I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS.
I have therefor created a user certificate and a user within the FreeRADIUS user management (including password). The certificates CN field matches the username. Then I converted the certificate/key into a password-protected #PCKS12 container and installed it on my iOS devices (where it is being called profile).
When setting up the WLAN connection on my iPhone 5 it asks me for a profile and a username. But i never get asked for a password.
My security-protocol knowledge is limited and I don't understand why I don't have to enter a password when accessing my WLAN (or at least when setting it up). The only time I had to enter a password was when I was installing the certificate, which I guess is only used to decrypt the keys and certificate.
Currently I am thinking of EAP-TLS as a two-factor authentication consisting of username/password and a private key (certificate).
So is there something wrong in the way I configured FreeRADIUS or do I have a wrong understanding on how EAP-TLS works and what it provides?