That did it! The new strongswan.conf is more like this: charon { start-scripts { # creds = /usr/local/sbin/swanctl --load-creds # <-- this line was the problem conns = /usr/local/sbin/swanctl --load-conns # <-- this line seems to imply loading creds mentioned in swanctl.conf } }