Certificate based SSO from an iPhone for Exchange with APM

You don't have to implement/rollout certs just to solve this problem(actually, I don't see how this will solve the expired password issue - but here is a good writeup article on how you can leverage iRules to prevent AD account lockout - you can implement this solution on your Exchange virtual server and stop users from locking themselves out of AD. https://devcentral.f5.com/articles/create-a-user-lockout-policy-with-access-policy-manager