I am wondering what are the possible options for the following: Let's say you have a software-agent you want to deploy on systems running both on Windows and Linux, e.g. an agent written in C++. Let's say this agent uses certificates issued by a PKI to do authentication towards a centralised system, be it locally or in the cloud (for TLS with mutual authentication).
How would you go about storing those client certificates for the agents in a secure way on both operating systems?
Just putting those certificates somewhere on the filesystem is obviously a no-go. Embedding them in the software agent itself is also to be considered dangerous, since anyone who has access to the system can grab the agent and reverse-engineer it, trying to extract the certificate from the agent.
So how would you protect those certificates in a secure way on third-party systems that are not under your control?