EAP-TLS certificate question