Never managed to use Userman without certificates. Actually all my alternate Radius servers (FreeRadius, Synology, Draytek, …) do have self-signed certificates.
clients don’t specify certificates and do not verify certificates for server identity, the CA is not installed as trusted on the client.. Still the Radius Server has them, probably needed to encrypt the communication with the Radius server. Not sure. Would love not to have to use them, but it only worked after installing the correct certificates.
Luckely MT provides all the needed commands in “help” to create such CA and server certificates. (FreeRadius has something similar built in: demo certificates.)
https://help.mikrotik.com/docs/display/ROS/Enterprise+wireless+security+with+User+Manager+v5
Thanks to @strods for helping me out : http://forum.mikrotik.com/t/new-user-manager-in-routeros-v7/135338/1