Are you downloading your trust profile and downloading it to the configuration machine? That step is new.

My carts that I've updated are working using the method listed here. I am on 9.11 and iOS 7.

https://jamfnation.jamfsoftware.com/article.html?id=211

Installing Enrollment Profiles Created Using the JSS v9.1 or Later
When you create an enrollment profile for use with Apple Configurator, the JSS v9.1 or later automatically creates an associated Trust Profile (Trust Profile.mobileconfig). The Trust Profile contains the CA certificate that establishes trust between the certificate authority (CA) and mobile devices.

Before you can use Apple Configurator to enroll mobile devices, you need to download both the enrollment profile and its Trust Profile from the JSS so you can import these profiles to Apple Configurator.

Thanks peineke!

Thanks! I just setup 30 devices, and all but two worked without installing the Trust Profile first. The two that gave the invalid cert error work just fine now that I installed the trust profile first. Saved me some headache.

How do you bind the enrollment and configuration profiles together we have used department field but how do we setup the username, fullname and email address fields, should we use $USER, $EMAIL for it. I am asking this because the department binding is not enough and in the absence of username, email and fullname settings in enrollment profile the configuration profile is dropping-off and taking all the payloads off with it but the enrollment profile (i.e. MDM profile) remains there. Please note that we are using jss User Location settings with LDAP to tie the users with that department.