This is an expected behavior. When authentication mode is configured as "certificate disabled" on hub and "certificate optional" on edge, they will not form the VCMP tunnel.
Erroneous configuration Example:
Hub Edge
Spoke Edge:
For valid certificate configurations on hub and edge check this compatibility matrix: