You didn't mention if you're using a Certificate Authority (CA) or a self-signed certificate, so the answer will be a little vague...
Check DB2's key database for the Spectrum Protect server certificate -- if the SP server cert is self-signed, you'll have to add a copy to the DB2 database's key db. If the SP server cert was signed by your organization's CA, then you need to make sure you have the full certificate chain (root + intermediate certificates) inside that key database.
-JD.