services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.file

Absolute path to the certificate to load. Passed as-is to the daemon, so it must be readable by it.

Configure either this or handle, but not both, in one section.