I've messed up BAD...

So, we were looking to prevent users from factory resetting their phones. It happens too often and it's becoming an issue. So, we decided to lock the phones down. So we've added the following lines to our provisioning server

auto_provision.power_on = 0
auto_provision.pnp_enable = 0
auto_provision.dhcp_option.enable = 0
auto_provision.repeat.enable = 1
auto_provision.repeat.minutes = 60
auto_provision.weekly.enable = 0
auto_provision.server.url = https://oururl.com/
features.factory_pwd_enable = 1

This has worked great at preventing users from factory resetting their devices. But, we noticed that we are no longer able to provision the phones. After some extensive testing I found that even though we DO have a cert from GeoTrust Global CA, the phones aren't trusting out cert. Then I found it, by default "Only Accept Trusted Certificates" is enabled?!? This is bad. This means that I can no longer auto provision any of my phones or factory reset the phones without the admin password. And unfortunately, the admin passwords we have "admin/admin" and "admin/ourpassword" aren't working on more than 50 phones. Is there anything I can do to rescue these phones???

Is there anything else than can be done???