Thanks for the additional information.
First of all: Automatic registration doesn’t work yet, sorry. The agent pairing ruleset got added accidentally to Checkmk 2.1 and has no effect. It will be removed with p12: Remove preliminary agent pairing ruleset
Can you rule out that a 2.1 agent (and with it the agent controller) has been installed to that test system before?
On initial update from 2.0 to 2.1, the agent controller should work in legacy mode and allow non-TLS connections. But as soon as there is or has been an agent controller on the system, the legacy case won’t be detected anymore and the agent controller won’t open a port without registration.