Looks like things are working as intended.  Using OPENSSL to test, 

mx.rediffmail.rdiff.com = no encryption

mx.pro.rediff.akadns.net = self-signed certificate included as third cert in the chain

Yes, noticed that.

But somehow, enabling this option is turning into false positive and complaints from customer perspective and hence have disabled this options as of now.

Thanks

My both options are disabled now in Protocols but still i am seeing some user with delivery issue and waiting to deliver with below error

If the message was queued before the change was made, it may be tagged for mandatory encryption, in which case it may never get delivered.  I am extrapolating from my experience with a different product.   You should open a support ticket to see if they can get the messages unstuck.