In netty/netty#8918 it was noted that getLocalCertificates() doesn't work on a handshake session on the server during the TrustManager call. This is past the time that the server should have sent certificates to the peer, so those certs should be available in the handshake session.