While it's rare these days that you encounter a server that fails Apple's default ATS requirements, the nscurl utility can be very helpful to quickly test many different configurations in order to make a diagnosis of what specifically is wrong with the server's SSL configuration. See this article for more information.