Note, The following only works on firmware 5.7 or smaller, I have found no way to make the new dynamic connect version of netagent starting from fw 5.8 work :-(

Adjust the following configs like this:

network.cfg

wifi.9.cacert=yourcert.crt
wifi.9.eapmethod="auth=PAP"
wifi.9.eaptype=TTLS
wifi.9.essid=eduroam
wifi.9.key_and_password_encrypted=0
wifi.9.mode=0
wifi.9.name=eduroam
wifi.9.password=yourpassword
wifi.9.proxy=0
wifi.9.security=2
wifi.9.username=user@realm

network.json

[ {
  "id": "wifi",
  "cacert": "yourcert.crt",
  "essid": "eduroam",
  "hidden": 0,
  "idle": 10,
  "key": "",
  "mode": 0,
  "security": 2,
  "wepmode": 0,
  "eaptype": "TTLS",
  "username": "user@realm",
  "usercert": "",
  "password": "yourpassword",
  "eapmethod": "\"auth=PAP\"",
  "network_param": { "ipconfig": 0, "dns_list": [ "", "" ] }
} ]

and put the certificate file into I:\system\Certificates