Thanks Argun, that aligns with my experience. Was hoping there might be some way to force my app into a deep suspended state while debugging but its nice to get a confirmation that this is simply not possible.

Somehow this is still an issue 5 years later. We're using client cert based authentication in our NSURLSession and finding that in some cases a 403 from the server will result in: NSURLErrorClientCertificateRequired It's pretty easy to prove, by just returning a 200 from the server instead and everything works (the full TLS handshake succeeds). The fact that NSURLResponse is completely nil in a 403 and it appears that the TLS handshake is failing (when its not) is a bug that IMO should have been fixed years ago.