| echo "NSS_HAS_IPSEC_PROFILE = true" >> Makefile.inc.local This worked. More documentation or more automation might have made this easier. It is mentioned in testing/pluto/ikev2-x509-02-eku/description.txt but not in a way that was clear to me.