I believe what's happening is that macOS needs access to the private key of the client certificate that EAP TLS is requesting. As has been suggested, find the client certificate in Keychain Access (if the prompt you get states that it is trying to access the "System" keychain, then search in the System keychain).
Besides the certificate there will be an arrow that allows you to expand the hierarchy, exposing the private key associated with the certificate. Expand then double-click on the key. Select Access Control.
Now if you're like me and you don't want to allow all applications to access this key, you'll need to select the
eapolclient. Click the "+" symbol, then Command+Shift+G and enter
"/System/Library/SystemConfiguration/EAPOLController.bundle/Contents/Resources". Click "Go". Select
eapolclient and click "Add", then authenticate yourself. Oddly enough, although this gives permission to
eapolclient, revisiting the Access Control dialog doesn't show the newly added
NB: I'm running Mojave 10.14.6.