1. Does EAP-TTLS with MSCHAPv2 considered as a mutual authentication method?
It is probably best if you read RFC4017 for a full discussion of mutual authentication in the EAP context. FWIW, the short answer is "yes, it can be used in this way".
2. I understand that the TTLS itself can be mutual, meaning:
a. The client authenticates the server (via server certificate)
Yes.
b. A secured tunnel is created
c. The server authenticates the client (via client certificate)
Yes, this is possible but not necessary, because as you say...
d. The client authenticates itself again using MSCHAPv2.
e. The server also authenticates itself using MSCHAPv2. A challenge-response is piggy-backed on the MSCHAP exchange.
Does FreeRadius support this kind of Authentication?
Yes.
3. I received a root-certificate and I want to create trusted certificates.
a. Which software can I use sign a certificate with the root-certificate I received?
I doubt you received a root CA certificate. You probably got issued with a certificate signed by the root or an intermediate CA. However, I'm speculating - it is probably best to ask whomever provided the certificate directly. It is essential to understand precisely what is going on, because it is very easy to make mistakes with PKI... best regards, josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG