143/tcp is imap (IIRC), not needed for push.
Did you mean SSL? 443/TCP? Did you also test this from OUTSIDE, on a different connection?
Do you have the CA installed in the iPhone? If you have goodaddy/similar then you may not need it. If you have a homemade, you need the CA on the iPhone.
The cert on the SERVER must either have a SAN with the external hostname, or the hostname must match EXACTLY.
IE: Internally it's exchange.domain.lol. Externally it's mail.domain.org. You can have the hostname as exchange.domain.lol, provided you have a SAN name for each of the other domains. Worst case, just have the hostname the external domain. 2k3 will not complain, but 2k7 will complain about cert name mismatches if you are using outlook to exchange internally.
$200 paypal. Send me the IP address of the server to RDP into, username/password and i'll have it working in under an hour
