We recently worked through an attachment download issue on the Android platform.  The issue is that we had a wildcard (*.example.com) certificate for SurgeWeb, so when you connected to the domains Surgeweb page those with Android-based smartphones would get a warning about the certificate and have to ignore it in order to get to the login page.  Also troublesome is that attachment downloads didn't work properly.

The solution, as discovered with Netwin's help, was adding the intermediate certificate(s) to the surge_cert.pem file.  Doing that was as simple as appending the intermediate certificate to the surge_cert.pem file (which is a just a text file) and then restarting Surgemail.  Intermediate certificates are readily downloadable from the Certificate Authorities' websites.

I used three SSL evaluation websites to help me:
https://www.ssllabs.com/ssltest/analyze.html (will show the names and details of the certs, missing or not
https://www.wormly.com/test_ssl (quick SSL tester, will point out if intermediate certificate is missing)
https://www.digicert.com/help/ (will show a green chain link between certs when they're all there *and* in order)

Frank