How is a client certificate different from a long random password? Both have to be stored somewhere. The correct solution is to keep this (and everything else)

How is a client certificate different from a long random password? Both have to be stored somewhere. The correct solution is to keep this (and everything else) out of your web root. If that i?php blunder happened to me, my users would see 10 lines of code. One include for the framework (which lives outside the web root), plus three calls to get the framework to handle the current request. Those 10 lines would be totally unproblematic