I facing SSL trust with a Gateway field issue on workspace one tunnel agent on a Windows desktop. 
although ssl mode on waf is pass-through. 
device downloaded the required certificates after enrollment by the same thumbprint