Sorry, I found reason. In my config this option `require_client_cert = yes` was set to `no` `tls` file accidentally was copied from very old freeradius release Again, thank you for answers.