iOS App Transport Security not accepting TLSv1.2 connection and plist exceptions not making any difference
The server does not provide a complete certificate chain in its SSL/TLS handshake. While some clients can handle this and build out a trust chain, others cannot.
You can find the missing intermediate certificate via https://whatsmychaincert.com/?api.branon.co.uk and serve it along with your site's certificate in your SSL configuration in nginx.
Do remember to remove any ATS exceptions that you may have put in place!
The format of the keys I use to allow older versions of TLS (for amazonaws, for example) looks like this:
<key>NSIncludesSubdomains</key><string>NO</string><key>NSThirdPartyExceptionMinimumTLSVersion</key><string>TLSv1.1</string><key>NSThirdPartyExceptionRequiresForwardSecrecy</key><string>NO</string>The rest of the structure looks the same. At one point, we had this at the root level.
<key>NSExceptionMinimumTLSVersion</key><string>TLSv1.0</string>