krackattacks/wpa_supplicant/examples/wpa2-eap-ccmp.conf

# WPA2-EAP/CCMP using EAP-TLS

ctrl_interface=/var/run/wpa_supplicant

network={
	ssid="example wpa2-eap network"
	key_mgmt=WPA-EAP
	proto=WPA2
	pairwise=CCMP
	group=CCMP
	eap=TLS
	ca_cert="/etc/cert/ca.pem"
	private_key="/etc/cert/user.p12"
	private_key_passwd="PKCS#12 passhrase"
}