For authentication methods that depend on validating a client certificate against a CA (e.g. EAP-TLS), we currently do not explicitly tell strongswan which CA to use. All CAs configured for any remote access VPN configuration are loaded into strongswan so one remote access configuration will accept a client certificate signed by the CA configured on another connection.