#20228
89%

Ran 27 Mar 2026 04:04PM UTC

Jobs 1

Files 630

Run time 2min

Badge

Embed ▾

Committed 27 Mar 2026 03:51PM UTC coverage: 88.715% (+0.01%) from 88.702%

Build # #20228

Build Type

push

github

Committed by

web-flow

Commit Message

util: update AdvancedTlsX509KeyManager to support key alias for reloaded cert (#12686)

## Overview

Make the alias in `AdvancedTlsX509KeyManager` dynamic so it can be used
with Netty's `OpenSslCachingX509KeyManagerFactory` to update key
material after reload.

Fixes #12670
Fixes #12485

## Problem

When using `SslProvider.OPENSSL`, each TLS handshake must encode Java
key material into a native buffer consumed by OpenSSL, which can account
for ~8% of server CPU. Netty's `OpenSslCachingX509KeyManagerFactory`
avoids this by caching the encoded buffer keyed by alias — but the
previous implementation always returned `"default"`, so the factory
could never detect credential rotations and create a new cache entry on
cert reload.

## Details

- The alias is now set to `key-<N>` (e.g. `key-1`, `key-2`, ...) and
  incremented on every `updateIdentityCredentials` call, ensuring the
  same alias always maps to the same key material.
- One prior key value is kept to allow consistent handshaking during key
  changes.

Run Details

35540 of 40061 relevant lines covered (88.71%)

0.89 hits per line

Uncovered Existing Lines

Lines	Coverage	∆	File
2	88.04	-0.96%	../netty/src/main/java/io/grpc/netty/NettyServer.java
5	83.02	-9.43%	../core/src/main/java/io/grpc/internal/Http2Ping.java
16	81.32	7.71%	../util/src/main/java/io/grpc/util/AdvancedTlsX509KeyManager.java

Jobs

ID	Job ID	Ran	Files	Coverage
1	#20228.1	27 Mar 2026 04:04PM UTC	630	88.71

grpc / grpc-java / #20228
89%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Existing Lines

Jobs

Source Files on build #20228

grpc / grpc-java / #20228 89%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Existing Lines

Jobs

Source Files on build #20228

grpc / grpc-java / #20228
89%

README BADGES
x