BAD: keys did not match
# cfagent -qIK ... cfengine:mrpmmds012: BAD: keys did not match
cfservd on the policyserver was correctly configured. My cfengine client was listed in AllowConnectionsFrom and TrustKeysFrom. I also allow the policyserver's public cfengine key to be copied to /var/cfengine/ppkeys on the client.
# For boostrapping cfengine clients /var/cfengine/ppkeys/localhost.pub server=$(policyhost) dest=/var/cfengine/ppkeys/root-$(policyhost).pub mode=600 owner=root group=root trustkey=true
So what was the problem?