and API project), now only the API project's domain is verified in the Apple pay portal. Do I have to verify the front end project too? Does the apple pay session creation depend on that? [image: image] <https://user-images.githubusercontent.com/79622585/110737322-2afc3400-8253-11eb-8b35-7bbe560cba5d.png> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#68 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGM3SGW6XZKQ5SQB6FGMKDTDBDW7ANCNFSM4YF3LUQA> .

-- Thanks.

[sampathbillava]

So to hit session.onpaymentauthorized, should my data be as follows?

Certificate friendly name is -> Apple Pay Merchant Identity:merchant.ae.[sub].[maindomain]
Then the domain in the Merchant Session Root element should be as follows
ValueKind = Object : "{"epochTimestamp":1XX5477XX81XX,"expiresAt":1XX54XX92XXXX,"merchantSessionIdentifier":"XXXXXXXXXXXX80C4XXXXXXXXXX673926C12_XXXXXXXXXX1343F5BC5815EXXXXXXXXXXFFDC1XXXXXXXXXX5A943FXXXXXXXXXX","nonce":"6XXXXXX0","merchantIdentifier":"XXXXXXXXXX70A2C52D0XXXXXXXXXX4A918XXXXXXXXXX2C6A1B37BXXXXXXXXXX","domainName":"[maindomain].[sub].ae","displayName":"XXXX","signature":"...LongSignature...","operationalAnalyticsIdentifier":"XXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","retries":0}"

This domain should be present in the Apple pay portal -> ae.[sub].[maindomain]

And finally, my front end project should be hosted the following domain
[maindomain].[sub].ae

Is my assumption correct?

[stale]

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

Closed automatically due to inactivity.