I guess depending on your version of IE (i am using ie7 now) you may or may not see the "lock". However, after logging into OWA you should be able to right click the web page and then select properties. Next click the certificates button which opens the Certificate viewer window. This window consists of three tabs General, Details, and Certificate Path. Go to Certificate Path tab in order to see the certificates. Select the top certificate and then click the "view certificate" button. This opens another Certificate Viewer but this time you are viewing configuration of the top certificate. Now go to the Details tab of the new window and click the "Copy to File..." button. Now you will see the Certificate Export Wizard. Click next>(choose default DER format)next> enter a file name (name it such that you can tell which cert in the chain it is) and save location and click next again and then click finish. Your certificate will now be exported to the location you specified with the file name you specified (i.e. name.cer). You repeat this export process for ALL certificates that are in the chain of certs for your OWA. Once you have all the .cer files exported you will need to get these files onto the device. I used the usb cable to copy the files to the my documents folder on the device. You could also send as attachments through email to another account (gmail, yahoo, etc. ) that you can access on your phone. Once the files are on the phone navigate to them using the WM5 file explorer and click the files to install them to the root store on the device. When you click the .cer file it will ask if you are sure you want to install and then click yes. I installed them in order of top to bottom as they appear in the chain but this is probably not required. Once you have installed all of the required certs a good test is to go to (in your device's IE) the address you normally use for OWA except add a /OMA to the end (i.e.
http://mail.yourcompany.com/oma) if mobile IE does not warn you about untrusted certificates then you installed them correctly.
As far as your IT dept not requiring SSL on Exchange this just means that you have the option to connect without using SSL. I would recommend using SSL anyway so that your credentials are protected OTA.
The 0x85010001 error is probably a problem with OWA or OMA like your IT guy said. Is OWA and OMA working when you browse to them on your computer? I got this error once when our entire exchange server was offline.