WA6320-C cloud 模式 802.1X 用户无法认证

-Username=<username>-UserMAC=<usermac>-BSSID=<bssid>-SSID=H3C_WiFi_1-APName=fatap-RadioID=1-VLANID=50; A user failed 802.1X authentication.Reason:AAA processed authentication request and return 26.

后端 freeradius 服务器报错

(82) # Executing group from file /etc/raddb/sites-enabled/default 
(82) authenticate { 
(82) eap: Expiring EAP session with state 0x7cb430e578b2297b 
(82) eap: Finished EAP session with state 0x7cb430e578b2297b 
(82) eap: Previous EAP request found for state 0x7cb430e578b2297b, released from the list 
(82) eap: Peer sent packet with method EAP PEAP (25) 
(82) eap: Calling submodule eap_peap to process data 
(82) eap_peap: Continuing EAP-TLS 
(82) eap_peap: Peer indicated complete TLS record size will be 7 bytes 
(82) eap_peap: Got complete TLS record (7 bytes) 
(82) eap_peap: [eaptls verify] = length included 
(82) eap_peap: <<< recv TLS 1.2 [length 0002]  
(82) eap_peap: ERROR: TLS Alert read:fatal:unknown CA 
(82) eap_peap: TLS_accept: Need to read more data: error 
(82) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca 
(82) eap_peap: TLS - In Handshake Phase 
(82) eap_peap: TLS - Application data. 
(82) eap_peap: ERROR: TLS failed during operation 
(82) eap_peap: ERROR: [eaptls process] = fail 
(82) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed 
(82) eap: Sending EAP Failure (code 4) ID 6 length 4 
(82) eap: Failed in EAP select 
(82) [eap] = invalid 
(82) } # authenticate = invalid 
(82) Failed to authenticate the user

看样子像是AP上需要导入radius server端的证书。请问需要怎么导入呢？

WA6320-C 7.1.064, Release 2446P60

FreeRADIUS Version 3.0.20

测试连接使用的是 Android 11 用 PEAP MSCHAPv2 做认证