This message was deleted.

With help from @powerful-easter-15334 in the following thread, we worked around this issue. I had to make

/etc/systemd/system/rancherd.service.d/override.conf

containing this contents:

[Service]
Environment=CATTLE_AGENT_STRICT_VERIFY=false

And then did

sudo systemctl daemon-reload

and

sudo systemctl restart rancherd.service

and this node joined the cluster. What I haven't tested is whether I need to edit

/oem/90_custom.yaml

for the work-around to stick.

Awesome, thanks a lot