Is it possible to use TPM for SSL Client Authentication (with a client certificate) and thereby ensure on the server/backend side knows, that the request comes from the specific client machine (even the key cannot be stolen) when I have an existing client application, that I can not modify?
Now, I know from here, that I can directly use openssl for those http requests, and I am sure that I can use some SDK to archive the same thing. But what if I have an existing application, that has its own implementation and of course needs access to the public and private key to do client authorization?
My current assumption: This, in general, means that a private key has to be generated and be accessible by the application and therefore can also be stolen (if someone has i.E. the same access as the application). And therefore it is not possible!
Is that true, or am I missing something?