optional certificate-based peer authentication on TLS server side

src/libcharon/plugins/eap_tls/eap_tls.c

@@ -433,8 +433,8 @@ static eap_tls_t *eap_tls_create(identification_t *server,
 		.is_server = is_server,
 	);
 	/* MSK PRF ASCII constant label according to EAP-TLS RFC 5216 */
-	this->tls = tls_create(is_server, server, peer, "client EAP encryption",
-						   NULL);
+	this->tls = tls_create(is_server, server, peer, TRUE,
+						   "client EAP encryption", NULL);
 
 	return &this->public;
 }

src/libcharon/plugins/eap_ttls/eap_ttls.c

@@ -441,8 +441,8 @@ static eap_ttls_t *eap_ttls_create(identification_t *server,
 		.is_server = is_server,
 	);
 	/* MSK PRF ASCII constant label according to EAP-TTLS RFC 5281 */
-	this->tls = tls_create(is_server, server, peer, "ttls keying material",
-						   application);
+	this->tls = tls_create(is_server, server, peer, FALSE,
+						   "ttls keying material", application);
 	return &this->public;
 }