I

finally

got iOS to let go of an expired certificate that it kept insisting upon using in place of the actual cert on the server

and

finally got both the mail and mail-relay servers to use the automatically-updating certificates

and

got the auto-updating certificates to maintain usable permissions so that all of the above could actually happen.

goddamn that was a pain in the arse.