Certificate mismatch happens when the private key of the OfficeScan server is different from the the public key of the OfficeScan agent.
To address the issue, execute the ipxfer on the agent. The ipxfer.exe is located in the following OfficeScan server's pccsrv\admin\utility\ipxfer folder:
ipxfer -s <OfficeScan server> -p <OfficeScan server port> -e <OfficeScan public key>
In OfficeScan XG, a new version of ipxfer is included. It has a new feature that prevents moving an agent without password. To execute the ipxfer, a new parameter for password (-pwd) is added.
Below is a sample:
ipxfer.exe/ ipXfer_x64.exe -s <OfficeScan server> -p <OfficeScan server port> -e <OfficeScan public key> -pwd <unload password>