Q: itunes store error 0x80092013 and cannot log on - what to do?

If like me you have concluded that this is not a connectivity issue.

In my case it is a problem with Webkit2 and they way it handles SSL certificates.

To test if this is the case install Safari for windows 5.1.7(if not already installed) and try to access a secure site, like facebook or your banking, if you receive a certificate dialog box saying 

"Safari can't verify the identity of the website"

If you hit "Continue" and the page loads but does not render correctly ........

Then try using another browser (IE/FF/Chrome) and see if you are able to access the site without prompts and the page renders correctly.

From Safari 4.04 onwards (as well as iTunes) it uses the windows root certificate store, to test uninstall Safari 5.1.7 and go back as far as Safar 3.2.3 (oldapps.com) and then try to access a secure site, if it renders correctly (back then Safari handled it's own certificates) you have the same problem as me

If you also look in the logs for itunes when you're accessing (attempting) the store if you find a reference to webkit2 and certificates that should further help clarify the problem. btw - don't bother with windows root certificate updates if your other browsers work ok

Hi All,

With regards to error 0x80092013 – this relates to a failure of iTunes to correctly reference a valid CRL (which prevents the establishment of an SSL connection to the iTunes store).

Now, a large CRL endpoint recently moved locations, interesting just days after HeartBleed hit (see here: http://www.lyncblog.info/2014/04/update-your-firewall-now-with-this-new-crl-endp oint/).  It would seem that iTunes requires access to this specific CRL.

For home users, your router, computer or browser may have cached the old CRL location, thus causing the issues with your iTunes connection – this is why the users attempting DNS changes have had some success.

For corporate users behind a proxy or firewall, the issue will relate to the new CRL location not being whitelisted.  This connection is not proxy aware (sigh) which means you won’t be able to authenticate to enable iTunes to access the CRL – the only way is to whitelist the new URL.

So do yourself a favour and add sa.symcb.com to your firewall’s whitelist.

With sa.symcb.com whitelisted, iTunes should be able to successfully obtain a valid CRL and your iTunes connection should now succeed.

It would have been nice if Apple could have provided a little more assistance in this matter – especially for enterprise customers.  But hey Hopefully this post helps some users out there.