Required SSL with exceptions

[List]

I have a Dovecot cluster which is on separate machines from my 
webmail/caldav/cardav cluster, and I currently have the system setup 
with ssl = required.  Unfortunately the caldav/cardav server I am 
running doesn't support STARTTLS so I was wondering if there is a way to 
still enforce ssl for every connection with the exception of a certain 
subnet, or if there is a better way to accomplish this without install a 
local install of Dovecot on each of my caldav/cardav servers.