diff --git a/radiuscontroller/Dockerfile b/radiuscontroller/Dockerfile
index b684d1b..1c800bc 100644
--- a/radiuscontroller/Dockerfile
+++ b/radiuscontroller/Dockerfile
@@ -36,6 +36,7 @@ WORKDIR /app
 # Copy pre-configured FreeRADIUS PostgreSQL rules & EAP authentication config
 COPY radiuscontroller/raddb/clients.conf /etc/freeradius/3.0/clients.conf
 COPY radiuscontroller/raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
+COPY radiuscontroller/raddb/mods-enabled/eap /etc/freeradius/3.0/mods-enabled/eap
 COPY radiuscontroller/raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
 COPY radiuscontroller/raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
 
diff --git a/radiuscontroller/entrypoint.sh b/radiuscontroller/entrypoint.sh
index 021c2ea..ad68e66 100644
--- a/radiuscontroller/entrypoint.sh
+++ b/radiuscontroller/entrypoint.sh
@@ -31,6 +31,14 @@ if [ -f "$CLIENTS_CONF" ]; then
     sed -i "s/secret = .*/secret = $RADIUS_SECRET/" "$CLIENTS_CONF"
 fi
 
+# Generate FreeRADIUS EAP certificates if missing
+if [ ! -f /etc/freeradius/3.0/certs/server.pem ]; then
+    echo "Generating FreeRADIUS EAP certificates..."
+    if [ -f /etc/freeradius/3.0/certs/bootstrap ]; then
+        /etc/freeradius/3.0/certs/bootstrap || true
+    fi
+fi
+
 # Ensure correct permissions for FreeRADIUS config directory
 chown -R freerad:freerad /etc/freeradius/3.0/ || true
 
diff --git a/radiuscontroller/raddb/mods-enabled/eap b/radiuscontroller/raddb/mods-enabled/eap
new file mode 100644
index 0000000..4b40382
--- /dev/null
+++ b/radiuscontroller/raddb/mods-enabled/eap
@@ -0,0 +1,40 @@
+eap {
+	default_eap_type = peap
+	timer_expire = 60
+	ignore_unknown_eap_types = no
+	cisco_accounting_username_bug = no
+	max_sessions = ${max_requests}
+
+	# PEAP Configuration
+	peap {
+		default_eap_type = mschapv2
+		copy_request_to_tunnel = yes
+		use_tunneled_reply = yes
+		virtual_server = "inner-tunnel"
+	}
+
+	# TTLS Configuration
+	ttls {
+		default_eap_type = mschapv2
+		copy_request_to_tunnel = yes
+		use_tunneled_reply = yes
+		virtual_server = "inner-tunnel"
+	}
+
+	# MSCHAPv2 Configuration
+	mschapv2 {
+	}
+
+	# TLS Configuration for PEAP / TTLS
+	tls-config certs {
+		private_key_password = whatever
+		private_key_file = ${certdir}/server.pem
+		certificate_file = ${certdir}/server.pem
+		ca_file = ${cadir}/ca.pem
+		dh_file = ${certdir}/dh
+		cipher_list = "DEFAULT@SECLEVEL=1"
+		cipher_server_preference = no
+		tls_min_version = "1.0"
+		tls_max_version = "1.2"
+	}
+}