(#7110) Better SSL error message certificate doesn't match key

Previously, any error with the certificate retrieved from the master
matching the agent's private key would give the same static error
message, which wasn't particularly helpful. This commit differentiates
three different error cases: missing certificate, missing private key,
and certificate doesn't match private key. In the last case, the error
message includes the fingerprint of the certificate in question and
explicit command line instructions on how to fix the problem.

In addition to all tests passing, I tested the error messaging and
included instructions in a virtual machine setup running PE 2.0.0.