Then chances are that something's wrong with your client certificate. Apparently there was something wrong with how the certificate was imported -- I've tried a different format now (pkcs12), getting me one step further: The machine does now indeed respond to "Request Identity".
(Before that, importing in .der format, the certificate manager would hang for a few minutes when importing the cert, but eventually claim "Import successful".) The cert is generated by freeradius' makefile, however, the EAP session stalls and FR complains: | WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! | WARNING: !! EAP session for state 0xe0880a2ce3de07a8 did not finish! | WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility | WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! which seems a bit circular, but I'll try to resolve this myself before asking for further assistence. Thank you so far, Timo