1. You'd have install the custom CA in all devices. Ever tried it on Android? The "network may be monitored" warning doesn't go away.

2. If the certificate is ever compromised, you'll have to keep it in the revocation list forever, or replace the entire CA.

(And I hope your CA contains a DNS name restriction.)

>1. You'd have install the custom CA in all devices. Ever tried it on Android? The "network may be monitored" warning doesn't go away.

This is the most annoying part of using certs for Radius authentication with Android. Either you self-sign a cert and forever get these warnings, or you let someone else sign your cert and then that CA can issue device certs for your domain.

At least modern Android version support setting the CA certificate in the wifi settings.

(And then there's the university way of things: just run your own trusted (!) CA ;-) (e.g. in Germany: signed by DFN)