How secure is saved password and certificate?

[aldomoro]

Hello

We authenticate our users via username+password and certificate in OpenVPN. I understand if password is sent, it travels via encrypted TLS connection. But what about if user safe his password in the OpenVPN client (Win10, Android)? It must be stored somewhere. How secure is this? Can somebody steal it? Can somebode takes certificate from my laptop/mobile phone and copy it to his device and use it?

Thanks for your answers