It was both IOS and Android. After struggling with documentation for a few hours and redoing the same thing over and over I called TAC.
It turns out that for whatever reason, the certificate being installed on devices did not include the entire chain of certificates. Every new root CA I tried it on had this issue. When I switched to the default CA included out of the box with CP/Onboard it worked just fine.
In the meantime I will just use the built in root CA, I believe TAC said they would file a bug.
N