I saw this same behavior after upgrading to 10.11 on some of our systems. Basically, I noticed after the upgrade, the wireless wouldn't work anymore and I kept getting a weird error that I needed to move closer to the AP. After doing a little research on my system I noticed that although the config profile was still there, the certs were not. Since that was the case, I couldn't simply re-run the policy to insert the certs because it conflicted with the profile that was already in place. I ended up re-writing the script to first check for the config profile and if found, remove it before trying to re-install the certs. So far this has worked without issue on all affected systems. I also haven't had a problem with them disappearing afterward.
