[oneplane]

I think the best explanation (including APNS which is on top of IMAP open connections) on the certificates and key usages is described here: https://micromdm.io/blog/certificates/

ABE and ABM both use the same technology so it's pretty much exactly how Apple intends it to be used. There used to be someone hosting a shared CA for this, but it because cumbersome to deal with third parties not loading the CRL and not using OSCP.