Reviving Huawei SANEX9510: Expired Certificates, Zero-Byte Keystore and Lost '@' Symbol Fixed Without Database Restart
A telecom OSS platform based on Huawei SANEX9510 (version V200R003C10SPC110) was restored after ten months of downtime caused by a cascade of seven distinct failures across four independent TLS contours.
The system collects and analyzes signaling traffic (MAP, ISUP, SCCP, TCAP) on two main servers and four DSS collectors. Data flows through four separate encrypted paths: WAS-DAS over Thrift (port 29301), DAS-DSS over FTPS, WAS-DSS over SGDSS (port 6688), and Store-Sybase IQ (port 2988). Each contour uses its own keystore and truststore, producing generic error messages that masked the real causes.
Layer 1: DAS identity certificate replacement
The first certificates to expire belonged to the DAS FTPS identity (CN=GENEX CN Nastar, expired 2025-10-18). A new serverkeystore_das.p12 containing the chain mae.huawei.com → Huawei Wireless Network Product CA → Huawei Equipment CA was deployed to both nodes, allowing DAS to start.
Layer 2: Zero-byte WAS keystore
WAS still failed to start because its identity PKCS#12 file was exactly 0 bytes. The empty file produced only indirect TLS errors instead of a clear fatal message. A new keystore was built from server_final.pem and SI.cer, verified as a valid PrivateKeyEntry with CN=mae.huawei.com valid until 2030.
Layer 3: Single missing '@' in encrypted password
TrustStorePass in ThriftClient.properties had lost its leading '@' during copy-paste through a PTY session. Restoring the character allowed the encrypted password to decrypt correctly and the truststore to open.
Layer 4: Separate FTPS keystore
DAS uses serverkeystore_das.p12 for Thrift but serverkeystore.p12 for FTPS (configured in ftpsCer.properties). A mapping of all property files to their actual keystores prevented accidental breakage of the newly restored WAS-DAS link while the FTPS certificate was replaced.
Layer 5: DSS private-key format incompatibility
New certificates had been loaded on the server in May 2026 but not applied to the DSS collectors. After loading via OMU and LOD CERT, the FTP service still refused to start. The private key had been generated with modern OpenSSL using PBKDF2 with HMAC-SHA512, which the product's legacy OpenSSL (0.9.8/1.0.x) could not process. Re-encrypting the key with matching parameters on a current Ubuntu system resolved the issue.
Layer 6: WAS-DSS SGDSS contour on port 6688
After FTPS was fixed, the GUI still showed Connection Interrupted Between WAS and Device. Manual OpenSSL and Java TLS handshakes confirmed mutual authentication worked. Re-establishing the links between WAS and the DSS collectors brought all four DSS instances online without further configuration changes.
Layer 7: Store connection leak to Sybase IQ
Store reported login errors while Sybase IQ showed 204 established connections against a -gm 300 limit. Restarting only the Store process reduced connections to 113 and restored database writes. No password changes or ALTER USER commands were executed.
An unrelated month-old alarm (Failed to import DAS data to database, Alarm ID 20) was traced to a missing PB_DAS_DIRSIZE table. The table was created manually from the installation DDL; subsequent import cycles succeeded immediately.
Related articles
Courtroom Sketches in the US and UK: Artistic Traditions, Charles Manson Trial and Lawyer Irvin Kanarek
The article explores the history and techniques of courtroom sketching in the United States and Britain, highlighting key artists and their distinctive styles. It details how Bill Robles captured the dramatic moment when Charles Manson lunged at Judge Older during his trial. The piece also reveals the unusual background of Manson's third attorney, Irvin Kanarek, a former rocket engineer turned lawyer known for deliberately prolonging cases. British artist Priscilla Coleman is noted for her method of sketching from memory after taking detailed notes in court. Additional artists such as Jane Rosenberg, Arnold Mesches, and Joseph Papin are profiled for their contributions to the genre. The text emphasizes that courtroom art conveys emotion and atmosphere that photographs cannot capture.
No News Content Available
The provided news item contains no text or details in the original Chinese source. Without any substantive information, it is impossible to determine relevance to cybersecurity topics. The entry is therefore classified outside all security-related categories.
Russian Federal Tax Service Tests Scoring Model to Uncover Concealed Self-Employed Income
The Russian Federal Tax Service is piloting a new scoring system designed to detect self-employed individuals who attempt to hide revenue by improperly canceling receipts in the Moy Nalog application. The model analyzes patterns such as systematic cancellations over specific periods and instances where checks are annulled by partner platforms or banks. Vladimir Maltsev, head of the operational control department at the Federal Tax Service, confirmed that the system is already being tested in several regions. Over the first nine months of 2026, authorities imposed penalties on approximately 3,000 self-employed taxpayers for unlawful receipt cancellations, resulting in fines totaling around 300 million rubles. The approach mirrors risk-assessment techniques long used by banks and focuses not only on incoming funds but also on how users manage recorded transactions. Full details of the scoring parameters and their weighting remain undisclosed to prevent circumvention.
Kimi K3 Open Model Surpasses Closed GPT and Anthropic Systems on Independent Benchmarks
Kimi K3 is an open-weight model developed by Moonshot AI that achieves state-of-the-art results on several independent benchmarks while allowing full local deployment. The architecture scales context length to one million tokens, increases layer depth, and expands the expert count to 896 within a Mixture-of-Experts design. Developers replaced the standard KV cache with a fixed-size state matrix updated via the delta-rule and introduced stabilizing mechanisms to prevent numerical overflow in BF16 precision. Sequential state updates were parallelized across chip, card, and multi-card levels using the open-sourced FlashKDA kernel built on CUTLASS. Information flow between layers was restructured with learned pseudo-queries that selectively retrieve relevant outputs from prior blocks, while expert routing employs per-expert quantile thresholds and a latent-space projection to maintain load balance. The resulting model demonstrates that carefully engineered scaling across context, depth, and width can close the gap with closed-source leaders without requiring proprietary data or compute advantages.