diff --git a/radiuscontroller/Dockerfile b/radiuscontroller/Dockerfile
index 1c800bc..4882c49 100644
--- a/radiuscontroller/Dockerfile
+++ b/radiuscontroller/Dockerfile
@@ -7,6 +7,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     freeradius-postgresql \
     freeradius-utils \
     ca-certificates \
+    openssl \
     && rm -rf /var/lib/apt/lists/*
 
 # Create symlink so both /etc/raddb and /etc/freeradius/3.0 work
diff --git a/radiuscontroller/entrypoint.sh b/radiuscontroller/entrypoint.sh
index 9b8e0e7..51e8a51 100644
--- a/radiuscontroller/entrypoint.sh
+++ b/radiuscontroller/entrypoint.sh
@@ -32,13 +32,34 @@ if [ -f "$CLIENTS_CONF" ]; then
 fi
 
 # Generate FreeRADIUS EAP certificates if missing
-if [ ! -f /etc/freeradius/3.0/certs/server.pem ]; then
+CERT_DIR="/etc/freeradius/3.0/certs"
+if [ ! -f "$CERT_DIR/server.pem" ]; then
     echo "Generating FreeRADIUS EAP certificates..."
-    cd /etc/freeradius/3.0/certs
-    if [ -f ./bootstrap ]; then
-        ./bootstrap || true
-    fi
-    cd /app
+    mkdir -p "$CERT_DIR"
+
+    # Generate CA key and certificate
+    openssl req -new -x509 -keyout "$CERT_DIR/ca.key" -out "$CERT_DIR/ca.pem" \
+        -days 3650 -nodes -subj "/CN=RADIUS CA" 2>/dev/null
+
+    # Generate server key and CSR
+    openssl req -new -keyout "$CERT_DIR/server.key" -out "$CERT_DIR/server.csr" \
+        -nodes -subj "/CN=RADIUS Server" 2>/dev/null
+
+    # Sign the server certificate with the CA
+    openssl x509 -req -in "$CERT_DIR/server.csr" -CA "$CERT_DIR/ca.pem" \
+        -CAkey "$CERT_DIR/ca.key" -CAcreateserial -out "$CERT_DIR/server.crt" \
+        -days 3650 2>/dev/null
+
+    # Combine server key + cert into server.pem
+    cat "$CERT_DIR/server.key" "$CERT_DIR/server.crt" > "$CERT_DIR/server.pem"
+
+    # Generate DH parameters (small size for speed, adequate for internal use)
+    openssl dhparam -out "$CERT_DIR/dh" 1024 2>/dev/null
+
+    # Clean up intermediate files
+    rm -f "$CERT_DIR/server.csr" "$CERT_DIR/server.key" "$CERT_DIR/server.crt" "$CERT_DIR/ca.key" "$CERT_DIR/ca.srl"
+
+    echo "EAP certificates generated successfully."
 fi
 
 # Ensure correct permissions for FreeRADIUS config directory