Not a freeradius issue. Client issue. You will need to ensure that the mac had the CA root and any intermediates required installed. The .mobileconfig can be populated with these requirements. pkcs12 and pem are 'mac-friendliest' alan