How does EAP-TLS authenticate? I understand that a client and server certificate is required, however the validation process isn't clear to me.

Is it simply that the certificates are check to ensure they're valid, aren't revoked, and are signed by the same root ca? Can certificates from different root CAs (both trusted by client and server) be used? Are there any other specific checks?

Sources


https://www.juniper.net/documentation/en_US/sbr-carrier7.5.0/information-products/topic-collections/sbr-admin-guide-10/index.html?id-98057.html
https://tools.ietf.org/html/rfc5216
If CA certificates are trusted by client and server both, than an CA certificate will work. 
However, apart from CA Signer (CA certificates), you can also validate the certificate subject CN name. [ this functionality is not provided by all the product ]

Process in details:


Negotiation (SSL Handshake)
Server Sends its Server Certificate to Client. (s - > c)
2.a Client validate that signer of certificates provided by server is in its trust-store.
Client Sends its Client Certificate to Server (c -> s)
3.a Server validates that the signer of certificate provided by client is present in it's trust-store.
Than, they exchange master-key.
Handshake done, and data transmission over synchronise encryption.