Apple docs says:
To specify an icon for the entire website (every page on the website), place an icon file in PNG format in the root document folder called apple-touch-icon.png
So file in ICO format definitely won't work.
It's at least using Open Graph and Twitter Card.
<meta property="og:image" content="https://www.j-26.com/assets/facebook.jpg"/>
<meta property="og:image" content="https://www.j-26.com/assets/twitter.jpg"/>
I tested this page using Twitter Card and Open graph and iOS ...
AHHH! Finally found it, with much Googling. This feature is called "Instant Articles"
That site contains a description of this feature and a video about it. Hope this helps someone else!
Found the reason on the Apple website:
The reason is not the CA, but the certificate itself:
Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore field of the certificate) must follow these guidelines:
TLS server certificates must contain an ExtendedKeyUsage (EKU) ...
I imagine that your publishing company's server must have some sort of iOS detection and that when it detects that the user is on iOS it returns that message. If that is the case and it most likely is, you should try to resolve this issue with your publishing company.
In the event that your publishing company can't fix this iOS detection issue, you could ...
Apple doesn't require the server to be reachable over IPv6 (yet). They do however require your app to work on an IPv6-only network with NAT64 and DNS64. The NAT64 service will make IPv4-only servers reachable.
They require this because more and more networks deploy this model of connectivity, and they don't want their users to have bad experiences. If you ...