The following certificates should be installed on the mobile phone. Download the certificates and transfer them e.g. via bluetooth to you phone, then execute the transfered certificate.
Go to the main menu and navigate to Settings -> Connections -> WLAN. Click "More" and the following menu appears, there you have to choose "New account"
Choose a name for the account. The SSID is very important, choose eduroam-WPAonly. Choose "WPA Enterprise" as security. Then click "Next"
Use TKIP for the data encryption and EAP-TTLS as network authentication method. Choose PAP as internal authentication.
Use your TIM id as user name, check the box "Statisches Kennwort verw." The password is your VPN/WLAN password.
Then your are prompted to save the profile. Just confirm this. Confirm the following dialog with "Yes". The created account is then added to the group "Internet". If the profile belongs to the group internet, a connection to eduroam will be established automatically, if a program wants to access the internet.