Hi Peter,
I went through this process last year and might have hit the same issue as you. The cert for the wifi profile has to be in the same profile, meaning your delivering wifi and cert payloads in the same profile but I think if I remember correctly, the root or intermediate certs need to be delivered in a separate cert profile..... or it might have been the other way around?
Have a play around with those two combos, as it was really convoluted.
Leo