services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.rekey_time

Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key material, optionally using a Diffie-Hellman exchange if a group is specified in the proposal.

To avoid rekey collisions initiated by both ends simultaneously, a value in the range of rand_time gets subtracted to form the effective soft lifetime.

If life_time is explicitly configured, rekey_time defaults to 10% less than that, otherwise, CHILD_SA rekeying is scheduled every hour, minus rand_time.