In a Microsoft Exchange Server 2019, 2016, or 2013 hybrid environment, you associate a certificate with the Office 365 send connector by using the TLSCertificateName parameter. When you send an email message to Office 365, the email message may be stuck in the send queue and you may receive the following error message in the protocol log:
TLS negotiation failed with error UnknownCredentials.
This issue occurs because the certificate isn't enabled for the SMTP service and Exchange Server doesn't check whether the certificate is enabled for the SMTP service when it's associated with the send connector.
To fix this issue, install one of the following updates:
Learn about the terminology that Microsoft uses to describe software updates.