I was setting up push mail to https://mail.example.com when I got this message. The solution (brace yourself)

1. openssl s_client -connect email.examile.com:443
2. Copypaste the lines between and including -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- to a .pem file
3. openssl x509 -outform der -in certificate.pem -out certificate.der
4. You need the whole trust chain, however, so in my case I needed the GlobalSign Root CA, which provides a DER file too
5. Copy your der files to the phone
6. In the phone file manager, click them and install them.

If the chain is longer than two? I have no idea.