Symptom:
After configuring the Centralized Policy, Virus and Outbreak Quarantines feature on your ESA, you may find that connections to the SMA on port 7025 are failing.  Errors such as the following may appear in the logs:

Mon Jul  2 12:00:00 2014 Info: New SMTP DCID 12345 interface 10.0.0.1 address 192.168.0.1 port 7025
Mon Jul  2 12:00:00 2014 Info: DCID 12345 TLS failed: verify error: no certificate from server
Mon Jul  2 12:00:00 2014 Info: DCID 12345 TLS was required but could not be successfully negotiated

Conditions:
This issue occurs when the ESA is offering anonymous ciphers for outbound SMTP connections.  If the SMA accepts such a cipher, the TLS verification process needed for PVO communication will fail.