For a manual configuration, please do the following (testet on Raspberry Pi 3 B+ with Raspbian GNU/Linux 11 (bullseye)):

1. In /etc/ssl/certs/ you should find the file dfn-verein_community_root_ca_2022.pem. If not, please download it here:
   wget https://doku.tid.dfn.de/_media/de:dfnpki:ca:dfn-verein_community_root_ca_2022.pem
2. Load the wpa_supplicant.conf onto the Raspberry Pi, (over LAN, USB Stick or the Wi-Fi network VPN/WEB and the WebVPN):
   wget https://www.tuhh.de/t3resources/rzt/conf/wlan/RaspberryPi/wpa_supplicant.conf
3. Edit the file and input your TUHH account with eduroam usage rights:
   nano wpa_supplicant.conf
4. Move the file to /etc/wpa_supplicant/wpa_supplicant.conf:
   sudo mv wpa_supplicant.conf /etc/wpa_supplicant/wpa_supplicant.conf
5. Change the file access rights, such that only root has read access to it:
   sudo chmod 600 /etc/wpa_supplicant/wpa_supplicant.conf
   
   Pay attention to who is part of the system group sudo, which is saved in /etc/sudoers and /etc/sudoers.d/*, who knows the root password and whose SSH key has an entry in /root/.ssh/authorized_keys. These people can see the TUHH password in /etc/wpa_supplicant/wpa_supplicant.conf.
6. Restart the device:
   sudo shutdown -r now
7. With the following command, you can find out the IP address of your device to access it:
   ip -4 -h -c address show
   The port restrictions in eduroam can be found here.

With the eduroam Configuration Assistant Tool you can automatically configure the NetworkManager and generate wpa_supplicant.conf.

1. Download the Python script for Linux and move it (e.g. with a USB stick) to the Raspberry Pi.
2. In the directory, run the script: python3 ./eduroam-linux-TUH-TUHH.py
3. If it is detected that the NetworkManager is not present, .config/cat_installer/cat_installer.conf is used to store the configuration.
4. Add the lines to the file at /etc/wpa_supplicant/wpa_supplicant.conf as root and restart the Raspberry Pi: shutdown -r now