Okay so it's Tunneled TLS
All I got was this:
EAP-TTLS Authentication Protocol. EAP-TTLS (Tunneled Transport Layer Security) is designed to provide authentication that is as strong as EAP-TLS, but it does not require that each user be issued a certificate. Instead, only the authentication servers are issued certificates. The authentication server's certificate is used to establish a tunnel between the user and the server. After the tunnel is established, credentials can be exchanged safely between the server and the user because tunnels encrypt all data in a secure fashion. This stage is called inner authentication.
What I don't understand why if it's Tunneled does that mean that clients don't need certificates anymore? Isn't the certificate needed for the client to prove who he is?