Root cause of error 1109 (06B4.0000) with Apple Devices on Windows, and a workaround that worked for me
TL;DR: I think it's a bug in Apple Devices itself, not your network, firewall, VPN, antivirus, cable or IPSW.
I reported it to Apple as ***. Below is a workaround that got my iPad updated.
How to recognize it: open the updater log
(folder "iPad Updater Logs" or "iPhone Updater Logs"). Near the end you'll see three
"The request timed out" lines, then "Error retrieving WKMS decryption key", then error 1109 with
fingerprint 06B4.0000.
What happens: since iOS 18 the system image inside the IPSW is encrypted. During the update the PC
must download its decryption key from Apple's CDN (fcs-keys-pub-prod.cdn-apple.com). The CDN sends
the key together with some TLS housekeeping data (session tickets) in a single network packet.
Apple Devices' own built-in network code has a bug: in that case it never notices the reply and
waits until it times out. I confirmed this by tracing the connection: the server answers in 0.14 s,
and Apple Devices just doesn't pick it up. Changing DNS, using a hotspot or a VPN only helps when the
packets happen to arrive split.
Workaround (Windows, needs admin rights and Python 3). It makes the reply arrive in separate packets.
The connection stays encrypted end-to-end with Apple, and nothing else on the PC is affected.
1. Install Python 3 from python.org or the Microsoft Store.
2. Download apple_key_relay.py from protomi/apple-devices-windows-ipad-update-tmp-fix (the code is short, read it first).
3. Open PowerShell as Administrator and run:
Add-Content "$env:WINDIR\System32\drivers\etc\hosts" "`r`n127.0.0.1 fcs-keys-pub-prod.cdn-apple.com"; ipconfig /flushdns
4. In a normal PowerShell window, go to the download folder and start the relay:
cd $HOME\Downloads
python apple_key_relay.py (if "python" is not found, use: py apple_key_relay.py)
Leave that window open. It should say "relay running".
5. Quit Apple Devices completely: close it, then in Task Manager also end "AMPDevicesAgent".
Reopen Apple Devices.
6. Choose UPDATE, which keeps your data. Do NOT choose Restore, which erases the device.
When the update reaches the old failure point, the relay window prints a "connection ..." line,
and the update should continue.
7. When it's done, remove the hosts line (PowerShell as Administrator):
$h="$env:WINDIR\System32\drivers\etc\hosts"; (Get-Content $h) | Where-Object { $_ -notmatch 'fcs-keys-pub-prod' } | Set-Content $h -Encoding ASCII; ipconfig /flushdns
Then stop the relay: press Ctrl+C in its window, or simply close that window.
Worked for me: iPad Air (5th gen), Windows 11 25H2, Apple Devices 1.1792.39682.0, update iPadOS
18.3.2 -> 27.2, after 4 identical failures.
Use at your own risk, and back up first if you can.
I'm not affiliated with Apple.
Hopefully a fixed Apple Devices update makes this unnecessary soon.
If you hit this too, please send Apple your own report (feedbackassistant.apple.com or
apple.com/feedback) and mention ***: it helps Apple see how many people are affected.
[Edited by Moderator]
