Android 11 does not trust a theoretically properly imported private CA for WiFi EAP-TLS
For anyone who doesn't want to trust a public CA for their network: we made this work by ensuring the dnsNme was set correctly on our certificates. We had our CN equal to a domain, and our SAN incorrectly had the DNS field of SAN equal to a string like &quot;Our RADIUS Server&quot;. Changing this to a proper domain and setting the &quot;domain&quot; field in the settings made this work.
From the Android SDK docs (what a place to find an answer to this), if an SAN is present, it is preferred over a CN.
https://developer.android.com/reference/android/net/wifi/WifiEnterpriseConfig#setDomainSuffixMatch(java.lang.String)