Outbound messages found with 454 certificate expired. Only one domain was affected. Delivery with TLS is possible without issues to other domains.
This can be due to an issue on Network side.
Having in mind that delivery with TLS is possible to other domains, it is advised to capture tcpdump based on the reference shown below for further analysis:
TCPDUMP usage on Messaging Gateway 10.7.4 and newer.
In case of having more networking assets after the SMG and before reaching end MTA, ensure that the connection is not interfered.