TLS questions

Hi, 1). I'm looking to reject external incoming TLS auth . requests with client certs containing a specific pattern in their CN. Other than configuring check-eap-tls and linking it into /etc/freeradius/sites-enabled, is there anything else I need to do ? 2). I've just downloaded 3.0.20 and when firing up on my test server I get a message recommending that I set min_tls to 1.2 ..... fine but where do I configure it? Rgds A