title: The '--ca-file' flag of etcdctl is useless?
body: <p>I have set up an <code>etcd</code> server with the command below:</p>
  
  <pre><code>etcd -name infra0 -initial-advertise-peer-urls http://192.168.99.240:2380 -listen-peer-urls http://192.168.99.240:2380 -listen-client-urls https://192.168.99.240:2379,https://127.0.0.1:2379 -advertise-client-urls https://192.168.99.240:2379 -initial-cluster-token etcd-cluster-1 -initial-cluster infra0=http://192.168.99.240:2380 -initial-cluster-state new -client-cert-auth -trusted-ca-file=/home/docker/ssl/ca.crt -cert-file=/home/docker/ssl/server.crt -key-file=/home/docker/ssl/server.key
  </code></pre>
  
  <p>And I can get data from it with <code>curl</code>:</p>
  
  <pre><code>curl --cacert /home/kubernetes/ssl/server.crt --cert /home/kubernetes/ssl/ca.crt --key /home/kubernetes/ssl/ca.key -L https://192.168.99.240:2379/v2/keys/coreos.com/network/config -XGET
  </code></pre>
  
  <p>The command above return:</p>
  
  <pre><code>{"action":"get","node":{"key":"/coreos.com/network/config","value":"{\"Network\":\"10.0.0.0/8\"}","modifiedIndex":10,"createdIndex":10}}
  </code></pre>
  
  <p>But when I use the <code>etcdctl</code>:</p>
  
  <pre><code>etcdctl --peers=https://192.168.99.240:2379 --ca-file=/home/kubernetes/ssl/server.crt --cert-file=/home/kubernetes/ssl/ca.crt --key-file=/home/kubernetes/ssl/ca.key ls
  </code></pre>
  
  <p>It return:</p>
  
  <pre><code>Error:  client: etcd cluster is unavailable or misconfigured
  error #0: x509: cannot validate certificate for 192.168.99.240 because it doesn't contain any IP SANs
  </code></pre>
  
  <p>I thought it is because the failed validation of certificate, so why does the <code>--ca-file</code> flag of <code>etcdctl</code> take effect? Or is there something wrong with my command?</p>
  
  <p>The etcd version I used is:</p>
  
  <pre><code>etcdctl --version
  etcdctl version 2.2.1
  </code></pre>