onion sites are not using https/ssl by default. But the connection inside the Tor network is always encrypted, so it is not really necessary to use https for .onion sites. Exit nodes aren't used at all with hidden services, because the connection stays inside the Tor network until the hidden service is reached.