Something Microsoft left out of their SCCM 2012 documentation. http://technet.microsoft.com/en-us/library/dd441397.aspx#ExternalFirewall
If you are using an ISA server there are more certificates and steps to setting this stuff up.
Microsoft should have documentation soon that references SCCM specifically. Until then I hope the above link helps anyone experiencing mobile enrollment issues.