I have not had any issues with GMS and setting this up on anybody's iPhone until the latest 10.3.3 update. We have GMS 14.2.1 Build 270. When I try to set up email sync on a users iPhone now it says that it cannot verify the Certificate. It is self signed so I know why it is getting that. In the past I manually downloaded the Cert and imported into the phone and all worked well. Now I get it downloaded and imported/installed on the iPhone and it says "Verified" under the profile and I have it enabled under the Certificate trust settings. After doing this if I try to set up email sync again, it still says it cannot verify and it brings up the profile but it says "not Verified" for some reason and does not allow me to trust or allow this cert. As a test I removed the Email account from my iPhone and removed my device from the GMS admin console under my name. I then upgraded my iPhone to the 10.3.3 version. I then went and was able to successfully add my email account to the iPhone. I did not have to add any profiles (nothing is under the profile section) or enable any profiles under the Certificate Trust settings. Now I am really confused.
Does anyone have any ideas or what I could try?