Introducing end-to-end mutual TLS (mTLS) between Client Workloads and Server Workloads using SPIFFE-compliant
X.509-SVID certificates.
Aembit has released new versions of the following components and packages:
- Agent Proxy
- Cloud (Tenant UI + API)
- EdgeAPI
- Terraform Provider
- Helm Chart
- Terraform ECS module
- AWS Lambda Extension
- AWS Lambda Layer
For the latest available versions of these components, see the Edge Components Supported
Versions page.
Key Updates:
- Agent Proxy outbound mTLS with X.509-SVID: Agent Proxy can now establish outbound mTLS connections to Server
Workloads using SPIFFE-compliant X.509-SVID certificates, with no application code changes required.
- mTLS Authentication method for Server Workloads: A new authentication method, mTLS Authentication with the
x509 Certificate scheme, lets Server Workloads validate the client certificate that Agent Proxy presents during the
mTLS handshake.
- X.509-SVID Credential Provider: A new Credential Provider type that issues SPIFFE-compliant X.509 certificates.
This release’s Agent Proxy update is what consumes them for outbound mTLS to Server Workloads.
Agent Proxy can now establish outbound mTLS connections to Server Workloads using SPIFFE-compliant X.509-SVID
certificates, enabling certificate-based workload-to-workload authentication without application code changes.
What’s new:
- In-memory private key: Agent Proxy generates an ECDSA key pair in memory for each X.509-SVID certificate.
The private key is never written to disk and is never transmitted to Aembit Cloud.
- Automatic rotation at 80% of certificate lifetime: Agent Proxy refreshes the certificate well before expiration,
generating a new key pair on each refresh.
In-progress mTLS connections continue using the prior certificate until they close.
- mTLS Authentication for Server Workloads: A new Server Workload authentication method (mTLS Authentication
with the
x509 Certificate scheme) lets the Server Workload side validate the X.509-SVID certificate that Agent
Proxy presents during the handshake.
For the end-to-end workflow and procedure, see
Enable mTLS on a Server Workload.
For the authentication-method catalog, see
Authentication methods and schemes.
Aembit is introducing a new X.509-SVID Credential Provider type that issues SPIFFE-compliant X.509 certificates
to Client Workloads, signed by an Aembit Standalone CA.
What’s new:
- SPIFFE-compliant identity in the URI Subject Alternative Name (SAN): Every issued certificate embeds the
workload’s SPIFFE ID as a URI SAN, so SPIFFE-aware Server Workloads can authenticate the Client Workload during
the TLS handshake.
- Literal or dynamic Subject and SPIFFE ID: Configure either field with a fixed value or with template
expressions that resolve at issuance time using workload attestation attributes.
- Configurable Extended Key Usage: Default to
id-kp-clientAuth for outbound mTLS, or add
id-kp-serverAuth to use the same certificate as a server credential.
- Configurable certificate lifetime: Set the lifetime in minutes (default 15).
Agent Proxy automatically refreshes the certificate before expiration (typically at 80% of the configured lifetime).
For setup instructions, see Create an X.509-SVID Credential
Provider.
For concepts and the end-to-end issuance flow, see About the X.509-SVID Credential
Provider.