Does anybody have this working with the iPhone native Mail app?

We have been using GMS to sync GW 2012 to BB OS 10 devices for a few years - no problem.
The powers that be have decided to switch mobile carriers and to switch to iPhone 7 running iOS 11.
Trying to use the BB Secure Gateway to route mail.
All of the BB UEM policies are on the phone, but the Activesync setup cannot connect to the server or verify the user.

Seems to be an SSL issue from the UEM log.
I am using a purchased SSL certificate.

Thanks for any info, hints or tips.