title: iOS9 NSAppTransportSecurity with s3.amazon.com
body: <p>I'm testing an app in iOS9 and getting SSL errors with ATS loading images from amazon.com.  All my stuff is being delivered over https but I'm still having issues.</p>
  
  <p>I've added the correct ATS keys (worked on another app).</p>
  
  <pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
  &lt;dict&gt;
      &lt;key&gt;NSExceptionDomains&lt;/key&gt;
      &lt;dict&gt;
          &lt;key&gt;amazonaws.com&lt;/key&gt;
          &lt;dict&gt;
              &lt;key&gt;NSExceptionRequiresForwardSecrecy&lt;/key&gt;
              &lt;false/&gt;
              &lt;key&gt;NSIncludesSubdomains&lt;/key&gt;
              &lt;true/&gt;
          &lt;/dict&gt;
      &lt;/dict&gt;
  &lt;/dict&gt;
  </code></pre>
  
  <p>I've been all over the forums, adc, and SO and I'm not having any luck.</p>
  
  <p>I've tried removing ATS entirely, and I still get the same error.</p>
  
  <pre><code>&lt;key&gt;NSAppTransportSecurity&lt;/key&gt;
  &lt;dict&gt;
      &lt;key&gt;NSAllowsArbitraryLoads&lt;/key&gt;
      &lt;true/&gt;
  &lt;/dict&gt;
  </code></pre>
  
  <p>Error: </p>
  
  <blockquote>
    <p>NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)
    Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSURLErrorFailingURLPeerTrustErrorKey=, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9802, NSErrorPeerCertificateChainKey={type = immutable, count = 3, values = (
        0 : 
        1 : 
        2 : 
    )}, NSUnderlyingError=0x7ffe70e2c690 {Error Domain=kCFErrorDomainCFNetwork Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSErrorFailingURLStringKey=<a href="https://redacted.s3.amazonaws.com/14B78421-84F1-48D1-A8F4-73B688102EE7-21502-00003598C1B6C883_thumbnail.jpg" rel="nofollow">https://redacted.s3.amazonaws.com/14B78421-84F1-48D1-A8F4-73B688102EE7-21502-00003598C1B6C883_thumbnail.jpg</a>, NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFNetworkCFStreamSSLErrorOriginalValue=-9802, kCFStreamPropertySSLPeerCertificates={type = immutable, count = 3, values = (
        0 : 
        1 : 
        2 : 
    )}, _kCFStreamPropertySSLClientCertificateState=0, kCFStreamPropertySSLPeerTrust=, NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., _kCFStreamErrorDomainKey=3, NSErrorFailingURLKey=<a href="https://redacted.s3.amazonaws.com/14B78421-84F1-48D1-A8F4-73B688102EE7-21502-00003598C1B6C883_thumbnail.jpg" rel="nofollow">https://redacted.s3.amazonaws.com/14B78421-84F1-48D1-A8F4-73B688102EE7-21502-00003598C1B6C883_thumbnail.jpg</a>, _kCFStreamErrorCodeKey=-9802}}, NSLocalizedDescription=An SSL error has occurred and a secure connection to the server cannot be made., NSErrorFailingURLKey=<a href="https://redacted.s3.amazonaws.com/14B78421-84F1-48D1-A8F4-73B688102EE7-21502-00003598C1B6C883_thumbnail.jpg" rel="nofollow">https://redacted.s3.amazonaws.com/14B78421-84F1-48D1-A8F4-73B688102EE7-21502-00003598C1B6C883_thumbnail.jpg</a>, NSErrorFailingURLStringKey=<a href="https://redacted.s3.amazonaws.com/14B78421-84F1-48D1-A8F4-73B688102EE7-21502-00003598C1B6C883_thumbnail.jpg" rel="nofollow">https://redacted.s3.amazonaws.com/14B78421-84F1-48D1-A8F4-73B688102EE7-21502-00003598C1B6C883_thumbnail.jpg</a>, NSErrorClientCertificateStateKey=0}</p>
  </blockquote>
  
  <p>Static files: AWS Amazon<br>
  Host: Heroku<br>
  Backend: Django<br>
  APIs: Django Rest Framework </p>
  
  <p>I've tried every configuration I could find on ATS, cleaned/reset/rebuilt, modified the Django requests (originally they included querystring authentication), etc.  I'm stumped on this and blocked.</p>