While Martin's answer is correct for Windows Phone 8.0, it won't work for Windows Phone 8.1.
If you use "application/c-x509-ca-cert" with 8.1, the .aetx file is transformed to .cer and you get the error 0x8028a001 "Your phone couldn't add one or more certificates because the certificate file might be unsupported or corrupt ...".
The correct type for 8.1 is "application/octet-stream". Same mime-type used when you send the token as attachment in an email.
But with "application/octet-stream", WindowPhone 8.0 doesn't see the aetx file as token and displays its content to the user.
The solution is to use a servlet (or equivalent if you're not using java) to set the mime type dynamically.