Using Ubiquiti Unifi AP with EAP-TLS, Mikrotik CCR1016 acts as DHCP server for wireless devices. All devices work well when CCR1016 is used as routing between AP and Unifi controller. After enabling Hotspot with Radius authentication, iPhone 6 and iPad fail to get IP because the Radius authentication EAP-TLS was not completed. But windows laptops and one iPhone 6s work fine.
Network diagram
AP <----> Mikrotik (Hotspot, DHCP) <----> Unifi Controller (Radius for EAP-TLS and Hotspot authentication)