It's a rather compley issue.

First, it could be that the certificate isn't recognized by The bat for valid reasons. The certificate could have expired, it could be self-signed or signed by a CA that isn't in your trusted CA list. It could also fail to match the name of the mail server.

Another possibility is that The bat knowns about the root CA but not about the intermediary certificate in the chain. In this case, if the mail server doesn't send back a full certificate chain (but only the leaf), then The bat has no way to validate the server certificate.

If any of the above fails, a corresponding error message should be displayed in the log. Check it and please come back with this message.

Now, it could also be a problem with the bat itself. It  does a pretty good validation of the certificate, but it's certificate management functionalities is pretty crappy and it's using several completely unrelated systems to boost.

I've had several long message exchanges with the developper until I finally managed to get TheBat to recognized my company's root CA (even if it was already and perfectly registered in Windows's own certificate store).

I don't really have the courage to explain all in detail here so if you could be more specific about your setup and your ISP's setup, that would be most helpful. I know that it could be hard to get the certificate from a SMTP connection (I don't think there is a way to do this using The bat) but please try to gather as much info as you can.