I agree with PAT, SSL certs are so cheap it is not an obstical to deploy FBA in an Exchange 2k3 environment. If you wanted, you could also just use the CA in Windows and create your own Cert. Of course this has its limitations. You will have to deploy your certificate to your OWA clients and install it manually as Windows XP/Vista will not recognize your CA as a trusted CA without manually installing the Cert on the client. This is not the case with a $20 cert from Verisign, Godaddy.com etc. That is why just purchasing a cert is the better solution.