If you can store a device ID on the client, then you can use that as both "username" and "password": within the SSL tunnel, the client sends the device ID, which the server looks up in the database. If the device ID is found, voilà! the client is authenticated. Remember that "a client is authenticated" has the same meaning as "no other entity than the client himself could have said that". As long as the "device ID" is client-specific, secret, and unguessable, it is a proper basis for authentication.
Of course, a customer who extracts the data contents of his device and reverse engineers the code will find his own device ID, and will be able to access the server from other computers. That's unavoidable. You cannot enforce usage of a specific client device unless the client device contains a tamper-resistant element (e.g. a TPM), and, apparently, iPhones do not. Certificates or other cryptographic gizmos won't help you there.