What is VPN on demand, and how do I get it to work with iOS?
EDIT: This answer is outdated. Here are some newer links that may help you if you are trying to set up VPN On Demand:


https://support.apple.com/apple-configurator
https://support.apple.com/guide/mdm/vpn-overview-mdm2d2adb35d/1/web/1
https://developer.apple.com/documentation/devicemanagement/vpn
https://developer.apple.com/documentation/networkextension/personal_vpn/vpn_on_demand_rules




Yes, it does involve authentication by certificate. From this article from Apple:


  iOS supports VPN On Demand for networks that use certificated-based authentication. You specify which domains require a VPN connection by using a configuration profile.


The VPN connection is made whenever the device tries to connect to certain domains. Specific apps don't need to do anything; as soon as they try to access such a server the VPN connection is initiated.

Visit this support page for information about how to use the Configuration Utility to create a configuration profile that sets up VPN On Demand.