How to add a cluster declaratively properly?

[lesomnus]

Im trying to deploy an Application to another cluster (not in-cluster), so I added Secret for cluster (argocd.argoproj.io/secret-type: cluster) with certificate as a credential but it does not work.
It reports: "cluster 'https://foo.com:6443/' has not been configured".
However, if I use argocd cluster add foo, the Application successfully deployed.
What is difference? Is it related to the service account (argocd-manager) that is created on the cluster foo when the cluster is added using CLI?
If so, why need another bearer token even I already provide a certificate to access the cluster foo.

I have tries followings but all failed:

• add cluster using CLI, then remove the secret and use my own secret yaml with same content, different secret name.
• using IP address for foo cluster.

only usinc CLI is OK.
What happens behind the scene?

[lesomnus]

It works after I added SAN for the domain foo in certificate of the cluster foo and set insecure to false.
But I'm not sure that was the problem, also I removed SA related resource in the cluster foo.