azure mysql database replication with on-prem mysql master is failing with 2003 error

I have setup azure mysql master database and I would like to do data-in replication with an on-prem mysql database but the replication is failing. Can someone tell me the reason ?

azure mysql -
mysql> SELECT VERSION();
+------------+
| VERSION() |
+------------+
| 5.7.29-log |
+------------+
1 row in set (0.07 sec)

running the change to master command below :
CALL mysql.az_replication_change_master('xx.xxx.xx.xx', 'repl2', 'repl2', 3306, 'bin.000141', 12176221, 'cert');
CALL mysql.az_replication_start;

mysql> show slave status \G
*************************** 1. row ***************************
Slave_IO_State: Connecting to master
Master_Host: xx.xxx.xx.xx
Master_User: repl2
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: bin.000141
Read_Master_Log_Pos: 12175973
Relay_Log_File: relay_bin.000001
Relay_Log_Pos: 4
Relay_Master_Log_File: bin.000141
Slave_IO_Running: Connecting
Slave_SQL_Running: Yes
Replicate_Do_DB:
Replicate_Ignore_DB:
Replicate_Do_Table:
Replicate_Ignore_Table:
Replicate_Wild_Do_Table:
Replicate_Wild_Ignore_Table: mysql.%,information_schema.%,performance_schema.%,sys.%
Last_Errno: 0
Last_Error:
Skip_Counter: 0
Exec_Master_Log_Pos: 12175973
Relay_Log_Space: 154
Until_Condition: None
Until_Log_File:
Until_Log_Pos: 0
Master_SSL_Allowed: Yes
Master_SSL_CA_File: C:\work\primary_ca.pem
Master_SSL_CA_Path:
Master_SSL_Cert:
Master_SSL_Cipher:
Master_SSL_Key:
Seconds_Behind_Master: NULL
Master_SSL_Verify_Server_Cert: No
Last_IO_Errno: 2003
Last_IO_Error: error connecting to master '15000@xx.xxx.xx.X:3306' - retry-time: 60 retries: 1
Last_SQL_Errno: 0
Last_SQL_Error:
Replicate_Ignore_Server_Ids:
Master_Server_Id: 0
Master_UUID:
Master_Info_File: mysql.slave_master_info
SQL_Delay: 0
SQL_Remaining_Delay: NULL
Slave_SQL_Running_State: Slave has read all relay log; waiting for more updates
Master_Retry_Count: 86400
Master_Bind:
Last_IO_Error_Timestamp: 210126 00:06:31
Last_SQL_Error_Timestamp:
Master_SSL_Crl:
Master_SSL_Crlpath:
Retrieved_Gtid_Set:
Executed_Gtid_Set:
Auto_Position: 0
Replicate_Rewrite_DB:
Channel_Name:
Master_TLS_Version:
1 row in set (0.08 sec)

on-prem master server -

mysql> select version();
+---------------+
| version() |
+---------------+
| 5.7.25-28-log |
+---------------+
1 row in set (0.00 sec)