ikev2: Only send one certificate request for the same CA