Following the ipsec N/S feature, we could see the pk12util script fails due to incorrect password but there is no mention where to provide the password resulting into service failure.

~~~
sh-5.1# journalctl -xu ipsec-import
Nov 02 10:19:02 degcpe1-tsgjp-worker-c-kbxdg systemd[1]: Starting Import external certs into ipsec NSS...
░░ Subject: A start job for unit ipsec-import.service has begun execution
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit ipsec-import.service has begun execution.
░░
░░ The job identifier is 344.
Nov 02 10:19:02 degcpe1-tsgjp-worker-c-kbxdg ipsec-addcert.sh[943]: importing cert to NSS
Nov 02 10:19:02 degcpe1-tsgjp-worker-c-kbxdg ipsec-addcert.sh[970]: pk12util: PKCS12 decode not verified: SEC_ERROR_BAD_PASSWORD: The security password entered is incorrect.
Nov 02 10:19:02 degcpe1-tsgjp-worker-c-kbxdg ipsec-addcert.sh[970]: pk12util: PKCS12 decode validate bags failed: SEC_ERROR_INVALID_ARGS: security library: invalid arguments.
Nov 02 10:19:02 degcpe1-tsgjp-worker-c-kbxdg systemd[1]: ipsec-import.service: Main process exited, code=exited, status=18/n/a
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ An ExecStart= process belonging to unit ipsec-import.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 18.
Nov 02 10:19:02 degcpe1-tsgjp-worker-c-kbxdg systemd[1]: ipsec-import.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit ipsec-import.service has entered the 'failed' state with result 'exit-code'.
Nov 02 10:19:02 degcpe1-tsgjp-worker-c-kbxdg systemd[1]: Failed to start Import external certs into ipsec NSS.
░░ Subject: A start job for unit ipsec-import.service has failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit ipsec-import.service has finished with a failure.
░░
░░ The job identifier is 344 and the job result is failed.
sh-5.1#
~~~

Re creating the butane file using the certificate as mentioned below, fixed the issue and should be done in the script as well..

~~~
Fixed using this
sh-5.1# pk12util -W "<Password_goes_here>" -i /etc/pki/certs/left_server.p12 -d /var/lib/ipsec/nss/
pk12util: no nickname for cert in PKCS12 file.
pk12util: using nickname: usercert1.xx.xx:ipsec_fabric_2.0 - Deutsche Bank AG
pk12util: PKCS12 IMPORT SUCCESSFUL
sh-5.1#
~~~

1.
2.
3.