In case this catches someone else.
I have a self-signed cert on my Zimbra server tied to my world facing name (fred.bloggs.com). My BES connects using my internal network name (fred.vm.home) and therefore the certificate is flagged as invalid.
I had to change :
to 1 to allow things to get moving again. 7.1.0, 7.1.1 & 7.1.4 worked ok, so perhaps the default changed in 7.2.0 or the upgrade did something funky with my certificate.