# Create raft ha\_cluster. Certs error

**URL:** <https://discuss.hashicorp.com/t/create-raft-ha-cluster-certs-error/15604>\
**Category:** Vault\
**Created:** [October 14, 2020, 10:01am UTC](https://discuss.hashicorp.com/t/create-raft-ha-cluster-certs-error/15604 "2020-10-14T10:01:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ingtarius](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ingtarius/32/12667_2.png) [@ingtarius](https://discuss.hashicorp.com/u/ingtarius)\
**Post date:** [October 14, 2020, 10:01am UTC](https://discuss.hashicorp.com/t/create-raft-ha-cluster-certs-error/15604/1 "2020-10-14T10:01:02Z")

</div>

Hello! I try to create 2 node cluster with raft storage  
My config:

> ui = true  
> disable\_mlock = true
> 
> service\_registration “consul” {  
> address = “127.0.0.1:8500”  
> service = “vault”  
> service\_address = “”  
> }
> 
> storage “raft” {  
> path = “/vault/data”  
> node\_id = “vault\_1”
> 
> retry\_join {  
> leader\_api\_addr = “[https://vault1:8200](https://vault1:8200)”  
> leader\_ca\_cert = “/vault/ssl/rootCA.crt”  
> leader-client-cert = “/vault/ssl/vault1.crt”  
> leader-client-key = “/vault/ssl/vault1.key”  
> }  
> retry\_join {  
> leader\_api\_addr = “[https://vault2:8200](https://vault2:8200)”  
> leader\_ca\_cert = “/vault/ssl/rootCA.crt”  
> leader-client-cert = “/vault/ssl/vault2.crt”  
> leader-client-key = “/vault/ssl/vault2.key”  
> }  
> }
> 
> listener “tcp” {  
> address = “EXTERNAL\_IP:8200”  
> tls\_disable = false  
> tls\_cert\_file = “/vault/ssl/vault1.crt”  
> tls\_key\_file = “/vault/ssl/vault1.key”  
> tls\_client\_ca\_file = “/vault/ssl/rootCA.crt”  
> tls\_require\_and\_verify\_client\_cert = false  
> tls\_disable\_client\_certs = true  
> }
> 
> listener “tcp” {  
> address = “127.0.0.1:8200”  
> tls\_disable = false  
> tls\_cert\_file = “/vault/ssl/vault1.crt”  
> tls\_key\_file = “/vault/ssl/vault1.key”  
> tls\_client\_ca\_file = “/vault/ssl/rootCA.crt”  
> tls\_require\_and\_verify\_client\_cert = false  
> }
> 
> api\_addr = “[https://127.0.0.1:8200](https://127.0.0.1:8200)”
> 
> cluster\_addr = “[https://vault1:8201](https://vault1:8201)”
> 
> log\_level = “Debug”

First node is unsealed and work fine, but cant join second node. In logs i see this error:  
**x509: certificate signed by unknown authority**

I also use this envs:

> VAULT\_CACERT=/vault/ssl/rootCA.crt  
> VAULT\_SKIP\_VERIFY=true

Manual for certs creation - [Self Signed Certificate with Custom Root CA · GitHub](https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309)

Fun things - if i init and unseal second node (create separate raft cluster) and then run

> vault operator raft join “[https://vault1:8200](https://vault1:8200)”

it show me Joined ok message, but not changes in peer-list command from first node.