Cisco 8861 Deployment Manual page 156

Will need to restart the Cisco IP Phone 8861 or 8865 after all certificates are installed.
Server Certificate
The root CA certificate that issued the RADIUS server's certificate must be installed for EAP-TLS or to enable Server
Validation for PEAP-GTC or PEAP-MSCHAPV2.
To manually install a server certificate, select Install for Authentication Server CA on the main certificates webpage.
Select Browse to point to the server certificate with PEM (Base-64) or DER encoding.
Will need to restart the Cisco IP Phone 8861 or 8865 after all certificates are installed.
Cisco IP Phone 8861 and 8865 Wireless LAN Deployment Guide
156