IKED_REQ_CERTVALID
sa->sa_stateflags &= ~IKED_REQ_CERTVALID;
sa_stateflags(sa, IKED_REQ_CERTVALID);
sa->sa_statevalid |= IKED_REQ_CERTVALID|IKED_REQ_CERT;
diff = IKED_REQ_CERTVALID|IKED_REQ_AUTHVALID|IKED_REQ_SA|