Was the wrong certificate in Cisco CES or the inbound-connector? As per my knowledge we don't get the option to assign certificate to O365 connectors.

We have exactly the same issue, could you pls guide how/where we can create the exception. Our environment have 1 on-prem server, O365 which has inbound and outbound connectors towards onprem and CES. Currently we are having email loop for few domain...