Hey @funghai,
I noticed in your broker properties you didn’t put a solace.messaging.tls.trust-store-path as suggested by @Solly-AI, was there a particular reason for that?
Additionally, did you happen to have a look at the response @swenhelge provided here regarding the possibility of needing to provide a full certificate chain?