# Aembit CLI now retrieves X.509-SVID certificates

Aembit CLI now retrieves SPIFFE-compliant X.509-SVID certificates directly from the X.509-SVID Credential Provider.

Aembit has released new versions of the following components and packages:

* Aembit CLI

For the latest available versions of these components, see the [Edge Components Supported Versions](/reference/edge-components/edge-component-supported-versions) page.

Key Updates:

* **X.509-SVID retrieval through Aembit CLI**: The `aembit credentials get` command now accepts [`--client-tls-private-key`](/dev-guide/cli/reference/credentials-get#--client-tls-private-key) to retrieve a SPIFFE-compliant X.509-SVID certificate from the existing [X.509-SVID Credential Provider](/user-guide/access-policies/credential-providers/about-spiffe-x509-svid). You supply a PEM-encoded private key. Aembit CLI generates the Certificate Signing Request (CSR) locally, submits it through the credential retrieval flow, and returns the signed certificate chain in `CLIENT_CERT_CHAIN`. The private key never leaves the local machine.