[BUG] Cannot configure WPA2-Enterprise EAP-TLS network from GUI in Windows 11

Based on my knowlegde, what you're experiencing in Windows 11 is a known regression in the Wi-Fi configuration GUI compared to Windows 10.

So we have to wait until Microsoft resolves this via update, but we can use some workaround options bellows:

Option 1: Use netsh wlan add profile with XML

You can still fully configure EAP-TLS using an XML Wi-Fi profile.

-> Example: wifi-eap-tls.xml

<WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1">
    <name>HOMEAP</name>
    <SSIDConfig>
        <SSID>
            <name>HOMEAP</name>
        </SSID>
    </SSIDConfig>
    <connectionType>ESS</connectionType>
    <connectionMode>auto</connectionMode>
    <MSM>
        <security>
            <authEncryption>
                <authentication>WPA2</authentication>
                <encryption>AES</encryption>
                <useOneX>true</useOneX>
            </authEncryption>
            <OneX xmlns="http://www.microsoft.com/networking/OneX/v1">
                <EAPConfig>
                    <EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
                        <EapMethod>
                            <Type>13</Type>
                            <VendorId>0</VendorId>
                            <VendorType>0</VendorType>
                            <AuthorId>0</AuthorId>
                        </EapMethod>
                        <Config xmlns:baseEap="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"
                                xmlns:eapTls="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1">
                            <baseEap:Eap>
                                <baseEap:Type>13</baseEap:Type>
                                <eapTls:EapType>
                                    <eapTls:CredentialsSource>
                                        <eapTls:CertificateStore>
                                            <eapTls:SimpleCertSelection>true</eapTls:SimpleCertSelection>
                                        </eapTls:CertificateStore>
                                    </eapTls:CredentialsSource>
                                    <eapTls:ServerValidation>
                                        <eapTls:DisableUserPromptForServerValidation>false</eapTls:DisableUserPromptForServerValidation>
                                        <eapTls:TrustedRootCA>‎‎<Thumbprint_here></eapTls:TrustedRootCA>
                                        <eapTls:ServerNames>radius.homeap.local</eapTls:ServerNames>
                                    </eapTls:ServerValidation>
                                    <eapTls:DifferentUsername>false</eapTls:DifferentUsername>
                                </eapTls:EapType>
                            </baseEap:Eap>
                        </Config>
                    </EapHostConfig>
                </EAPConfig>
            </OneX>
        </security>
    </MSM>
</WLANProfile>

• Then install it via:

netsh wlan add profile filename="wifi-eap-tls.xml" user=current

=> Replace ‎<Thumbprint_here> with the certificate thumbprint of your trusted CA.

Option 2: Use Group Policy or Intune (if available)

For domain-joined or Intune-managed devices, use:

• GPO → Computer Configuration → Policies → Windows Settings → Security Settings → Wireless Network (IEEE 802.11) Policies
• Intune → Wi-Fi profiles with EAP-TLS settings