I was setting up push mail to https://mail.example.com when I got this message. The solution (brace yourself)
- openssl s_client -connect email.examile.com:443
- Copypaste the lines between and including -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- to a .pem file
- openssl x509 -outform der -in certificate.pem -out certificate.der
- You need the whole trust chain, however, so in my case I needed the GlobalSign Root CA, which provides a DER file too
- Copy your der files to the phone
- In the phone file manager, click them and install them.
If the chain is longer than two? I have no idea.