iOS - how to get mail app to recognize and trust custom or self-signed SSL certificates from a profile? Running iOS 10.2
I added the root certificates of CAcert to my iPhone profile using various ways:


directly from their website in mobile Safari
sent by email to mail app
by adding a profile with the Apple Configurator 2 software


each time the certs show in the profile, but they are marked as "not checked / validated" in red.

Everytime mail app tries to connect to the mail server a warning dialog pops up that it cannot validate the mail server. Consequently it does not connect. Plus the popups are very annoying.

On MacOS the CAcert certificates are added to the Keychain and MacOS Mail works just fine. Same with all browsers and Apache running on the same box. It's a wildcard certificate (*.example.com) that I se for all services. All fine except mail.app on iOS - this also used to work fine with mail app in the past as well, by the way (older version of iOS).

An ideas?
In addition to the root certificate you will in some instances also need to add the intermediate certificate in case the mail server you're connecting to does not present the full certificate chain.

You can download the intermediate certificate here:

http://www.cacert.org/?id=3