Which EAP method requires that supplicants have a client-side certificate?

LEAP (Lightweight Extensible Authentication Protocol) is a legacy Cisco proprietary EAP method that authenticates clients using a username and password, without requiring client-side certificates.

EAP-TTLS (Tunneled Transport Layer Security) primarily uses a server-side certificate to establish a secure TLS tunnel, inside which another authentication method (often username/password) is performed; client-side certificates are optional but not required.

PEAP/MS-CHAPv2 (Protected EAP with Microsoft Challenge Handshake Authentication Protocol version 2) uses a server-side certificate to establish a TLS tunnel and then uses MS-CHAPv2 for username/password authentication within the tunnel, not client-side certificates.

EAP-TLS (Transport Layer Security) is a robust EAP method that requires mutual authentication through digital certificates. Both the authentication server (e.g., RADIUS server) and the supplicant (client device) must present and validate each other's X.509 certificates to establish a secure connection and authenticate the client.