wpa_supplicant is running anyway, it's what enables you to connect to WLAN at all.

I edited wpa_supplicant.conf and added this section:

network={
ssid="eduroam"
key_mgmt=WPA-EAP
eap=PEAP
identity="username@domain"
ca_cert="/etc/pki/tls/certs/ca-bundle.crt"
phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
priority=2
}

I haven't tested this in eduroam yet. Restarting wpa_supplicant didn't produce any new errors, and I was still able to connect to my existing WLAN (whew, because while fingerterm is good, nothing beats a full size keyboard and a large screen (or two) for serious admin work). I'll see what happens once I get back to UEF.

Replace username@domain with your username and the domain of your university as per eduroam's instructions.