I have tried to get the hotfix and new agent to work, but it isn't compatible with our environment. First, the PAinstaller fails to intall the certificate into any user home, if the username contains a dot, as is with ours: stephan.budach. Second this hotfix does only install itself into the user home directly, so the Mac agent can't be mass-deployed, which is especially bad, since - should we ever overcome the first issue, it will bug everybody with the installation.
Is there anyway, I can address at least the first issue, as this is a real misconception… you simply can't assume anything about a username, other not having any non-printable characters.