iOS 12 enrollment on Profilemanager fails due to ATS

Hi,

I have found a problem where if trying to enrol an iOS 12 device into Server 5.3 on High Sierra will not work unless you have a 3rd Party verified SSL certificate installed. however, if you build a new box based on Mojave and install the Server App 5.7.1, it seems to generate self signed SSL certs which appear to work just fine - ive compared the certs from both an old and new build and cannot see a difference - also noted that when trying to enrol and monitoring an iOS device im receiving an error when trying to retrieve the SCEP profile - the resource could not be loaded because the App Transport Security policy requires the use of a secure connection...

So ATS is stopping access to the SCEP profile by the looks of it...

has anyone run into this problem and found a solution?

thanks