# Aembit Secrets Operator now delivers X.509-SVID certificates

**Aembit Secrets Operator 1.34.358** and **Aembit Secrets Operator Helm chart 1.34.358** are now available.

[Secrets Operator](/user-guide/deploy-install/kubernetes/aso/) now delivers X.509-SVID certificates to your Kubernetes workloads. When an `AembitSecretRefreshSchedule` sets `credentialType: X509Svid`, Secrets Operator generates a private key inside the cluster and obtains a signed certificate from Aembit. It writes both to a `kubernetes.io/tls` Secret that your workload uses for mutual TLS. See [Deliver X.509-SVID certificates with Secrets Operator](/user-guide/deploy-install/kubernetes/aso/x509-svid/).

* **New `X509Svid` credential type**: The Secret holds `tls.crt` with the signed certificate chain and `tls.key` with the private key. Secrets Operator sends Aembit only a certificate signing request, so the private key never leaves the cluster.
* **Automatic renewal**: Secrets Operator refreshes the certificate before it expires.
* **TLS Secret type**: `X509Svid` writes a `kubernetes.io/tls` Secret, while every other credential type writes a generic Secret, so switching a schedule to or from `X509Svid` deletes and recreates the target Secret. See [Credential types and Secret data keys](/user-guide/deploy-install/kubernetes/aso/reference/#credential-types-and-secret-data-keys).