When I start wpa_supplicant as a service sudo service start wpa_supplicant (and the same issue if it is in a startup file), my laptop will not connect to an EAP network, with errors in /var/log/wpa_supplicant like:1478280999.154045: OpenSSL: pending error: error:2006D002:BIO routines:BIO_new_file:system lib1478280999.154052: OpenSSL: pending error: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib1478280999.154062: OpenSSL: tls_load_ca_der - Failed load CA in DER format error:0200100D:system library:fopen:Permission denied1478280999.154068: OpenSSL: pending error: error:20074002:BIO routines:FILE_CTRL:system lib1478280999.154074: OpenSSL: pending error: error:0B06F002:x509 certificate routines:X509_load_cert_file:system lib1478280999.154079: TLS: Failed to set TLS connection parameters1478280999.154085: EAP-TLS: Failed to initialize SSL.1478280999.154091: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS)1478281000.477040: CTRL-EVENT-EAP-FAILURE EAP authentication failed1478281002.477915: Authentication with 6c:f3:7f:af:fb:62 timed out.1478281002.493367: CTRL-EVENT-DISCONNECTED bssid=00:00:00:00:00:00 reason=01478281002.993907: Failed to initiate AP scan.1478281003.994183: Failed to initiate AP scan.1478281004.994662: Failed to initiate AP scan.1478281005.558072: Trying to associate with 6c:f3:7f:af:fb:72 (SSID='eduroam' freq=5825 MHz)1478281005.561055: Association request to the driver failed1478281005.569691: Associated with 6c:f3:7f:af:fb:721478281005.573148: CTRL-EVENT-EAP-STARTED EAP authentication started1478281005.845088: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=131478281005.845239: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:0200100D:system library:fopen:Permission denied1478281005.845268: OpenSSL: pending error: error:2006D002:BIO routines:BIO_new_file:system lib1478281005.845291: OpenSSL: pending error: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib1478281005.845326: OpenSSL: tls_load_ca_der - Failed load CA in DER format error:0200100D:system library:fopen:Permission denied1478281005.845348: OpenSSL: pending error: error:20074002:BIO routines:FILE_CTRL:system lib1478281005.845368: OpenSSL: pending error: error:0B06F002:x509 certificate routines:X509_load_cert_file:system lib1478281005.845383: TLS: Failed to set TLS connection parameters1478281005.845425: EAP-TLS: Failed to initialize SSL.1478281005.845446: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS)1478281007.073725: CTRL-EVENT-EAP-FAILURE EAP authentication failed1478281009.074324: Authentication with 6c:f3:7f:af:fb:72 timed out.The following is the relevant part of my /etc/wpa_supplicant/wpa_supplicant.log:ctrl_interface=/var/run/wpa_supplicantctrl_interface_group=wheelupdate_config=1network={    ssid=eduroam    proto=RSN    key_mgmt=WPA-EAP    pairwise=CCMP    group=CCMP    eap=TLS    identity=anonymous@CERN.CH    ca_cert=/home/chris/cert/ca.crt    client_cert=/home/chris/cert/cert.pem    private_key=/home/chris/cert/key.pem    private_key_passwd=LONGPASSWORD    priority=10}And my /etc/sysconfig/wpa_supplicant:# Use the flag -i before each of your interfaces, like so:#  INTERFACES=-ieth1 -iwlan0INTERFACES=-iwlan0# Use the flag -D before each driver, like so:#  DRIVERS=-DwextDRIVERS=-Dwext# Other arguments#   -u   Enable the D-Bus interface (required for use with NetworkManager)#   -f   Log to /var/log/wpa_supplicant.log#   -P   Write pid file to /var/run/wpa_supplicant.pid #        required to return proper codes by init scripts (e.g. double start action)#        -B to daemonize that has to be used together with -P is already in wpa_supplicant.init.d#   -t   include timestamp in debug messagesOTHER_ARGS=-f /var/log/wpa_supplicant.log -P /var/run/wpa_supplicant.pid -tOpen networks work fine, and all networks work fine if I run wpa_supplicant manually, as sudo wpa_supplicant -Dwext -c/etc/wpa_supplicant/wpa_supplicant.conf -iwlan0 -B.Edit: Some extra information- I have been able to access WPA2-PSK networks just fine, so it indeed appears to be specific to EAP-TLS.
Centos 6 EAP Authentication fails when wpa_supplicant is started as a service
centos;networking;services;wpa supplicant
It was a problem with SELinux permissions: running the command chcon -t NetworkManager_var_run_t on the certificates fixed it.