rpi ~$ man wpa_supplicant.conf

# work network; use EAP-TLS with WPA; allow only CCMP and TKIP ciphers
network={
   ssid="work"
   scan_ssid=1
   key_mgmt=WPA-EAP
   pairwise=CCMP TKIP
   group=CCMP TKIP
   eap=TLS
   identity="user@example.com"
   ca_cert="/etc/cert/ca.pem"
   client_cert="/etc/cert/user.pem"
   private_key="/etc/cert/user.prv"
   # private_key_passwd="password"
}