Raft join from CLI seems to be ignoring -tls-skip-verify

[SK360]

Describe the bug
When we have TLS enabled on a listener with a self signed cert, we are unable to join raft node due to cert signed by unknown authority error. It seems to be ignoring the -skip-tls-verify flag.

To Reproduce
[vault@Vault-002 ~]$ vault operator raft join -tls-skip-verify https://10.255.12.209:8200
Error joining the node to the raft cluster: Error making API request.

URL: POST https://127.0.0.1:8200/v1/sys/storage/raft/join
Code: 500. Errors:

• failed to join raft cluster: error during bootstrap init call: Put https://10.255.12.209:8200/v1/sys/storage/raft/bootstrap/challenge: x509: certificate signed by unknown authority

Expected behavior
I expect it to trust the unknown authority and join the cluster

Environment:

• Vault Server Version (retrieve with vault status): 1.2.0
• Vault CLI Version (retrieve with vault version): 1.2.0
• Server Operating System/Architecture: CentOS7

Vault server configuration file(s):

storage "raft" {
  path    = "/var/vault/raft"
  node_id = "Vault-001"
}

cluster_addr = "https://10.255.12.209:8201"
api_addr = "https://10.255.12.209:8200"

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_cert_file = "/etc/vault/tls/vault-cert.pem"
  tls_key_file = "/etc/vault/tls/vault-key.pem"
}

Additional Info
I also tried setting VAULT_SKIP_VERIFY env variable with no luck

[leventyalcin]

I have the very same issue but not limited with that.

The cluster is using the very same certificate on all the nodes. So that, I've tried to set VAULT_CACERT with the correct CA file but didn't help.

When I checked what options I have with join command, I've noticed -leader-ca-cert, -leader-client-cert and -leader-client-key. While I'm giving the correct certs and the key, I've got following error.

* tls: failed to find any PEM data in certificate input

I've also added -client-cert, -client-key and -ca-cert, but the result is the same.

I also added the CA to the trusted chain. While curl-ing the API is OK without -k or giving the CA cert, RAFT isn't working.

[krabradosty]

I've got the same error. But I use not a self-signed certificate. Instead, I configure Vault nodes with a certificates chain (server certificate + root CA certificate).
And, as I understand, -tls-skip-verify is used for client-server communication, but the problem is in establishing server-server tls communication.
Error still occurs after I added the root CA certificate to the host's trusted certificates store.

[krabradosty]

Seems like this PR fixes the bug https://github.com/hashicorp/vault/pull/7393/files/81e2f5c310c2623f8af88ba5c93b538d44746e70

[leventyalcin]

Whoa! Nice catch @krabradosty and thanks for the ping. On the PR, it seems tagged for the release 1.2.3 but still not in the CHANGELOG unfortunately. I'm pretty sure will be released with the new version 🤞

[michelvocks]

Closing this since #7393 has been merged.