Exchange 2003 works fine with the HTC....
Exchange oma page needs no SSL and the IT guys wont be happy about that. Lucky thats my job, so heres how I just reconfigured my little (2000 user) exchange server... took about 20mins and does involve IIS being down for about 5 mins.
The exchange virtual directory requires SSL and theres no way you should turn this off. However you can create a copy of the exchange virtual directory, turn off SSL but only allow one computer (the same exchange server) to access it. This way the initial connection from the website is SSL, but connection from the website to the exchange backend is http... this is ok, because its only talking to itself.
Exchange ActiveSync and Outlook Mobile Access errors occur when SSL or forms-based authentication is required for Exchange Server 2003
My HTC Hero now works with exchange 2003 activesync....
It doesnt need a godaddy cert (we use ipsCA), exchange 2007 might be different as 2007 activesync requres some additional info specified in a special SSL cert (UCC) which only a few places provide at an extra cost.
Hope that helps.