I was able to do this by hooking it to my computer by usb. I transferred the files to my documents folder. Then I used a program called "files" that I got from the app store. I used the files program to navigate to the cer file. Then it opened and installed. Now I can use self signed certs from my company domain.
To my ongoing aggravation, it appears to not currently be possible to use S/MIME with WP8.1 or W10M unless you are using an Exchange ActiveSync-based account. Secure email on IMAP and POP3 accounts is not supported, for some reason. From the user's perspective, this is a completely pointless and artificial restriction - other platforms' email clients have no ...
Lots of ways to do this.
Zip the cert and email it to yourself, open the zip, and tap on the cert in the zip viewer app.
Transfer the cert file using USB, and then use a file browser app to open it on the phone.
Send the cert file to your phone using Bluetooth (pretty easy if the phone is synched to your PC via Bluetooth; right-click in Explorer and select ...
The cause of the problem was incorrect date settings on the phone. Although it was set to update date/time automatically it hadn't (it has been connected to a wifi network), so the date was set to 24th of May while the certificate of the site it was trying to reach was created at a later date.
Thanks to TomEus for asking the right question.