...
Regarding the SSIDs to configure (options "Additional SSID" and "Additional SSID (with TKIP)": You do not have to configure the eduroam SSID yourself. eduroam CAT always produces one two installer settings for the SSID eduroam which is configured ; one for both WPA/TKIP and one for WPA2/AES. You do not have to configure the eduroam SSID. The generated installers for this SSID will possibly be shown on your users' screens as "eduroam (with TKIP)" even if connecting to WPA2/AES-only hotspots. When their computer chooses this profile for the connection this does NOT mean it is trying to connect via TKIP. The operating system will automatically choose WPA2/AES if that is available at the hotspot.
...