See Piotr, I considered this as an issue as for me a browser should open any kind of URL as long as the URL is active and valid, irrespective of whether the URL has http:// or https://. The requirement of an SSL certificate on webservers for iOS apps can be considered valid as Apple wants its devices to communicate securely with the web servers. But a mobile web browser on iOS devices should open all kinds of web pages even the ones without the SSL certificate. And we already see this happening all browser apps like Chrome, Firefox, etc. which must be following the protocol to communicate with their web servers but allows to open any and all kind of URLs.
Now, in this case, an InAppBrowser is expected to work similar to a web browser inside an app and open any and all kinds of active and valid URLs. I hope you understand this as a justifiable expectation. Your solution of adding App Transport Security in Xcode did work for me and for unity we can create a post process build monobehaviour to add this to the Info.plist after the Xcode project is built to avoid manually changing this in Xcode. You can find a reference to this method here – https://answers.unity.com/questions/1431654/app-transport-security-has-blocked-a-cleartext-htt.html
Now, as far as cross-platform capabilities and other features of an in-app browser are concerned, IAB asset does an excellent job. I hope you come up with a more robust solution for this as well.
Regards,
Sanket.