It definitely seems like there is an issue with configuration.
Either 1) your local broker can’t access it’s own certificate to make the handshake or 2) it may not trust the certificate that the cloud vpn/service is offering. Can you check each of those?