ios9 HTTP load failed kCFStreamErrorDomainSSL (-9802) - ios

Question

I have an issue that appeared recently.
In my code, I load some images from an HTTP server:
let urlPicture = "http://images.mydomain.com/" + self.currentUser.pic
imageView.sd_setImageWithURL(NSURL(string: urlPicture))
I do not use HTTPS for my images server because I guess it would have been too slow, but maybe I'm wrong on this point.
A nodejs server is running in an AWS EC2 instance, and listens on port 80 to manage images.
Due to ATS restrictions, I declare an exception in my Info.plist file for my images subdomain:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>images.mydomain.com</key>
<dict>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
<true/>
<key>NSExceptionMinimumTLSVersion</key>
<string>TLSv1.2</string>
<key>NSExceptionRequiresForwardSecrecy</key>
<true/>
<key>NSIncludesSubdomains</key>
<true/>
<key>NSRequiresCertificateTransparency</key>
<false/>
<key>NSThirdPartyExceptionAllowsInsecureHTTPLoads</key>
<false/>
<key>NSThirdPartyExceptionMinimumTLSVersion</key>
<string>TLSv1.2</string>
<key>NSThirdPartyExceptionRequiresForwardSecrecy</key>
<true/>
</dict>
</dict>
</dict>
Recently I added a new subdomain on the same AWS instance: https://api.mydomain.com
Another nodejs server listens on 443 port and manages the API.
Since this change, everything is fine in my app when I call the API, but when I load images I am facing the following issue:
NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9802)
Any idea fo fix that?

Answer 1

I found the issue.
It was on server side, the HTTPS server running on the same AWS instance is configured with HSTS:
var ONE_YEAR = 31536000000;
app.use(helmet.hsts({
maxAge: ONE_YEAR,
includeSubdomains: true,
force: true
}));
The variable includeSubdomains set to true forces my other domain images.mydomain.com to use HTTPS protocol while it is a HTTP server.
To solve it, just exclude others domains in HSTS configuration:
var ONE_YEAR = 31536000000;
app.use(helmet.hsts({
maxAge: ONE_YEAR,
includeSubdomains: false,
force: true
}));

Answer 2

Can you add this in plist.
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
</dict>