Microsoft Knowledge Base Article 326474 contains the following summary:
This step-by-step article describes how to troubleshoot Extensible Authentication Protocol (EAP) authentication when you are using it
with virtual private network (VPN) connections.
Use an Enterprise Certification Authority (CA) to obtain certificates for EAP authentication. According to the Windows 2000 Server Resource Kit Distributed Systems Guide, stand-alone CAs cannot issue certificates for the smart card logon process.