Cisco 8821 Manual page 33

EAP-TLS may also require a user account to be created on the authentication server matching the common name of the
certificate imported into the Cisco Wireless IP Phone 8821 or 8821-EX.
It is recommended to use a complex password for this user account and that EAP-TLS is the only EAP type enabled on the
RADIUS server.
Cisco Wireless IP Phone 8821 and 8821-EX Wireless LAN Deployment Guide
33