NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802) in iOS 9? - objective-c

Question

I know this question is previously asked! But none of the solutions seems to work for me. I'm getting this error while playing an audio file via url.
Note: Server has been upgraded according to the Apple ATS and using https://. All the network call are updated (AFNetworking 3.0) to use and compatible to iOS 9. No work around have been made as handling exception in plist (see below).
I had to play video/audio file from below code snippet which throwing this error. NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)
How app play video/audio file:
//This is https url:
self.movieController = [[MPMoviePlayerController alloc] initWithContentURL:[NSURL URLWithString:self.browserMediaItem.mediaItem.media_item_hd_url]];
self.movieController.movieSourceType = MPMovieSourceTypeFile;
[self.movieController prepareToPlay];
[self.movieController.view setFrame:_photoImageView.frame];
[self addSubview:self.movieController.view];
[self.movieController play];
If I added <key>NSAllowsArbitraryLoads</key> line in the plist, it gives below error.
NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9843)
Here is my .plist file:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>en</string>
<key>CFBundleDisplayName</key>
<string>AppName</string>
<key>CFBundleExecutable</key>
<string>${EXECUTABLE_NAME}</string>
<key>CFBundleIdentifier</key>
<string>domain.com</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>${PRODUCT_NAME}</string>
<key>CFBundlePackageType</key>
<string>APPL</string>
<key>CFBundleShortVersionString</key>
<string>2.2.2</string>
<key>CFBundleSignature</key>
<string>????</string>
<key>CFBundleVersion</key>
<string>73</string>
<key>LSRequiresIPhoneOS</key>
<true/>
<key>UIAppFonts</key>
<array>
<string>OpenSans-Italic.ttf</string>
<string>FontAwesome.ttf</string>
<string>OpenSans-Semibold.ttf</string>
<string>OpenSans-Bold.ttf</string>
<string>OpenSans-Regular.ttf</string>
<string>OpenSans-Light.ttf</string>
</array>
<key>UIMainStoryboardFile</key>
<string>Main_iPhone</string>
<key>UIMainStoryboardFile~ipad</key>
<string>Main_iPad</string>
<key>UIRequiredDeviceCapabilities</key>
<array>
<string>armv7</string>
</array>
<key>UIStatusBarHidden</key>
<false/>
<key>UIStatusBarStyle</key>
<string>UIStatusBarStyleBlackTranslucent</string>
<key>UISupportedInterfaceOrientations</key>
<array>
<string>UIInterfaceOrientationPortrait</string>
</array>
<key>UISupportedInterfaceOrientations~ipad</key>
<array>
<string>UIInterfaceOrientationPortrait</string>
</array>
<key>UIViewControllerBasedStatusBarAppearance</key>
<false/>
<key>UIViewEdgeAntialiasing</key>
<true/>
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
</dict>
</dict>
</plist>
Edited:
Output of curl -v your_url:
* Trying 40.146.243.53...
* Connected to t-mobi.name.school.nz (40.146.243.53) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: *.name.school.nz
* Server certificate: COMODO RSA Domain Validation Secure Server CA
* Server certificate: COMODO RSA Certification Authority
* Server certificate: AddTrust External CA Root
> GET /api/v2/users/bW9iaWxldGVzdA==/galleries/197/audios/27 HTTP/1.1
> Host: t-mobi.name.school.nz
> User-Agent: curl/7.43.0
> Accept: */*
>
< HTTP/1.1 302 Found
< Cache-Control: no-cache
< Pragma: no-cache
< Expires: -1
< Location: https://t.azure.name.school.nz//DataStore/Users/test/uSpace/Audio/mp3/0b27c797-5.mp3
< Server: Microsoft-IIS/8.5
< X-AspNet-Version: 4.0.30319
< X-Powered-By: ASP.NET
< Date: Mon, 22 Feb 2016 18:33:16 GMT
< Content-Length: 0
<
* Connection #0 to host t-mobi.name.school.nz left intact
Out put for : openssl s_client -connect your_host:your_port -showcerts:(i.e. openssl s_client -connect t-mobi.name.school.nz:443 -showcerts)
CONNECTED(00000003)
709:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59/src/ssl/s23_clnt.c:593:
Output for curl -vL url:
* Trying 40.146.243.53...
* Connected to t-mobi.name.school.nz (40.146.243.53) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: *.name.school.nz
* Server certificate: COMODO RSA Domain Validation Secure Server CA
* Server certificate: COMODO RSA Certification Authority
* Server certificate: AddTrust External CA Root
> GET /api/v2/users/bW9iaWxldGVzdA==/galleries/197/audios/27 HTTP/1.1
> Host: t-mobi.name.school.nz
> User-Agent: curl/7.43.0
> Accept: */*
>
< HTTP/1.1 302 Found
< Cache-Control: no-cache
< Pragma: no-cache
< Expires: -1
< Location: https://t.name.school.nz//DataStore/Users/mobiletest/uSpace/Audio/mp3/0b27c797-5.mp3
< Server: Microsoft-IIS/8.5
< X-AspNet-Version: 4.0.30319
< X-Powered-By: ASP.NET
< Date: Tue, 23 Feb 2016 03:50:12 GMT
< Content-Length: 0
<
* Connection #0 to host t-mobi.name.school.nz left intact
* Issue another request to this URL: 'https://t.name.school.nz//DataStore/Users/mobiletest/uSpace/Audio/mp3/0b27c797-5.mp3'
* Trying 40.146.243.53...
* Connected to t.name.school.nz (40.146.243.53) port 443 (#1)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: *.name.school.nz
* Server certificate: COMODO RSA Domain Validation Secure Server CA
* Server certificate: COMODO RSA Certification Authority
* Server certificate: AddTrust External CA Root
> GET //DataStore/Users/mobiletest/uSpace/Audio/mp3/0b27c797-5.mp3 HTTP/1.1
> Host: t.name.school.nz
> User-Agent: curl/7.43.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Cache-Control: public,max-age=1209601
< Content-Type: audio/mpeg
< Last-Modified: Fri, 19 Feb 2016 02:22:53 GMT
< Accept-Ranges: bytes
< ETag: "fb7d26fbc6ad11:0"
< Server: Microsoft-IIS/8.5
< X-Powered-By: ASP.NET
< Date: Tue, 23 Feb 2016 03:50:16 GMT
< Content-Length: 2593081
<
ID36TIT2 1rack10TSSELavf55.14.101????Info
'??...
Output for whereis openssl:
/usr/bin/openssl
Output for openssl version:
OpenSSL 0.9.8zg 14 July 2015