Expired Certificates, Zero-Byte Keystore and Missing '@': Reviving Huawei SANEX9510 Without Database Restart
A detailed postmortem reveals how a long-dead Huawei SANEX9510 telecom OSS platform was restored in three days after ten months of downtime. The outage involved seven independent failures across four separate TLS circuits, including expired certificates, an empty PKCS#12 keystore, a truncated encrypted password missing its leading '@', and an incompatible private-key encryption format that the product's legacy OpenSSL could not process. Technicians mapped every keystore dependency, rebuilt identities with modern OpenSSL parameters matching PBKDF2 and HMAC-SHA512, and verified mTLS handshakes on ports 29301, 6688 and FTPS without rebooting servers or Sybase IQ. Connection leaks to the database were resolved by restarting only the Store component, avoiding any password resets or schema changes. The case highlights the absence of certificate-expiry warnings and the difficulty of diagnosing legacy Java/OpenSSL stacks where error messages bear little relation to root causes.
HabrOct 30, 2026Translated from Russian