Configure certificate-based authentication for Exchange ActiveSync

Apple iPads and iPhones support PKCS1-formatted X.509 certificates, stored in files ending with .crt, .cer, .pem or .der. You can use these certificates to identify CAs, servers or individual users and devices. Here's how to add CA certificates used during enterprise Web, email, VPN or wireless LAN (WLAN) server authentication.

Ways to deploy configuration profiles

Via Web
Direct employees to a Web page where your CA certificate is posted. Any user who clicks on the certificate file URL will launch a dialog similar to that described above. Although this method is also vulnerable to phishing, it can be strengthened by hosting the CA certificate on a secure website, and you can advise users to ensure that they reach the legitimate website before downloading your certificate by logging into a corporate Web portal first.
Via email
The least secure method is to simply email your trusted CA certificates to employees. Any user that clicks on this attachment launches an Install Profile dialog that warns that the CA certificate about to be installed is not trusted. If the user clicks Install, he will be further warned that the authenticity of the subject cannot be verified and that installing the profile will add it to the list of trusted certificates on that iPad or iPhone.

When using this method, counsel users to make a one-time exception and never install any other CA certificates, even if they appear to be from the IT department.

Via Profiles
By connecting an iOS device to a computer running the iPhone Configuration Utility
By pushing profiles to an iOS device workgroup using Apple Configurator (ideal for small organizations with fewer than 30 devices)
Over the air using an MDM tool (most businesses should consider MDM for fully automated, user-transparent iOS configurations)

i need what configuration is required at Server side and what is at Client side

From your end you can use apple server or use MDM solution.
Even apple configurator can do the work for you.
Screen-Shot-2015-11-16-at-5.03.53-PM.png

MDM is already there.. but what server side configuration is required and what client side

On MDM you need to create a profile by adding all information, and Push this profile on client.

in details:

First long in to your MDM and bind all your clint to it. to bind you need to ask then to enrol to your MDM.
once they get enrol they will be shown in your devices list. Make a group.

then you created a profile with your polices and push it to the client.

first you have to be go through you MDM software. if you can share your MDM info i can through their website and guide you.

i think you are not getting my question correctly.

Please tell what configuration requirement is needed on Exchange 2013 , AD and Internal PKI and Mailmarshall Gateway we are using

this for Exchange 2010.. i have only exchange 2013

steps are same.

thanks