With the eduroam Configuration Assistant Tool you can automatically configure the NetworkManager and generate wpa_supplicant.conf.

For a manual configuration, please do the following (testet on Raspberry Pi 3 B+ with Raspbian GNU/Linux 9 (stretch)):

1. In /etc/ssl/certs/ you should find the file T-TeleSec_GlobalRoot_Class_2.pem. If not, please download it here:
   wget https://www.pki.dfn.de/fileadmin/PKI/zertifikate/T-TeleSec_GlobalRoot_Class_2.pem
2. Load the wpa_supplicant.conf onto the Raspberry Pi, (over LAN, USB Stick or the Wi-Fi network VPN/WEB and the WebVPN):
   wget https://www.tuhh.de/t3resources/rzt/conf/wlan/RaspberryPi/wpa_supplicant.conf
3. Edit the file and input your TUHH account with eduroam usage rights:
   nano wpa_supplicant.conf
4. Move the file to /etc/wpa_supplicant/wpa_supplicant.conf:
   sudo mv wpa_supplicant.conf /etc/wpa_supplicant/wpa_supplicant.conf
5. Change the file access rights, such that only root has read access to it:
   sudo chown 600 /etc/wpa_supplicant/wpa_supplicant.conf
   
   Pay attention to who is part of the system group sudo, which is saved in /etc/sudoers and /etc/sudoers.d/*, who knows the root password and whose SSH key has an entry in /root/.ssh/authorized_keys. These people can see the TUHH password in /etc/wpa_supplicant/wpa_supplicant.conf.
6. Restart the device:
   sudo shutdown -r now
7. With the following command, you can find out the IP address of your device to access it:
   ip -4 -h -c address show
   The port restrictions in eduroam can be found here.