Why RSA-sig authentication VPN need its own private key? In my understanding, RSA-sig authentication only requires its own Public Key so that the peer authenticates it using Root CA's public key. But, strongSwan VPN configuration requires its own private key. I can't understand it. Am I wrong about RSA-Sig authentication or is strongSwan using RSA encryption?
In my understanding, RSA-sig authentication only requires its own Public Key so that the peer authenticates it using Root CA's public key.

No, that is not how PKI (Public Key Infrastructure) works.  Yes, the CA does issue a certificate (authenticated by the root CA's public key), however the certificate just says &quot;this specific public key corresponds to a private key owned by themasterplan&quot;.
That is, a certificate is a way to bind a public key (which is a series of random-looking bits) to an identity (a label that is meaningful to the reader of the certificate); it is one way to solve the question &quot;how do we know that this particular public key is from who we want to talk to&quot;.
So, to meaningfully authenticate yourself with a certificate, you need your own private key (so that the certificate can refer to your public key); that is the public/private key that StrongSwan requires.
And, a StrongSwan service authenticates itself by sending its certificate (so that the peer knows and can verify the public key), as well as a signature (to prove that the StrongSwan implementation has the private key that the certificate refers to).