The titles says most of what we're confused with. Here's some details:
On an embedded device, we have a microcontroller and external flash memory. This memory can be easily read and written to in place. On that memory we store SSL certificates and a private key.
The microcontrollers internal flash memory is secure and can be used to hold fixed encryption keys, even uniquely generated so are only ever known inside the microcontroller. I cannot store certificates on the internal flash memory.
It seems obvious that the private key should be stored as encrypted but I am not so clear about the certificates.
What is not so obvious is if the certificates used to verify a TLS connection should be stored as encrypted to. It is likely that the root level certificates will be self signed and have no chain back to a verified root CA.
Thoughts?