How to setup PEAP-TLS in supplicant config?

[802-1x]

ca-cert=/root/certs/_ca.pem

eap=peap;

identity=xxxx

phase2-auth=tls;

phase2-ca-cert=/root/certs/_ca.pem

phase2-client-cert=/root/certs/_user.pem

phase2-private-key=/root/certs/_user.pem

phase2-private-key-password=cert-password