Strongswan: Two cert-based ike2 connections in parallel: Conflict?

Question

any help on the following issue is highly appreciated:

I cannot use the two cert-based connections below (conn one and conn two) in parallel. Individually (so commenting out one of them), they work perfectly (so the locally installed ca-certs as well as the one in the server are ok).

Strongswan is running on a kubernetes cluster using the latest vimagick/strongswan image but that shouldn't matter. BTW, the site-2-site connection works perfectly as well.

Any ideas?

apiVersion: v1 kind: ConfigMap metadata: labels: app: config-strongswan name: config-strongswan data: ipsec.conf: | conn sts-base fragmentation=yes dpdaction=restart ike=aes256-sha384-modp2048,aes256-sha512-modp2048 esp=aes256-sha384-modp2048,aes256-sha512-modp2048 keyingtries=%forever leftauth=psk rightauth=psk

conn site-2-site
    also=sts-base
    keyexchange=ikev2
    leftsubnet=12.15.207.0/24
    rightsubnet=192.168.4.0/28
    right= 87.138.155.173
    auto=route
    
conn one
    auto=add
    compress=no
    type=tunnel
    keyexchange=ike
    fragmentation=yes
    forceencaps=yes
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    [email protected]
    leftcert=servercert1.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightsourceip=10.10.10.0/24
    rightdns=8.8.8.8,8.8.4.4
    rightsendcert=never
    eap_identity=one
    
#conn two
#    auto=add
#    compress=no
#    type=tunnel
#    keyexchange=ike
#    fragmentation=yes
#    forceencaps=yes
#    dpdaction=clear
#    dpddelay=300s
#    rekey=no
#    left=%any
#    [email protected]
#    leftcert=servercert2.pem
#    leftsendcert=always
#    leftsubnet=0.0.0.0/0
#    right=%any
#    rightid=%any
#    rightauth=eap-mschapv2
#    rightsourceip=10.0.1.0/24
#    rightdns=8.8.8.8,8.8.4.4
#    rightsendcert=never
#    eap_identity=two

ipsec.secrets: | : PSK 'xxxxx' : RSA "serverkey1.pem" : RSA "serverkey2.pem" one : EAP "one_password" two : EAP "two_password"

Here is the iptables config:

Generated by iptables-save v1.8.6 on Wed Apr 28 15:15:46 2021

  *mangle
  :PREROUTING ACCEPT [1524:546941]
  :INPUT ACCEPT [625:222172]
  :FORWARD ACCEPT [814:310269]
  :OUTPUT ACCEPT [386:140400]
  :POSTROUTING ACCEPT [1200:450669]
  -A FORWARD -s 10.10.10.0/24 -o eth0 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
  COMMIT
  # Completed on Wed Apr 28 15:15:46 2021
  # Generated by iptables-save v1.8.6 on Wed Apr 28 15:15:46 2021
  *filter
  :INPUT ACCEPT [625:222172]
  :FORWARD ACCEPT [814:310269]
  :OUTPUT ACCEPT [386:140400]
  COMMIT
  # Completed on Wed Apr 28 15:15:46 2021
  # Generated by iptables-save v1.8.6 on Wed Apr 28 15:15:46 2021
  *nat
  :PREROUTING ACCEPT [161:20962]
  :INPUT ACCEPT [4:1692]
  :OUTPUT ACCEPT [0:0]
  :POSTROUTING ACCEPT [0:0]
  -A POSTROUTING -s 10.10.10.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
  -A POSTROUTING -s 10.0.1.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
  -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE
  -A POSTROUTING -s 10.0.1.0/24 -o eth0 -j MASQUERADE
  # COMMITOUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE
  COMMIT