FreeRadius & PI - Constant failure - raspberry-pi4

Question

I'm new to Freeradius. Relatively familiar with linux. I've never been this stumped by an issue like this before.
No matter what I do, or how I config freeradius on my Pi, I end up with the following error when trying to start the service. This error will just repeat.
I've played with permissions & wiped the pi twice, followed many tutorials, and I still hit the same spot.
Can anyone help please?
lines 2500-2551/2551 (END)
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ A start job for unit freeradius.service has begun execution.
░░
░░ The job identifier is 13806.
Mar 04 19:44:11 raspberrypi freeradius[4362]: FreeRADIUS Version 3.0.21
Mar 04 19:44:11 raspberrypi freeradius[4362]: Copyright (C) 1999-2019 The FreeRADIUS server project and contributors
Mar 04 19:44:11 raspberrypi freeradius[4362]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
Mar 04 19:44:11 raspberrypi freeradius[4362]: PARTICULAR PURPOSE
Mar 04 19:44:11 raspberrypi freeradius[4362]: You may redistribute copies of FreeRADIUS under the terms of the
Mar 04 19:44:11 raspberrypi freeradius[4362]: GNU General Public License
Mar 04 19:44:11 raspberrypi freeradius[4362]: For more information about these matters, see the file named COPYRIGHT
Mar 04 19:44:11 raspberrypi freeradius[4362]: Starting - reading configuration files ...
Mar 04 19:44:11 raspberrypi freeradius[4362]: Debug state unknown (cap_sys_ptrace capability not set)
Mar 04 19:44:11 raspberrypi freeradius[4362]: Creating attribute Unix-Group
Mar 04 19:44:11 raspberrypi freeradius[4362]: Creating attribute LDAP-Group
Mar 04 19:44:11 raspberrypi freeradius[4362]: Please use tls_min_version and tls_max_version instead of disable_tlsv1
Mar 04 19:44:11 raspberrypi freeradius[4362]: Please use tls_min_version and tls_max_version instead of disable_tlsv1_2
Mar 04 19:44:11 raspberrypi freeradius[4362]: tls: Using cached TLS configuration from previous invocation
Mar 04 19:44:11 raspberrypi freeradius[4362]: tls: Using cached TLS configuration from previous invocation
Mar 04 19:44:11 raspberrypi freeradius[4362]: rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
Mar 04 19:44:11 raspberrypi freeradius[4362]: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
Mar 04 19:44:11 raspberrypi freeradius[4362]: rlm_ldap: libldap vendor: OpenLDAP, version: 20457
Mar 04 19:44:11 raspberrypi freeradius[4362]: rlm_ldap (ldap): Initialising connection pool
Mar 04 19:44:11 raspberrypi freeradius[4362]: rlm_mschap (mschap): using internal authentication
Mar 04 19:44:11 raspberrypi freeradius[4362]: Ignoring "sql" (see raddb/mods-available/README.rst)
Mar 04 19:44:11 raspberrypi freeradius[4362]: # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:>
Mar 04 19:44:11 raspberrypi freeradius[4362]: radiusd: #### Skipping IP addresses and Ports ####
Mar 04 19:44:11 raspberrypi freeradius[4362]: Configuration appears to be OK
Mar 04 19:44:11 raspberrypi systemd[1]: freeradius.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ An ExecStart= process belonging to unit freeradius.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Mar 04 19:44:11 raspberrypi systemd[1]: freeradius.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ The unit freeradius.service has entered the 'failed' state with result 'exit-code'.
Mar 04 19:44:11 raspberrypi systemd[1]: Failed to start FreeRADIUS multi-protocol policy server.
░░ Subject: A start job for unit freeradius.service has failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ A start job for unit freeradius.service has finished with a failure.
░░
░░ The job identifier is 13806 and the job result is failed.

Answer 1

I actually found the answer. There was a typo in Googles instructions. It's minor and I missed it:
https://support.google.com/a/answer/9089736?hl=en#zippy=%2Cfreeradius
It uses both .cer and .crt for the same certificate file as shown below.
Follow these steps:
Install and configure FreeRADIUS at /etc/freeradius/3.0/.
Once FreeRADIUS is installed, you can add the LDAP configuration by installing the freeradius-ldap plugin.
sudo apt install freeradius freeradius-ldap
Copy the LDAP client key and cert files to /etc/freeradius/3.0/certs/ldap-client.key and /etc/freeradius/3.0/certs/ldap-client.crt respectively.
chown freeradius:freeradius /etc/freeradius/3.0/certs/ldap-client.*
chmod 640 /etc/freeradius/3.0/certs/ldap-client.*
Enable the LDAP module.
cd /etc/freeradius/3.0/mods-enabled/
ln -s ../mods-available/ldap ldap
Edit /etc/freeradius/3.0/mods-available/ldap.
a. ldap->server = 'ldaps://ldap.google.com:636'
b. identity = username from the application credentials
c. password = password from the application credentials
d. base_dn = 'dc=domain,dc=com'
e. tls->start_tls = no
f. tls->certificate_file = /etc/freeradius/3.0/certs/ldap-client.cer
g. tls->private_key_file = /etc/freeradius/3.0/certs/ldap-client.key
h. tls->require_cert = 'allow'
i. Comment out all fields in the breadcrumb representing the section 'ldap -> post-auth -> update'
​Edit /etc/freeradius/3.0/sites-available/default.
This modifies the FreeRadius client connection. If you are not using the default client, be sure to update the relevant client (inner-tunnel or any custom client) that you have configured.
a. Modify the authorize section to add the following block at the bottom after the password authentication protocol (PAP) statement:
if (User-Password) {
update control {
Auth-Type := ldap
}
}
b. In the authorize section, enable LDAP by removing the '-' sign before it.
#
# The ldap module reads passwords from the LDAP database.
ldap
c. Modify the authenticate section by editing the Auth-Type LDAP block as follows:
# Auth-Type LDAP {
ldap
# }
d. Modify the authenticate section by editing the Auth-Type PAP block as follows:
Auth-Type PAP {
# pap
ldap
}