From the RADIUS point of view, this is pretty easy, with only minor changes to the base configuration.

The hard bit is the certificates themselves. Not only do they have to work with RADIUS but they also have to cope with the idiosyncrasies of the operating systems they're installed on.

Instructions for generating client certificate PKI.