IKEv2 IPSEC with signature auth

FG Config

FortiGate # show vpn ipsec phase1-interface BIA

config vpn ipsec phase1-interface

 edit "BIA"

 set interface "wan1"

 set ike-version 2

 set local-gw LocalIP

 set authmethod signature

 set peertype any

 set proposal aes256-sha256

 set dpd disable

 set dhgrp 21

 set nattraversal disable

 set remote-gw RemoteIP

 set certificate "VPN3"

 next

end

FortiGate # show vpn ipsec phase2-interface BIA

config vpn ipsec phase2-interface

 edit "BIA"

 set phase1name "BIA"

 set proposal aes256-sha256

 set dhgrp 21

 set src-addr-type name

 set dst-addr-type name

 set keylifeseconds 28800

 set src-name "local_10.254.211.0"

 set dst-name "BIA_Remote"

 next

end

And still I  get signature verification Failed.

VPN3 (Local Certificate) and Remote Certificate are both signed by same CA.

Certificates have CN=Local/RemoteIP

  X509v3 Extended Key Usage:                 TLS Web Client Authentication, ipsec Internet Key Exchange  X509v3 Key Usage: critical                 Digital Signature, Key Encipherment, Data Encipherment

Manual verification of CA and certificates is ok.

Can anyone give me any tip what`s going on?

PSK works fine so it`s not a problem of Policies.