pfSense

I am also having this problem with 2.4.2.

Command line doesn't help either:

swanctl --list-sas
connecting to 'unix:///var/run/charon.vici' failed: Connection refused
Error: connecting to 'default' URI failed: Connection refused
strongSwan 5.6.0 swanctl

status_ipsec.php and widget use these functions:

ipsec_dump_spd(); - # /sbin/setkey -DP
ipsec_dump_sad(); - # /sbin/setkey -D
ipsec_dump_mobile(); - # /usr/local/sbin/ipsec leases
ipsec_list_sa(); - pfSense_ipsec_list_sa() (use /usr/local/sbin/swanctl --list-sas (?))

setkey -DP and setkey -D show the correct output, but two other commands:

/usr/local/sbin/ipsec leases
connecting to 'unix:///var/run/charon.ctl' failed: Connection refused
failed to connect to stroke socket 'unix:///var/run/charon.ctl'
/usr/local/sbin/swanctl --list-sas

connecting to 'unix:///var/run/charon.vici' failed: Connection refused
Error: connecting to 'default' URI failed: Connection refused
strongSwan 5.7.1 swanctl
usage:
swanctl --list-sas [--raw|--pretty]

similar issues:
https://wiki.strongswan.org/issues/1484 - It was all due to insufficient "Max open files" limit for the user used to run charon.
https://wiki.strongswan.org/issues/3294 - The # character is used for comments (the rest of the line is ignored). To use it in a config value (e.g. a secret) enclose the whole thing in double quotes

You are chasing the wrong end of the problem. We know that it can't talk to the VICI socket. What we do not know is why there are other processes stuck talking to the VICI socket before it reaches that point. Something is consuming all the available sockets and is stuck waiting there.

it works OK if you disable IPsec Mobile

"Several of the threads from the thread pool are "reserved" for long running tasks in internal modules and plugins." (strongswan)
https://wiki.strongswan.org/projects/strongswan/wiki/JobPriority

plugins part of the strongswan.conf:

plugins {
        # Load defaults
        include /var/etc/ipsec/strongswan.d/charon/*.conf        
                stroke {
            secrets_file = /var/etc/ipsec/ipsec.secrets
        }        unity {
            load = no
        }
        attr {
            subnet = x.x.x.x/y
            split-include = x.x.x.x/y
            # Search domain and default domain
            28674 = "xxx.int" 
            28675 = "xxx.int" 
            28672 = "Welcome to xxx.int" 
        }
        xauth-generic {
            script = /etc/inc/ipsec.auth-user.php
            authcfg = AD
        }    
}

That doesn't quite line up because strongSwan may have many worker threads running, but it still only has a few open spots for the vici socket.

Consider this on 2.5.0:

: swanctl --stats | grep threads
worker threads: 16 total, 10 idle, working: 5/0/1/0

: netstat -Lan 
Current listen queue sizes (qlen/incqlen/maxqlen)
Proto Listen                           Local Address  
[...]
unix  0/0/3                            /var/run/charon.vici

16 threads, 10 idle, but only 3 total sockets in the listen queue for VICI.