diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index 0a8fc2905..b9f6b79b1 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -254,6 +254,7 @@ typedef struct {
 	char *handle;
 	uint32_t slot;
 	char *module;
+	char *file;
 } cert_data_t;
 
 /**
@@ -263,6 +264,7 @@ static void free_cert_data(cert_data_t *data)
 {
 	free(data->handle);
 	free(data->module);
+	free(data->file);
 	free(data);
 }
 
@@ -1402,6 +1404,7 @@ CALLBACK(cert_kv, bool,
 		{ "handle",			parse_string,		&cert->handle				},
 		{ "slot",			parse_uint32,		&cert->slot					},
 		{ "module",			parse_string,		&cert->module				},
+		{ "file",			parse_string,		&cert->file					},
 	};
 
 	return parse_rules(rules, countof(rules), name, value,
@@ -1556,30 +1559,46 @@ CALLBACK(auth_sn, bool,
 			free_cert_data(data);
 			return FALSE;
 		}
-		if  (!data->handle)
+		if  (!data->handle && !data->file)
 		{
-			auth->request->reply = create_reply("CKA_ID missing: %s", name);
+			auth->request->reply = create_reply("handle or file path missing: "
+												"%s", name);
+			free_cert_data(data);
+			return FALSE;
+		}
+		else if (data->handle && data->file)
+		{
+			auth->request->reply = create_reply("handle and file path given: "
+												"%s", name);
 			free_cert_data(data);
 			return FALSE;
 		}
 
-		handle = chunk_from_hex(chunk_from_str(data->handle), NULL);
-		if (data->slot != -1)
+		if (data->file)
 		{
 			cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
-							BUILD_PKCS11_KEYID, handle,
-							BUILD_PKCS11_SLOT, data->slot,
-							data->module ? BUILD_PKCS11_MODULE : BUILD_END,
-							data->module, BUILD_END);
+								BUILD_FROM_FILE, data->file, BUILD_END);
 		}
 		else
 		{
-			cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
-							BUILD_PKCS11_KEYID, handle,
-							data->module ? BUILD_PKCS11_MODULE : BUILD_END,
-							data->module, BUILD_END);
+			handle = chunk_from_hex(chunk_from_str(data->handle), NULL);
+			if (data->slot != -1)
+			{
+				cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
+								CERT_X509, BUILD_PKCS11_KEYID, handle,
+								BUILD_PKCS11_SLOT, data->slot,
+								data->module ? BUILD_PKCS11_MODULE : BUILD_END,
+								data->module, BUILD_END);
+			}
+			else
+			{
+				cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
+								CERT_X509, BUILD_PKCS11_KEYID, handle,
+								data->module ? BUILD_PKCS11_MODULE : BUILD_END,
+								data->module, BUILD_END);
+			}
+			chunk_free(&handle);
 		}
-		chunk_free(&handle);
 		free_cert_data(data);
 		if (!cert)
 		{
diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index 0bf1243d0..f749564ea 100644
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -299,9 +299,21 @@ connections.<conn>.local<suffix>.cert<suffix> =
 	in _certs_ are transmitted as binary blobs, these sections offer more
 	flexibility.
 
+connections.<conn>.local<suffix>.cert<suffix>.file =
+	Absolute path to the certificate to load.
+
+	Absolute path to the certificate to load. Passed as-is to the daemon, so it
+	must be readable by it.
+
+	Configure either this or _handle_, but not both, in one section.
+
 connections.<conn>.local<suffix>.cert<suffix>.handle =
 	Hex-encoded CKA_ID of the certificate on a token.
 
+	Hex-encoded CKA_ID of the certificate on a token.
+
+	Configure either this or _file_, but not both, in one section.
+
 connections.<conn>.local<suffix>.cert<suffix>.slot =
 	Optional slot number of the token that stores the certificate.
 
@@ -442,9 +454,21 @@ connections.<conn>.remote<suffix>.cert<suffix> =
 	in _certs_ are transmitted as binary blobs, these sections offer more
 	flexibility.
 
+connections.<conn>.remote<suffix>.cert<suffix>.file =
+	Absolute path to the certificate to load.
+
+	Absolute path to the certificate to load. Passed as-is to the daemon, so it
+	must be readable by it.
+
+	Configure either this or _handle_, but not both, in one section.
+
 connections.<conn>.remote<suffix>.cert<suffix>.handle =
 	Hex-encoded CKA_ID of the certificate on a token.
 
+	Hex-encoded CKA_ID of the certificate on a token.
+
+	Configure either this or _file_, but not both, in one section.
+
 connections.<conn>.remote<suffix>.cert<suffix>.slot =
 	Optional slot number of the token that stores the certificate.
 
@@ -465,9 +489,21 @@ connections.<conn>.remote<suffix>.cacert<suffix> =
 	in _cacerts_ are transmitted as binary blobs, these sections offer more
 	flexibility.
 
+connections.<conn>.remote<suffix>.cacert<suffix>.file =
+	Absolute path to the certificate to load.
+
+	Absolute path to the certificate to load. Passed as-is to the daemon, so it
+	must be readable by it.
+
+	Configure either this or _handle_, but not both, in one section.
+
 connections.<conn>.remote<suffix>.cacert<suffix>.handle =
 	Hex-encoded CKA_ID of the CA certificate on a token.
 
+	Hex-encoded CKA_ID of the CA certificate on a token.
+
+	Configure either this or _file_, but not both, in one section.
+
 connections.<conn>.remote<suffix>.cacert<suffix>.slot =
 	Optional slot number of the token that stores the CA certificate.