The difference between a domain-joined computer and a non-domain-joined computer is where it gets Autodiscover. A non-domain-joined computer looks to autodiscover.company.com, where the e-mail address is of the form somebody@company.com if you've configure Autodiscover the way most people do it. (You can also publish it as company.com or with an SRV record.)
Domain-joined machines look to the SCP record, which is specified by Set-ClientAccessServer -AutodiscoverServiceInternalUri. You can look at this property by entering:
Get-ClientAccessServer | FL Name,AutodiscoverServiceInternalUri
I suspect that this isn't set to a URL that's covered by your certificate. You might need to enter something like this:
Set-ClientAccessServer -Identity SERVERNAME -AutodiscoverServiceInternalUri https://autodiscover.company.com/Autodiscover/Autodiscover.xml