Freeradius certificate

Must contains OID = 1.3.6.1.5.5.7.3.1 (TLS Web Server Authentication)

The name in the Subject line of the server certificate matches the name that's configured on the client for the connection.

For wireless clients, the Subject Alternative Name SubjectAltName) extension contains the server's fully qualified domain name (FQDN).