Keyset does not exist

I got this alert for an agent:

Alert name: System Center Management Health Service Unable to Process New Configuration
Alert description: The System Center Management Health Service 6C0DB9CB-3E55-748A-954A-577E3DBEAEF7 running on host NAME and serving management group with id {00E1446C-53D6-E622-676C-FFCE6C114CBE} is not healthy. System Center Management Health Service is unable to process or load configuration.

I tried the usual fixes but it wouldn't connect. Looking in the ops log I saw this event:

Event Id: 7022
Source: HeathService
Description: The Health Service has downloaded secure configuration for management group NAME, and processing the configuration failed with error code Keyset does not exist(0x80090016).

Instruction to fix are here. Basically you need to delete the certificate in MMC > Certificates > Computer account > Operations Manager > Certificates then restart the health service.

You can backup the certificate before deleting but you can't export the private key. Select Base-64 encoded X.509 (.CER).