Use wpa_supplicant. Outer authentication is EAP-TTLS, inner authentication is PAP.
A minimal network block looks like this — fill in your own Central Auth username and password, and point ca_cert at the Devi Nivas CA certificate:
# /etc/wpa_supplicant/wpa_supplicant-minnal.conf
network={
ssid="MINNAL"
key_mgmt=WPA-EAP
eap=TTLS
phase2="auth=PAP"
identity="your-central-auth-username"
password="your-central-auth-password"
ca_cert="/etc/ssl/certs/devinivas-ca.pem"
}
Set restrictive permissions on the config file, since it contains your password in plain text:
chmod 600 /etc/wpa_supplicant/wpa_supplicant-minnal.conf
Make sure CA certificate validation is enabled (the ca_cert line above) rather than skipped. Without it, your device can't confirm it's really talking to Minnal.