eap-ttls and require a certificate along with username/password

How can i make freeradius require a certificate along with username/password with eap-ttls? Im using the latest version of FR. We need it to do the two step auth for our current backend user management. Thanks