services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.cacert.<name>.handle

Hex-encoded CKA_ID or handle of the certificate on a token or TPM, respectively.

Configure either this or file, but not both, in one section.