The guest-vlan supplicant stuff is only useful if the supplicant gives up on EAPOL entirely AFTER there's been EAPOL on the port during the life of link on the port.
Here's what happens based on your config if a 1X session fails.
1) 1X will fail normally.
2) 1X will fail again immediately (b/c you have auth-fail-vlan turned on, and not sure why you set it to max-attempts 2 but OK).
3) Port enters into Auth-Fail-VLAN immediately after step 2.
4) Upon existing HELD state (probably 60-sec), supplicant will try to re-auth but the switch will ignore any subsequent EAPOL-Start frames from the supplicant since it's placed it in the Auth-Fail-VLAN at step3.
Here's what happens based on your config if a 1X session times out and has no supplicant at all.
1) EAPOL-Id-Request from switch.
2) 10-sec later, another (b/c you tweaked your tx-period).
3) 10-sec later, another.
4- 10-sec later, port goes into Guest-VLAN and stays there (as long as you don't in fact send in EAPOL to the switch).
So not counting the issue of being enabled for TLS, but in fact not having a cert if the above is NOT happening, if the above is not happening per the above, I'd recommend a TAC case for a closer look.
HTH a little,
