Why is user and CA certificate required for IKEv2 RSA VPN? It should work similarly as to going to a random HTTPS website, where the supplied certificate is backed by a CA, and based on which a secure connection is made. Then authentication follows over the secure connection. 

So why am I required to supply both user and CA certificates. In other words, why is it not merely an option?

Edit: now that I look at it, it seems that no user nor password can be supplied either, so the client authentication happens based on the user certificate. Only for PPTP a password is required (which is not a secure protocol anyway). So the question becomes: why have they chosen to support only IKEv2 with user certificates and not passwords. It can not be for security reasons since PPTP is supported.
As the name implies, the VPN type IKEv2/IPSec RSA [sic, it should actually be "IPsec" not "IPSec"] is for client authentication with an RSA certificate/key. The name was probably chosen for consistency with the existing IKEv1-based VPN types (e.g. "L2TP/IPSec RSA" or "IPSec Xauth RSA"), it might also work with ECDSA certificates/keys not only RSA, but I did not test that.

There were two other IKEv2 VPN types added in Android 11/R's built-in VPN client:


IKEv2/IPSec PSK for authentication of both client and server with a pre-shared key (PSK), which is not an ideal choice for remote access connections as anybody who knows the PSK can impersonate the server (an active attacker can retrieve the PSK hash and attack it via brute-force/dictionary attack).
IKEv2/IPSec MSCHAPv2 for client authentication with username/password using EAP-MSCHAPv2. The server is theoretically authenticated with a certificate first so the password hash is only sent to a trusted peer. However, this verification is apparently not mandatory in this client and disabled by default (don't verify server), which makes this VPN type vulnerable to active attackers unless the user makes sure to install and select the correct CA/server certificate.


For an IKEv2/IPsec VPN client with more options (e.g. split-tunneling, app filtering), you could use the open-source strongSwan VPN client app, which also works on older Android versions. (Disclaimer: I'm a developer for the strongSwan project.)