# End-to-end mTLS between Client and Server Workloads with SPIFFE X.509-SVID certificates

Introducing end-to-end mutual TLS (mTLS) between Client Workloads and Server Workloads using SPIFFE-compliant X.509-SVID certificates.

Aembit has released new versions of the following components and packages:

* Agent Proxy
* Cloud (Tenant UI + API)
* EdgeAPI
* Terraform Provider
* Helm Chart
* Terraform ECS module
* AWS Lambda Extension
* AWS Lambda Layer

For the latest available versions of these components, see the [Edge Components Supported Versions](/reference/edge-components/edge-component-supported-versions) page.

Key Updates:

* **Agent Proxy outbound mTLS with X.509-SVID**: Agent Proxy can now establish outbound mTLS connections to Server Workloads using SPIFFE-compliant X.509-SVID certificates, with no application code changes required.
* **mTLS Authentication method for Server Workloads**: A new authentication method, **mTLS Authentication** with the `x509 Certificate` scheme, lets Server Workloads validate the client certificate that Agent Proxy presents during the mTLS handshake.
* **X.509-SVID Credential Provider**: A new Credential Provider type that issues SPIFFE-compliant X.509 certificates. This release’s Agent Proxy update is what consumes them for outbound mTLS to Server Workloads.

***

Agent Proxy can now establish outbound mTLS connections to Server Workloads using SPIFFE-compliant X.509-SVID certificates, enabling certificate-based workload-to-workload authentication without application code changes.

**What’s new:**

* **In-memory private key**: Agent Proxy generates an ECDSA key pair in memory for each X.509-SVID certificate. The private key is never written to disk and is never transmitted to Aembit Cloud.
* **Automatic rotation at 80% of certificate lifetime**: Agent Proxy refreshes the certificate well before expiration, generating a new key pair on each refresh. In-progress mTLS connections continue using the prior certificate until they close.
* **mTLS Authentication for Server Workloads**: A new Server Workload authentication method (**mTLS Authentication** with the `x509 Certificate` scheme) lets the Server Workload side validate the X.509-SVID certificate that Agent Proxy presents during the handshake.

For the end-to-end workflow and procedure, see [Enable mTLS on a Server Workload](/user-guide/access-policies/server-workloads/enable-mtls). For the authentication-method catalog, see [Authentication methods and schemes](/user-guide/access-policies/server-workloads/authentication).

***

Aembit is introducing a new **X.509-SVID Credential Provider** type that issues SPIFFE-compliant X.509 certificates to Client Workloads, signed by an Aembit Standalone CA.

**What’s new:**

* **SPIFFE-compliant identity in the URI Subject Alternative Name (SAN)**: Every issued certificate embeds the workload’s SPIFFE ID as a URI SAN, so SPIFFE-aware Server Workloads can authenticate the Client Workload during the TLS handshake.
* **Literal or dynamic Subject and SPIFFE ID**: Configure either field with a fixed value or with template expressions that resolve at issuance time using workload attestation attributes.
* **Configurable Extended Key Usage**: Default to `id-kp-clientAuth` for outbound mTLS, or add `id-kp-serverAuth` to use the same certificate as a server credential.
* **Configurable certificate lifetime**: Set the lifetime in minutes (default 15). Agent Proxy automatically refreshes the certificate before expiration (typically at 80% of the configured lifetime).

For setup instructions, see [Create an X.509-SVID Credential Provider](/user-guide/access-policies/credential-providers/spiffe-x509-svid). For concepts and the end-to-end issuance flow, see [About the X.509-SVID Credential Provider](/user-guide/access-policies/credential-providers/about-spiffe-x509-svid).