If you are using an SSL port (ssl-enabled=true) to communicate with the Controller UI, make sure that you copy the TrustStore files to the new directory. For example, copy the cacerts.jks from the old backup agent directory (<version>/conf/) to the new upgraded directory (<agent_home>/<version>/conf/). Also, make sure that the agent TrustStore file (cacerts.jks) is readable by the agent user.