May 2026 Netty monthly summary: Delivered a targeted improvement to TLS key material caching to robustly support certificate rotation. Key changes include adding evictStaleEntries() to OpenSslCachingKeyMaterialProvider and invoking it on cache misses to prune entries no longer recognized by the X509KeyManager before loading new material. Result: reduced memory usage and more reliable cert rotation, improving TLS handshake stability for clients relying on updated credentials. This work aligns with grpc-java performance goals and reduces the risk of stale material during rotation. Commit 40b824bcd39bdcd7bac972430419251c3431a033 (co-authored by Chris Vest). Related discussions: grpc/grpc-java PRs #12686 and #12670.

March 2026: Implemented TLS Dynamic Key Alias Support for re-loaded certificates in grpc-java, enabling credential rotation without performance penalties and improving TLS handshake efficiency. This work updates AdvancedTlsX509KeyManager to support dynamic aliases used by Netty's OpenSslCachingX509KeyManagerFactory, ensuring new key material is picked up on reload and new cache entries are created as credentials rotate. This reduces the previously high-CPU path in TLS handshakes and aligns with security and operational rotation requirements. All changes reference fixes #12670 and #12485.