maybe delete the ca cert on the agent end and see if it downloads again and is correct, failing that maybe consider blowing away the complete ca certs and server certs on the server end