Home
KUBE
Unify DevOps and Security teams by managing certificates with a Kubernetes-native certificate lifecycle management solution.
KUBE User Guide
Policy Enforcement
Cluster Policy
Configure Amazon ACM Private Key Exportability in Policy Central
Use this procedure to enroll Amazon ACM certificates with exportable private-key options from Policy Central in KUBE.

CLM
Automate certificate lifecycle management including issuance, discovery, renewal, and deployment, across public and private trust CAs. Assess, prioritize, and plan your migration to quantum-safe encryption with the Quantum Trust Hub add-on module.
PKI
Provision, govern and scale private trust certificates with a Post Quantum ready cloud based Enterprise PKI-as-a-Service.
Code Signing
Secure software, firmware, and containers with a comprehensive enterprise code signing solution.
SSH
Control SSH access and key rotation at scale with an SSH key lifecycle management solution.
KUBE
Unify DevOps and Security teams by managing certificates with a Kubernetes-native certificate lifecycle management solution.
- KUBE User Guide
  - Getting Started
  - KUBE Features and Capabilities
  - KUBE Deployment Architecture
  - Visibility & Control
  - Docker Image and Helm Chart Validation Using Cosign
  - Visibility
  - Dashboard - Insights
  - Policy Enforcement
    - Certificate Authority (CA) Integration
    - Creating the CA Policy
    - Groups
    - Cluster Policy
      - Creating a Cluster Policy Using Legacy Policy Method
      - Creating a Cluster Policy Using Policy Central
      - Configure Amazon ACM Private Key Exportability in Policy Central
        Use this procedure to enroll Amazon ACM certificates with exportable private-key options from Policy Central in KUBE.
      - Show Only Unmapped Clusters During Endpoint Mapping
        Use this procedure to map endpoints to eligible clusters and avoid duplicate cluster mappings by selecting only unmapped clusters.
      - Modifying Cluster Policy
      - Deleting a Cluster Policy
    - Appendix A: Prerequisites for Enabling the Integrated Windows Gateway Mode
    - Tags
  - Automate Certificate Lifecycle Management
  - Secure Service Mesh with mTLS authentication
  - Managing the Mesh Inventory
  - Enable External Signing
  - Integrating Istio with Custom CA
  - Alerts and Logs
  - Automation
  - System Administration
  - Notification Event
  - Enabling Custom Workflow Integration
  - Uninstalling and Cleaning up the KUBE Deployment
  - FAQs and Troubleshooting
- KUBE API Guide
- KUBE Upgrade Guide
  When migrating the AppViewX Compute cluster, it is necessary to upgrade the Cloud Connector and Cert Orchestrator to enable the latest KUBE features.
- KUBE as an EKS Addon - AWS Marketplace
DDI
Manage domain registration, renewal, decommissioning, and other security controls with an end-to-end domain lifecycle management solution.
ADC
Automate and orchestrate application delivery infrastructure at scale with an ADC lifecycle automation platform.
Platform
Manage policy and automation across all of the products and modules in the AVX ONE platform.
AVX Setup
Get detailed instructions for setting up AVX ONE in on-premises or SaaS deployments.
Artifacts
Review new features, fixes, and security advisories with official AppViewX release documentation.

Configure Amazon ACM Private Key Exportability in Policy Central

Use this procedure to enroll Amazon ACM certificates with exportable private-key options from Policy Central in KUBE.

Amazon CA integration is configured in KUBE.
A Policy Central cluster policy exists with an Amazon ACM issuance template.
You have permission to create or run certificate enrollment from KUBE.

Go to menu > KUBE > GROUPS & POLICIES > Cluster Policy.
The Cluster Policy inventory page is displayed.
Create a new Policy Central cluster policy or edit an existing one, then open its certificate enrollment or issuance template details for Amazon ACM.
The enrollment fields for Amazon ACM are displayed.
Enable privateKeyExportable to request the certificate in AWS ACM with an exportable private key.
The request is configured to create an exportable private key for that certificate enrollment.
(Optional) Enable retrievePrivateKey to have AppViewX retrieve the private key after issuance and store it for certificate lifecycle operations.
Private key retrieval is configured for completed enrollments.
Complete the remaining enrollment fields and submit the enrollment request.
The certificate request is submitted to Amazon ACM with the selected private-key behavior.
After issuance, verify the certificate details in KUBE to confirm the enrollment completed with the configured private-key options.
The certificate is available in KUBE according to the selected Policy Central settings.

Policy Central enrollment for Amazon ACM uses explicit private-key exportability and retrieval settings, aligned with your certificate lifecycle requirements.

AppViewX