i left it as default and it should be automatically configure certificate trust.
i actually restore my publisher but because my subscriber failed to join back for some reason, i did a cluster reset-database on the publisher, i then reconfigure everything, included onboard. then this happens. i will check if the trusted list has any duplicate entries.