We have a distributed product where one server acts as a 'Scheduler' of jobs and there are hundreds if not thousands of 'Agents' which receive commands from the 'Scheduler' and execute the jobs. The communication between the Scheduler and the Agents wasn't secured with TLS till now. We had a symmetric key encryption implementation to protect data over the wire.
Now, though we want to implement TLS for securing the communication between the Scheduler and the Agents. One way TLS is clear and easy to implement. We can configure the Scheduler with a TLS key pair and we can have all the Agents send a client hello to the Scheduler and verify the Scheduler's TLS public key certificate they receive back. Since most of our customers are Enterprise companies they most likely have a TLS truststore configured with their CA in all the machines were they have our Agents running. So, Scheduler authentication is easily achievable.
However, the reverse - each Agent authenticating itself to the Scheduler using TLS public key certificate has practical difficulties for us. For example, customers who have thousands of Agents face an overhead generating a TLS key pair in all the machines were they have Agents running.
Is there a standard way for us to achieve 2 way mutual TLS authentication in this case without installing TLS key pair in all the Agents ?