I don't have much experience with Blackbery clients, and this may not be a long term solution, but just to see if it works you can try this.
If you don't have an external Radius server, then you have the controller doing 802.1X termination. If you look at the dot1x authentication profile, you can confirm what certificate is being used. Try loading this certificate onto the Z10 and using it as the "CA Certificate" (again, I don't have a lot of Blackberry experience, so i am not sure of this process to load the certificate, but I am sure it is documented).
It is the Server-Certificate entry under the Advanced tab of the 802.1X Authentication profile in use.