Why does OS X repeatedly prompt for certificate trust when joining WPA2 Enterprise WiFi

servermgrd looks up the certificate it uses for port 311 via an identity preference named "com.apple.servermgrd". By default, the preference points to the self-signed "com.apple.servermgrd" identity cert. After you change the preference you can remove the old self-signed cert without causing any harm. But you must make sure that the access control list (ACL) on the private key of the certificate that you want servermgrd to use allows servermgrd access.

If servermgrd cannot access the private key, it will delete the preference and create a new self-signed identity and set a new preference to point to the newly created identity cert.

According to the Security Enhancements section of the OS X 10.11 pre-release notes on Apple's Developer web site

App Transport Security (ATS)

App Transport Security (ATS) enforces best practices in the secure connections between an app and its back end. ATS prevents accidental disclosure, provides secure default behavior, and is easy to adopt; it is also on by default in OS X v10.11 and iOS 9. You should adopt ATS as soon as possible, regardless of whether you’re creating a new app or updating an existing one.

If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible. In addition, your communication through higher-level APIs needs to be encrypted using TLS version 1.2 with forward secrecy. If you try to make a connection that doesn't follow this requirement, an error is thrown. If your app needs to make a request to an insecure domain, you have to specify this domain in your app's Info.plist file.