services.strongswan-swanctl.swanctl.authorities.<name>.handle

Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively.

Configure either this or file, but not both, in one section.