The step-ca demo server I was using didn't issue a Client Certificate if the Attest is set to false. Below ACME payload is verified to be working in iOS.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadUUID</key>
<string>70e4b45e3c1e</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadOrganization</key>
<string>NewComp</string>
<key>PayloadIdentifier</key>
<string>4565353a3a84</string>
<key>PayloadDisplayName</key>
<string>ACME</string>
<key>PayloadRemovalDisallowed</key>
<true/>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadUUID</key>
<string>f84ef110e39b</string>
<key>PayloadType</key>
<string>com.apple.security.acme</string>
<key>PayloadOrganization</key>
<string>NewComp</string>
<key>PayloadIdentifier</key>
<string>f84ef110e39b</string>
<key>PayloadDisplayName</key>
<string>ACME Configuration</string>
<key>DirectoryURL</key>
<string>https://acmeserver/acme/acme/directory</string>
<key>ClientIdentifier</key>
<string>test</string>
<key>HardwareBound</key>
<true/>
<key>KeyType</key>
<string>ECSECPrimeRandom</string>
<key>KeySize</key>
<integer>384</integer>
<key>Subject</key>
<array>
<array>
<array>
<string>1.2.840.113549.1.9.1</string>
<string>test@test.com</string>
</array>
</array>
</array>
<key>SubjectAltName</key>
<dict>
</dict>
<key>KeyUsage</key>
<integer>5</integer>
<key>Attest</key>
<true/>
</dict>
</array>
</dict>
</plist>
