The solution is this:
First, generate your own CA Certificate and install it on your phone.
Create a new signing request with a Subject Alternate Name record. iOS requires a SAN record and if it's not present, you'll get 9808.
Once you do this, it will work as expected.