Failed of Direct Routing for MS phone system and Cisco CUBE

samsam You're not getting the ACK because of the certificate issue.

Can you confirm that you have sbc2.domain.com as the subject of the certificate?
Is your certificate provider on Microsoft's list https://docs.microsoft.com/en-us/MicrosoftTeams/direct-routing-plan#public-trusted-certificate-for-the-sbc
Did you add the root certificate that Microsoft uses to your SBC? 

If your firewall permits it, can you use https://www.sslshopper.com/ssl-checker.html to verify that it shows your certificate as valid? You'll need to use "sbc2.domain.com:5061" as the format for the address.