Firstly, 1. Thanks to Alan for letting me know that the freeradius image on Dockerhub does support EAP-TLS. That's very helpful :-) 2. Any by the process of logically writing out my question, I have solved my next problem. 3. Third problem: how can I tell if I have successfully started freeradius in debug mode? freeradius -v does not say which mode it is running in. Despite my attempts to start in debug mode, I suspect it is not in debug mode. This is how the Bob initial test result looks: Sent Access-Request Id 217 from 0.0.0.0:49095 to 127.0.0.1:1812 length 73 User-Name = "bob" User-Password = "test" NAS-IP-Address = 172.17.0.6 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "test" Received Access-Accept Id 217 from 127.0.0.1:1812 to 127.0.0.1:49095 length 38 Message-Authenticator = 0xdf169e01bb4399fada2b31bbde5e7ff3 So is it possible to tell from this whether freeradius is running in debug mode? Thank you! Kat