[Design] a question about x509cert exchange

Hello,

There is problem torturing me for two days. I don't know whether the hosts needed to exchange their certificate if they built one secure channel between them based on x509cert. If I designed ipsec.conf for two hosts like following, I always got error;

"no RSA public key known for (ip address of peer)"

ipsec.conf for host (10.10.10.112)

    config setup

        interfaces=%defaultroute
        klipsdebug=none
        plutodebug=none
        plutoload=%search
        plutostart=%search
        uniqueids=yes

    conn %default
        keyingtries=1
        compress=yes
        disablearrivalcheck=no
        authby=rsasig
        leftrsasigkey=%cert
        rightrsasigkey=%cert

    conn one-one
        right=10.10.10.114
        rightid="####"

        #don't install certificate of 10.10.10.114 in 10.10.10.12 

        #rightcert=x509cert_no3.der


        # local host is left


        left=10.10.10.112
        leftcert=x509cert_no1.der
        auto=add
        pfs=yes

ipsec.conf for host (10.10.10.114)

    config setup

        interfaces=%defaultroute
        klipsdebug=none
        plutodebug=none
        plutoload=%search
        plutostart=%search
        uniqueids=yes

    conn %default
        keyingtries=0
        compress=yes
        disablearrivalcheck=no
        authby=rsasig
        leftrsasigkey=%cert
        rightrsasigkey=%cert

    conn one-one
        left=10.10.10.112
        leftcert=x509cert_no1.der
        right=10.10.10.114
        rightcert=x509cert_no3.der
        auto=add
        pfs=yes


_______________________________________________