@HermanAkv You could try using "co" for contains instead of "eq" equals - in case you haven't included the entire serial number in the output above (or obfuscated it), as the output looks too short for the entire serial number.
Using the certificate map isn't very scalable, as you have to have multiple IKEV2 Profiles, authorisation profiles etc for each match.
Name managler would be a better suggestion, you can use a common dVTI, IKEv2 profile and a unique authorisation policy, where the name of the authorisation policy exactly matches the name of the value extracted from the certificate using the name managler - however it does not support matching on serial number - only attributes from dn, email, fqdn or eap.
