SSL issue for specific user

Hi Team

We are facing a problem in our app for one particular user the url session is giving below error. Rest for all the users its working fine. Below is the complete error we get from user device.

{"type":"video_player","error":"Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSErrorFailingURLStringKey=https://api.vimeo.com/videos/1020892798, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask .<4>, _NSURLErrorRelatedURLSessionTaskErrorKey=(\n "LocalDataTask .<4>"\n), NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSErrorFailingURLKey=https://api.vimeo.com/videos/1020892798, NSUnderlyingError=0x301ea8930 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, _kCFNetworkCFStreamSSLErrorOriginalValue=-9836, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9836, _NSURLErrorNWPathKey=satisfied (Path is satisfied), viable, interface: pdp_ip0, ipv6, dns, expensive, uses cell}}, _kCFStreamErrorCodeKey=-9836}"}

Device info device_type iOS device_os_version 18.1.1 device_model iPhone 11

Please let me know how we can resolve for one particular user. Or what we can adivse.

Answered by DTS Engineer in 816371022

Buried in that error log is the -9836 error code, which stands for errSSLPeerProtocolVersion. That suggests that the remote peer is using a TLS version that’s not supported by iOS. It’s unlikely to be too new, because the TLS negotiation would then fall back to a version that iOS supports. That means it’s probably too old.

Given that this only affects one specific user, you know that the server itself is just fine. That suggests that there’s some middlebox causing problems. Or possibly the user has configured their device in a weird way, for example, installed an Network Extension configuration that’s messing with this connection.

Regardless, it’s going to be hard for you to debug this on their behalf. If I were in their shoes, I’d do the following:

  • Make sure that all NE configurations are disabled.

  • If the error shows up on Wi-Fi, try WWAN, or vice versa.

  • Or try on a different Wi-Fi. For example, if you see the problem at home, try it at work, or vice versa. Or visit a local coffee shop.

  • Try it with a newly erased device in the problematic environment. If you only have one device, back that up your device, erase it, run the test, and then restore from the backup.

But, yeah, all of this is user-level debugging rather than the code-level debugging that DTS specialises in.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Buried in that error log is the -9836 error code, which stands for errSSLPeerProtocolVersion. That suggests that the remote peer is using a TLS version that’s not supported by iOS. It’s unlikely to be too new, because the TLS negotiation would then fall back to a version that iOS supports. That means it’s probably too old.

Given that this only affects one specific user, you know that the server itself is just fine. That suggests that there’s some middlebox causing problems. Or possibly the user has configured their device in a weird way, for example, installed an Network Extension configuration that’s messing with this connection.

Regardless, it’s going to be hard for you to debug this on their behalf. If I were in their shoes, I’d do the following:

  • Make sure that all NE configurations are disabled.

  • If the error shows up on Wi-Fi, try WWAN, or vice versa.

  • Or try on a different Wi-Fi. For example, if you see the problem at home, try it at work, or vice versa. Or visit a local coffee shop.

  • Try it with a newly erased device in the problematic environment. If you only have one device, back that up your device, erase it, run the test, and then restore from the backup.

But, yeah, all of this is user-level debugging rather than the code-level debugging that DTS specialises in.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

SSL issue for specific user
 
 
Q