I think this might be specific to blackberry browser. The blackberry browser is not configured to distinguish between self signed and non self signed certificates only like desktop browsers. But it is configured to detect mismatches between the common name of the certificate and the domain name.

For example hotmail.com which has a common name of login.live.com is not detected by desktop browsers as a need for a security prompt. But on the bb browser it triggers the prompt.

Maybe the question should be how to configure the policy for client side ssl parsing to only warn on non signed certificates and not common name irregularities.