How can i make freeradius require a certificate along with username/password with eap-ttls?

Im using the latest version of FR.

We need it to do the two step auth for our current backend user management.

Thanks