Hi Andi,<br>               1st I am no expert .For your first Q , private_key_password= &quot;your pass&quot; is missing from your eap.conf under tls section may be this is why you have to enter the password manually.<br><br>
This is how my tls section is<br>tls {<br>         rsa_key_exchange = no                                                                                                               <br>        dh_key_exchange = yes                                                                                                               <br>
        rsa_key_length = 512                                                                                                                <br>        dh_key_length = 512                                                                                                                 <br>
        verify_depth = 0                                                                                                                    <br>        CA_path = &quot;/etc/raddb/certs&quot;                                                                                                        <br>
        pem_file_type = yes                                                                                                                 <br>        private_key_file = &quot;/etc/raddb/certs/private.pem&quot;                                                                                   <br>
        certificate_file = &quot;/etc/raddb/certs/server.pem&quot;                                                                                    <br>        CA_file = &quot;/etc/raddb/certs/ca.pem&quot;                                                                                                 <br>
        private_key_password = &quot;whatever&quot;                                                                                                   <br>        dh_file = &quot;/etc/raddb/certs/dh&quot;                                                                                                     <br>
        random_file = &quot;/etc/raddb/certs/random&quot;                                                                                             <br>        fragment_size = 1024                                                                                                                <br>
        include_length = yes                                                                                                                <br>        check_crl = no                                                                                                                      <br>
        cipher_list = &quot;DEFAULT&quot;                                                                                                             <br>        make_cert_command = &quot;/etc/raddb/certs/bootstrap&quot;<br>
}<br><br>Try the configuration. This is the default one except private_key_file name changed.<br><br>Regards,<br>Prateek<br>