Failed to start the IKEv2 VPN connection to surfshark via NetworkManager

charon-nm[5070]: 13[CFG] subject certificate invalid (valid from Apr 12 17:41:01 2021 to Jun 11 17:41:01 2021)

Apparently, the certificate of the RADIUS server that requested EAP-PEAP has expired, but the subject with all that "example" stuff looks weird anyway (unless you modified that). Why Windows would accept that, if it actually uses EAP-PEAP, I don't know.

You could try to disable the eap-peap plugin and hope the server supports other EAP methods (e.g. EAP-MD5 or EAP-MSCHAPv2). To do so add the following to strongswan.conf:

charon-nm {
  plugins {
    eap-peap {
      load = no
    }
  }
}