<p>Smart-home IoT devices face tight memory, energy, and latency budgets, yet deployments still apply a single heavyweight cipher and fixed key lifetimes to all flows. We introduce CALIS, an SDN-based, AI-driven framework that uses real-time device/network telemetry to select, per flow, a lightweight AEAD cipher (ASCON-128, AES-128-GCM, or ChaCha20-Poly1305) and an adaptive key-rotation interval. A compact gradient-boosting policy (XGBoost) executes at the controller and enforces decisions through standard SDN rules; mutual authentication and ECDH handle key establishment. Using a Raspberry Pi smart-home testbed and a public multi-device traffic corpus, CALIS reduced memory footprint by 86%, energy consumption by 58%, execution time by 58%, and communication overhead by 50% versus a static AES-256 baseline. Formal PySMT/Z3 verification under a Dolev–Yao adversary confirmed secrecy and authentication in all modeled scenarios with solver times less than 1 ms. Ablation studies show that disabling adaptive rotation or ML decisions consistently degrades efficiency. These results demonstrate that controller-side, context-aware crypto agility and adaptive key freshness can deliver substantial resource savings without weakening security, providing a practical path for heterogeneous, resource-constrained smart-home IoT. Our code is available at <a href="https://github.com/eseinctz/calis">https://github.com/eseinctz/calis</a></p>