Description:

I have a wifi setup based on wireless-wpa-config - only the location of the config and the interface name are changed:

$ cat /etc/netctl/wifi-eduroam
Description='A wpa_supplicant configuration file based wireless connection'
Interface=wlp2s0
Connection=wireless
Security=wpa-config
WPAConfigFile='/etc/netctl/wifi-eduroam.conf'
IP=dhcp

However, starting this with
$ netctl start wifi-eduroam
fails:
Aug 21 10:58:32 rodrigues network[2509]: Starting network profile 'wifi-eduroam'...
Aug 21 10:58:51 rodrigues network[2509]: WPA association/authentication failed for interface 'wlp2s0'
Aug 21 10:58:51 rodrigues network[2509]: Failed to bring the network up for profile 'wifi-eduroam'
Aug 21 10:58:51 rodrigues systemd[1]: netctl@wifi\x2deduroam.service: Main process exited, code=exited, status=1/FAILURE
Aug 21 10:58:51 rodrigues systemd[1]: netctl@wifi\x2deduroam.service: Failed with result 'exit-code'.
Aug 21 10:58:51 rodrigues systemd[1]: Failed to start Networking for netctl profile wifi-eduroam.

I thought, I had an error in my configuration, so I tried to start it manually with
$ wpa_supplicant -c /etc/netctl/wifi-eduroam.conf -i wlp2s0
which worked fine. And a
$ dhcpcd -i wlp2s0
afterwards to get an ip address brought the net fully up.

This looks like a bug in netctl to me (so I opened one). But on second thought, it might also be some security feature of systemd preventing access to the config file (?) or the certificate (also stored in /etc/netctl and referenced by absolute path) - however, the error message does not indicate any read-permission / file-not-found issue.

Additional info:
* package version(s)
wpa_supplicant 2:2.8-1
netctl 1.20-1
linux 5.2.9.arch1-1
systemd 242.84-2

* config and/or log files etc.
--- /etc/netctl/wifi-eduroam --- start ---
Description='A wpa_supplicant configuration file based wireless connection'
Interface=wlp2s0
Connection=wireless
Security=wpa-config
WPAConfigFile='/etc/netctl/wifi-eduroam.conf'
IP=dhcp
--- /etc/netctl/wifi-eduroam --- end ---

--- /etc/netctl/wifi-eduroam.conf --- start ---
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0

network={
ssid="eduroam"
key_mgmt=WPA-EAP
eap=TTLS
group=TKIP CCMP
pairwise=TKIP CCMP
anonymous_identity="obfuscated"
identity="obfuscated"
password="obfuscated
priority=1
phase2="auth=PAP"
ca_cert="/etc/netctl/T-TeleSec_GlobalRoot_Class_2.crt"
}
--- /etc/netctl/wifi-eduroam.conf --- end ---

Steps to reproduce:
Maybe it's enough to start a WPAConfigFile based profile with some referenced files (config, certificate), but I strongly doubt that.