no trusted RSA public key found, strongswan, IKEv2

My setup:

Linux running strongswan server, 5.3, latest version.
Client is iPhone iOS 9.2

Trying to setup IKEv2 with certificate authentication. MS-CHAPv2 authentication works fine.

Issue: no trusted RSA public key found

After spending hours on the Internet, combing through the strongswan forums and even looking at the source code, I was able to finally find out the issue:

The issue was with the client certificate I generated for iPhone.

The certificate did not have a SAN (Subject Alternative Name). I never knew it was REQUIRED to have one.  This is how the check on the server goes:

1. Server needs to make sure a certificate is received from the client.
2. It then does the following checks:
    - cert is signed with a known CA.
    - cert date is valid
    - IMPORTANT: "local ID" specified on iOS has to be a FQDN, and has to match the SAN in the certificate.  SAN for FQDN starts with "DNS:". In theory, the ID can also be IPv4 address (IP:) or USER_FQDN with is an email address (email:). If no SAN is found in the cert, the server is supposed to match the DN of the cert, but iOS always submit the local ID as FQDN therefore breaking that, and therefore requiring an SAN for the client cert with the "DNS:" name.

strongswan log will not tell you this if the SAN and local ID does not match, even if turning debug level all the way to 3. It will just say "no trusted RSA public key found". Very confusing.

Well, now you know it.