Thanks Ben, I'll try installing the CA cert on the SM. I had already been through the EAP notes when testing auth with a PC. Baby steps ...
The AP is running NTP, so time is not an issue. We were aware of the vlan problem with 11.0. (Of course, no one uses those ;-) Jim - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

