We have an embedded device running a web server. That web server uses HTTPS and so has a private certificate which is embedded on the device. Right now we are unsure if this private key should be password protected since that password will need to be embedded on that same device at some pont. If we don't, even the web server won't be able to load the key.
That being said, should we still add that extra thin layer of protection by adding on passphrase ton the private key?