Certificate request payloads can be sent in pretty much any IKEv1 message.