[chronster]

Ok I figured out what was happening. I wasn't exporting the certificate as a P7B file, which apparently you can do from MMC.

I wrote up some instructions for the IT guy to hand out, here they are in case anyone ever has this issue as well:

1. From Internet Explorer, go to your owa website and login
2. Click on the lock icon in the address bar and select view certificates.
3. Click “Install certificate…”
4. Click Next, then click “Place all certificates in the following store…”
5. Click Browse, then select “Personal” then OK.
6. Go to start > run then type “MMC” without quotes.
7. From MMC, click File > Add Remove snap in…
8. On the next screen click Add…
9. Select Certificates from “Available standalone snap-ins list” then “Add”
10. Select “My User Account” and click Finish.
11. Back on the Console window, select Personal > Certificates. There should be a certificate to the right named after your owa site.
12. Right click the cert, go to All Tasks > Export…
13. Click next, then select “Cryptographic Message Syntax Standard – PKCS #7 Certificates (.P7B) and click Next.
14. Name to file something like “C:\cert” then click Next and then Finish.
15. Find the certificate file just made and send it to your storage card or internal memory on your Windows Mobile phone.
16. Run the certificate from the phone, then setup an ActiveSync connection to your exchange server from your phone.

shorter instructions apparently is to type certmgr.msc in start > run, then you can access your personal certs from there too lol