eaptls certificate question

My radius does an eaptls 802.1x authentication with looking into AD to get group information and finally consulting the users file, to assign the correct vlan. This works without problems. When I configure another certificate_file/private_key_file in eap.conf, the authentication process does not succeed. The obvious difference between the working and the not working configuration is, that in the bad case, the certificate is issued by an intermediate ca, not by the root ca. May this chaining have negative influence on the configuration? If this is not the case, maybe another reason may be found in radiusd -AX's lengthy output: http://www.wegener-net.de/fr/typescript Thanks Norbert Wegener