I don't have an answer but part of your premise confuses me. You said: "He can connect via ...
in-home wifi over vpn to office, and shaw open wifi outside". if he can connect on public wifi (Shaw), why does he need a VPN to connect from home? And why did you mention Shaw public wifi specifically? Why not all public wifi?
I'm not an IOS guy at all but I was under the impression that iPhones will not connect without a valid certificate, including situations where a valid certificates name does not match the domain name. I've commonly seen this in situations where a phone connects to an internal Wifi and the phone does a DNS lookup for an external name, but then ends up hitting an internal IP address with a self-signed internal domain trusted certificate. Since the phone is not domain joined (unlike corporate laptops for example, it doesn't trust the cert and refuses to connect.
One solution is to manually install the certificate on the iPhone.
That being said, it doesn't match your scenario so I'm not sure this is your problem.
John