Txs for the advice. However I’m getting further and further away from a working setup.
Gradually increased the timeout up to 4000ms, but nothing helped.
However now I see only 6 handshakes (12 packets) with each attempt, not the usual 10. No idea why the communication now stops there.
Maybe the certificate ? We moved from summer-time to winter-time ??? User profile limits kicking in?? (non existing everything was unlimited), also created new fresh users to test. Nothing helped.
No error messages.
I destroyed my Raspberry Docker environment by some Portainer upgrade or phpAdmin installation. But I have an even more stable Docker installation of Freeradius on my Odroid N2+.
IP addresses in sniffer file: (2.38 Raspberry= broken, 2.42 Daloradius docker on Odroid, 2.25 de wAP ac as Radius client, 2.100 ROS7.1rc5 CHR VM on Synology with Usermanager)
See ZIP file.
Current situation:
With Usermanager: Tablet works, Windows fails
With Freeradius: Tablet and Windows work.
PS: (When swapping RADIUS servers, the Usermanager didn’t like to receive accounting information due to the Freeradius authentication, and sent kill commands for that session.)
Also created and selected the certificates as published example, on the server only: no change
Sorry, what blew up the Windows environment? The previously mentioned TLSv1.2 registration editing, that was undone, and never helped?
EDIT: kept digging … Windows complex logbooks give : “Authentication for the EAP method 25 type failed. The following error occurred: 0x30A.”
What is 0x30A? No idea, but smells like certificates.
Revisited the certificate process. Something must have gone wrong with the copy/paste of the full example in ‘New Terminal’.
Some things are not familiar to me, like I never used keysize ‘secp384r1’ before.
Done again, line by line … and BINGO … that certificate “userman-cert” does work for Windows 10 , and for the tablet.
The FreeRADIUS copied certificate does not work for Windows 10 with Usermanager v5.
THANK YOU !
Now time to analyze that certificate 
(My “free-radius” certificate I used had become invalid since 24/oct/2021. Now added the “invalid after” column in Winbox table)
# Generating a Certificate Authority
/certificate
add name=radius-ca common-name="RADIUS CA" key-size=secp384r1 digest-algorithm=sha384 days-valid=1825 key-usage=key-cert-sign,crl-sign
# sign it
sign radius-ca ca-crl-host=radius.mikrotik.test
# Generating a server certificate for User Manager
add name=userman-cert common-name=radius.mikrotik.test subject-alt-name=DNS:radius.mikrotik.test key-size=secp384r1 digest-algorithm=sha384 days-valid=800 key-usage=tls-server
# and sign it
sign userman-cert ca=radius-ca
# to be set in the usermanager settings
4000ms.zip (19.2 KB)
