Had the same problem with IOS7 clients only. Turned out to be a trust issue.
"My issue turned out to be a trust issue.
Guest > onboard+workspace > Onboard/MDM Configuration > Network Settings > *your profile* > Trust tab
I had selected to automatically configure trust settings.
Even though the cppm ssl certificate included the entire chain this wasn't working properly.
The fix was to change this to manualy configure the trust settings. Cut up the server cert into its CA and intermediate CA's and upload those individualy and then add them as trusted certificates."