When the phone sends an HTTP request to the IP Office, it receives a 307 redirect message pointing to the HTTP server and resends the request to that server. But to open an HTTPS connection to the server, it needs to validate the server's identity by verifying the IIS server's identity certificate against a known signing authority.

We have just given the phone a trusted root CA certificate from our signing authority, so if we give the IIS server an identity certificate signed by the same signing authority, the same trusted root CA certificate on the phone can be used. To do this we can give the server the same root CA certificate and its own identity certificate.