Unable to workplace join IOS - Windows 8.1 ok

Question

I have 2012R2 up and WAP/ADFS all working nice, I can WPJ my 8.1 client no problem, but any IOS device just wont install the profile saying unable to connect to server, here are the logs from the device.
All URLS are reachable fine from the devices, its a trusted public cert with enterpriseregistration on for the UPN also, any ideas?
Jul 16 10:06:52 Martins-iPhone profiled[39] <Notice>: (Note ) MC: Enrolling in OTA Profile service...
Jul 16 10:06:52 Martins-iPhone profiled[39] <Notice>: (Error) MC: Failure occurred while retrieving profile during OTA Profile Enrollment: NSError:
Desc   : A connection to the server could not be established.
US Desc: A connection to the server could not be established.
Domain : MCHTTPTransactionErrorDomain
Code   : 23001
Type   : MCFatalError
Params : (
"https://sts.domain.com/EnrollmentServer/otaprofile/profile?operation=enroll",
400
Jul 16 10:06:52 Martins-iPhone profiled[39] <Notice>: (Error) MC: Installation failed. Error: NSError:
Desc   : Profile Installation Failed
Sugg   : A connection to the server could not be established.
US Desc: Profile Installation Failed
US Sugg: A connection to the server could not be established.
Domain : MCInstallationErrorDomain
Code   : 4001

Answer 1

Can you paste the config file please, so I can set up the same tracing? I have enabled it, but getting nothing logged?
Hi Martin,
Sorry for the delay, here is my Microsoft.DeviceRegistration.ServiceHost.exe.config.  I specified C:\Windows\Temp\drsTrace.xml for the trace file.  Just make sure that your DRS service account has write access to it.
You can see where I have added the new entry for CertificateExpiryExemptForiOSProfileService.
Mark.
<?xml version="1.0"?>
<configuration>
<uri>
<idn enabled="All" />
<iriParsing enabled="true" />
</uri>
<appSettings><add key="CertificateExpiryExemptForiOSProfileService" value="true"/></appSettings>
<system.serviceModel>
<diagnostics>
<messageLogging maxMessagesToLog="30000" logEntireMessage="true" logMessagesAtServiceLevel="true" logMalformedMessages="true" logMessagesAtTransportLevel="true">
</messageLogging>
</diagnostics>
</system.serviceModel>
<system.diagnostics>
<!-- To enable DRS tracing, change the switchValue below to desired trace level - Verbose, Information, Warning, Error, Critical, All -->
<!-- Uncomment sources below to enable tracing -->
<!-- Set initializeData to a complete path to a file that the Device Registration Service has write access to in order to generate traces -->
<!-- NOTE THAT THE CHANGES TO THIS SECTION REQUIRE SERVICE RESTART TO TAKE EFFECT -->
<sources>
<source name="System.ServiceModel" switchValue="Verbose, ActivityTracing" propagateActivity="true">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="System.ServiceModel.MessageLogging" switchValue="Verbose">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="Microsoft.DeviceRegistration.ServiceHost" switchValue="Verbose, All">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="Microsoft.DeviceRegistration.DiscoveryService" switchValue="Verbose, All">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="Microsoft.DeviceRegistration.HttpDiscoveryService" switchValue="Verbose, All">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="Microsoft.DeviceRegistration.HttpCloudDiscoveryService" switchValue="Verbose, All">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="Microsoft.DeviceRegistration.Utilities" switchValue="Verbose, All">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="Microsoft.DeviceRegistration.WindowsDeviceEnrollmentService" switchValue="Verbose, All">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="Microsoft.DeviceRegistration.iOSDeviceEnrollmentService" switchValue="Verbose, All">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="Microsoft.DeviceRegistration.Utilitities.DRSyncSourceDomain" switchValue="Verbose, All">
<listeners>
<add name="xml"/>
</listeners>
</source>
</sources>
<sharedListeners>
<add name="xml" type="System.Diagnostics.XmlWriterTraceListener" initializeData="C:\Windows\Temp\drsTrace.xml"/>
</sharedListeners>
<trace autoflush="true"/>
</system.diagnostics>
<!-- By default the service will load the on-premise configuration
The following optional attributes on to the 'startup' element
can be used to modify this behavior.
isCloudDeployment="true" and isOnPremiseDeployment="true"
These settings should not both be set to true in production
deployment.
Example: <startup isCloudDeployment="true"... OR
<startup isOnPremiseDeployment="true"
-->
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/>
</startup>
</configuration>