1
89%
master: 89%

Ran 27 Mar 2026 04:04PM UTC

Files 630

Run time 19s

Badge

Embed ▾

Committed 27 Mar 2026 03:51PM UTC coverage: 88.715% (+0.01%) from 88.702%

Job # #20228.1

Build Type

push

github

Committed by

web-flow

Commit Message

util: update AdvancedTlsX509KeyManager to support key alias for reloaded cert (#12686)

## Overview

Make the alias in `AdvancedTlsX509KeyManager` dynamic so it can be used
with Netty's `OpenSslCachingX509KeyManagerFactory` to update key
material after reload.

Fixes #12670
Fixes #12485

## Problem

When using `SslProvider.OPENSSL`, each TLS handshake must encode Java
key material into a native buffer consumed by OpenSSL, which can account
for ~8% of server CPU. Netty's `OpenSslCachingX509KeyManagerFactory`
avoids this by caching the encoded buffer keyed by alias — but the
previous implementation always returned `"default"`, so the factory
could never detect credential rotations and create a new cache entry on
cert reload.

## Details

- The alias is now set to `key-<N>` (e.g. `key-1`, `key-2`, ...) and
  incremented on every `updateIdentityCredentials` call, ensuring the
  same alias always maps to the same key material.
- One prior key value is kept to allow consistent handshaking during key
  changes.

Coverage Stats

35540 of 40061 relevant lines covered (88.71%)

0.89 hits per line

grpc / grpc-java / #20228 / 1
89%
master: 89%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job #20228.1

grpc / grpc-java / #20228 / 1 89% master: 89%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job #20228.1

grpc / grpc-java / #20228 / 1
89%
master: 89%

README BADGES
x