When starting the secondary node we see:

Checking system requirements
Running the node status checks...
You attempted to start the node node2.company.com which is not the previously active node.
Start the previously active node node1.company.com first and then start this node.

Note: You can skip this validation and start the node by running the command below. By doing so, you will lose the cell events/data stored on the previously active node node1.company.com, which have not yet been replicated to this node. Before running the following command, BMC recommends that you review error code 101387 in the product documentation (https://docs.bmc.com) to manually sync the events/data.

Usage: pw system start [force] skipHAcheck

 

First, check for port connectivity:


Note that the ports need to be available between the nodes outside of the Load Balancer as well.  For example:
From node1:
telnet node2.company.com 443
telnet node2.company.com 1828
telnet node2.company.com 11590
telnet node2.company.com 10590

From node2:
telnet node1.company.com 443
telnet node1.company.com 1828
telnet node1.company.com 11590
telnet node1.company.com 10590

If you don't have telnet, use ssh for the test.  For example:
ssh node2.company.com -p 443

If the ports are open, run the following to find out what is happening behind the scenes during the test for availability during startup:
cd ./pronto/bin
./runjava com.proactivenet.ha.runtime.TsimRestartSequenceManager

This will print the output to the screen. Eventually no new information will display. Hit ^C to get out. Send the output to BMC.

For example:
[...]
ERROR 02/05 09:29:16 haruntime            [main] 300446 BMC-TSIM-HA:  An error occurred while retrieving Primary Node [node1.company.com] status sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
staus=isMaster:false, isActive:false, isHAEnabled:false

The above implies a certificate problem which needs to be corrected.
To resolve it, 
Import intermediate(if it's there) and root CA certs in Java truststore cacerts.
i.e.
keytool -importcert -trustcacerts -alias root -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit -file Root.cer
keytool -importcert -trustcacerts -alias intermediateCA -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit -file Intermidiate.cer