Unknown CA error for VIP that is doing SSL offloading on LTM

I would say that best way is to do packet capture when connecting with sites that are working and compare SSL Handshake to capture when connecting to your VS - of course if you have a way to capture traffic from iPad to Internet.

If other clients/devices are not complaining about Unknown CA then it has be somehow related to iPad config or specific requirements.

If possible I would as well try some other Apple devices to see if it's the same. If not then there is big chance that configuration for this specific iPad is somehow messed up/corrupted.

Piotr