Libreswan on Debian requires libnss3-tools as an installed dependency. libnss3-tools provides certutil. certutil requred for instantiating a new nss database in ipsec.d/ via 'ipsec initnss'