Your current TLS config is set to verify certs.
They aren't using a cert that matches the A record/Host name of the box the mail is going to, often seen when they're using a self signed cert, or the demo cert that came with their ESA...
You can inform them of the issue and hope they fix it, or create an entry in Mail Policies/Destination controls for this domain and set the TLS Support to something other than a setting that verifies the cert.
