iOS app fails second access to secure server - ios

Question

We have an iOS app that reads information from our secure web server. Everything was working great until my friend moved back to the US. Now his phone only downloads data the first time after the app run for the first time after installation or after he switches from phone data to wifi. The app works perfectly every time for me and I'm outside the US (as it did for him before he moved to the US). His relatives have reported the same issue.
Both of us have an iPhone 6 running iOS 10.2. I've got the development code but he's not a developer and doesn't have a macbook so I cant debug his phone directly. I've downloaded the app from Test Flight to make sure I've got the same binary.
(FYI: I did fix an issue with an old self-signed certificate being left behind on the server that caused him issues with SSL failures. I have no TLS/networking info.plist entries in the app other than Non-Exempt Encryption = No.)
Our server is hosted in the US and runs Apache 2.4.18 with PHP and has a commercial certificate. I've run various certificate testers and they all say the certificate works perfectly (even before I added Forwarding Secrecy). I've cranked up the Apache logs to "trace6" to see what the SSL is doing but his second attempts to access the server (almost) never logs anything in the site access.log or error.log.
Occasionally he will get this in the Apache site error.log on his second attempts in the app (I've done a little redacting):
[Sun Jan 29 18:27:48.129214 2017] [ssl:info] [pid 6690] [client 70.211.19.XXX:8740] AH01964: Connection to child 8 established (server (redacted).net:443)
[Sun Jan 29 18:27:48.129312 2017] [ssl:trace2] [pid 6690] ssl_engine_rand.c(126): Seeding PRNG with 656 bytes of entropy
[Sun Jan 29 18:27:48.129354 2017] [ssl:trace3] [pid 6690] ssl_engine_kernel.c(1970): [client 70.211.19.XXX:8740] OpenSSL: Handshake: start
[Sun Jan 29 18:27:48.129365 2017] [ssl:trace3] [pid 6690] ssl_engine_kernel.c(1979): [client 70.211.19.XXX:8740] OpenSSL: Loop: before/accept initialization
[Sun Jan 29 18:27:48.129376 2017] [ssl:trace4] [pid 6690] ssl_engine_io.c(2065): [client 70.211.19.XXX:8740] OpenSSL: I/O error, 11 bytes expected to read on BIO#5566ac3b3e20 [mem: 5566ac3ef790]
[Sun Jan 29 18:27:48.129380 2017] [ssl:trace3] [pid 6690] ssl_engine_kernel.c(2008): [client 70.211.19.XXX:8740] OpenSSL: Exit: error in SSLv2/v3 read client hello A
[Sun Jan 29 18:27:48.129385 2017] [ssl:debug] [pid 6690] ssl_engine_io.c(1227): (70014)End of file found: [client 70.211.19.XXX:8740] AH02007: SSL handshake interrupted by system [Hint: Stop button pressed in browser?!]
[Sun Jan 29 18:27:48.129390 2017] [ssl:info] [pid 6690] [client 70.211.19.XXX:8740] AH01998: Connection closed to child 8 with abortive shutdown (server (redacted).net:443)
One concern here is the line with "OpenSSL: Exit: error in SSLv2/v3 read client hello A". TLS 1.2 is on the server, of course, and SSLv3 is disabled - as I believe it should be.
As a test I created a test app to test DNS, HTTP and HTTPS and he gets 404 errors only on the https pages. I can access any page from my phone as often as I like - at exactly the same time he gets 404s. I then get him to access https:\\www.google.com and it works every time for him. He then tries our server and ... instant 404 and nothing in the server logs.
I repeat - I never have any problems at all. Same phone, same iOS, same binary.
Has anyone come across anything like this before?
EDIT: Updated the scenario and correct some information that wasn't quite right.

Answer 1

I found my issue and it's a little embarrassing but if this helps someone else then here goes. The 404 was trying to tell me something.
In my country all the ISPs are still running IPv4. My friend moved to the US and everything over there is IPv6. Basically, by accident I hadn't setup Apache to point the IPv6/SSL config to the same "HTML" directory as IPv4/SSL - hence the 404s for him and not for me. However IPv6 on port 80 was configured correctly. I couldn't test IPv6 because it's not available to me.
I figured it out after using wget on the server. I could get a hit on the index.html page but nothing else. I found an extra "html" directory and hence the IPv6 config that pointed to it. There was nothing in the logs because they were the wrong logs (rolls eyes and feels like a noob).
I had tried an IPv6 proxy page but, as it turns out, it's broken. Even after I fixed my site and the app works on IPv6 the proxy site still gives SSL errors. It might be using an outdated protocol that I've banned. Quite the red herring.