When importing an EAP-TLS profile without embedded certificate, the user is prompted for a certificate file. It should also be possible to pick a certificate that's already in the certificate store.