OS X 10.6.2 | Java Update 10.6 Update 1 and Juniper SSL/VPN Gateway 6.5R1

Question

OS X 10.6.2 | Java Update 10.6 Update 1 and Juniper SSL/VPN Gateway 6.5R1

I have the following questions regarding updates and support of Java 1.5 related to the information provided herein:

Question 1 - Is there a way to "roll-back" the OS X Java 10.6 Update 1 update?

Question 2 - Why are we removing support for Java 1.5 with the current Java 10.6 Update 1?

Question 3 - Is there a known fix for resolving the Juniper SSL/VPN Network Connect 6.5R1 issue?

Juniper VPN "Network Connect" was working on 10.5.8 until I updated with the latest OS X Java Update which disabled Java 1.4 and left my Java 1.5 and 1.6 intact. The result when using Juniper SSL/VPN 6.5R1 was that I could establish a VPN session, but when attempting to load the "Network Connect" I received the error: "An error occurred while extracting one of the Network Connect components."

After research, it sounded like I stood a better chance of resolving this with an upgrade to Snow Leopard. The upgrade, my first OS X upgrade, went well from a Juniper perspective. The resulting Java preferences listed 1.5 (64 and 32 bit) along with 1.6 (64 and 32 bit) Following the upgrade to 10.6, I was able to establish a VPN connection and a Network Connect session - Success!

Then came the software update notice for 10.6.2 and Java 10.6 Update 1. Only having worked with OS X 10.5 (I purchased my first MacBook Pro July 2008), I became comfortable with Apple's update process and applied these updates. After updating, I could no longer establish a Network Connect session, receiving the same error listed above for 10.5.8: "An error occurred while extracting one of the Network Connect components." My Java Preferences now indicated only support for Java 1.6 (64 and 32 bit).

I am working with our staff who support the Juniper VPN and trying to get them to initiate a JTAC report. I also see multiple references that indicate I may need to reinstall Java 1.5 but before I do I would prefer to roll-back the Java 10.6 Update 1 update to see if that fixes my issue.

MacBook Pro, Mac OS X (10.6.2), Juniper SSL/VPN 6.5R1

Posted on Dec 10, 2009 11:17 PM

Reply

Answer 1

baltwo

Level 9

62,362 points

Dec 11, 2009 12:43 PM in response to Brian Trimble

See http://wiki.oneswarm.org/index.php/OSX_10.6_SnowLeopard

Reply

Answer 2

Dec 13, 2009 10:17 AM in response to baltwo

I'm having a very similar issue and the oneswarm wiki article didn't seem to fix the issue. Is there any other options than a complete re-install of OS X?

Thanks

Reply

Answer 3

kmaybe

Level 1

15 points

Dec 13, 2009 7:26 PM in response to Brian Trimble

Hi Brian,

The reason you are seeing the error "An error occurred while extracting one of the Network Connect components" when attempting to upgrade your Network Connect client after installing the latest Java update is because Apple changed the keystore password that protects the "cacerts" file on Mac OS X that is referenced in our Installer package and we attempt to access the file using the old password with causes a Java Exception error in our ncinstallhelper program which prevents the installation from going any futher.

Here's the bug that was filed with Apple on this issue:

http://lists.apple.com/archives/java-dev/2009/Dec/msg00067.html

Somebody managed to crack the "cacerts" keystore password and posted this here:

http://lists.apple.com/archives/java-dev/2009/Dec/msg00093.html

Now that Mac users have the new password there have been some solutions provided by other site using Java applications that also hit this issue when trying to access the keystore.

See Comment #6 in the following post:

http://bugzilla.zimbra.com/show_bug.cgi?id=43197

Juniper will publish a Knowledge Base article this week with more details on the issue.

I would recommend opening a support ticket with Juniper to track this so you can receive regular updates on the progress/resolution. Email me with the case number once you have it.

kmayberry@juniper.net

Thanks,

Karen

Reply

Answer 4

baltwo

Level 9

62,362 points

Dec 13, 2009 9:26 PM in response to kmaybe

Thanks for jumping in. It's all yours.

Reply

Answer 5

Dec 14, 2009 5:48 AM in response to baltwo

The oneswarm wiki does not fix this problem but Karen's post provides hope:-) Thank you for this response; I am working with our Juniper lead on this, will forward the ticket if I can get it.

While I have encountered several issues as a result of the Snow Leopard upgrade, some due to my inexperience with OS X, I am impressed with the communicated on the Apple forums regarding fixes and bug tracking to resolve issues on the new release!

I can work around this for a while using a Fusion VM; will wait for the Juniper KB article before taking action.

Thank you,

Brian

Reply

Answer 6

Dec 14, 2009 1:49 PM in response to Brian Trimble

Upgrading my Snow Leopard Mac to version 6.5.0 Release 2 of Juniper Network Connect fixed this instantly.

I had to run the standalone installation package from an Apple Disk Image file. The company's Juniper gateway couldn't complete the upgrade through Safari, I assume for same reasons as above.

Your VPN admin should be able to get the install .DMG from Juniper for you.

HTH/jc

Reply

Answer 7

kmaybe

Level 1

15 points

Dec 14, 2009 6:10 PM in response to Brian Trimble

The KB article is being reviewed and we should have it posted tomorrow.

The KB provides steps to change the keystore password for the cacerts file back to "changeit" since this is the password set in our NC installation package to gain access to the file.

I've tested this solution on Mac OS X 10.5.6 with Java update 6 and Mac OS X 10.6.2 with Java update 1 and it works. Both clients were in the state where NO version of NC could be installed without seeing the error but the keystore password was changed back to "changeit" the very next attempt to install Network Connect worked and I had a tunnel up and running within seconds.

I've talked to a few Mac users who don't see any issues with changing the keystore password for this file but we don't know how many users will be comfortable with this solution since it involves the user having to make changes to the system as "sudo"

In any event, it would be great if more users could test the workaround to see if it works for you.

Here is the command verbatim:

sudo keytool- storepasswd -new changeit -keystore /System/Library/Frameworks/JavaVM.framework/Resources/Deploy.bundle/Contents/Ho me/lib/security/cacerts -storepass changeme

Reply

Answer 8

Dec 15, 2009 1:53 AM in response to kmaybe

Really appreciate the feedback on this issue:

1. Tried the command posted by Karen, please note there needs to be a space following the keytool command and the "-" needs to preceed the storepasswd parameter, may have just been how the forum accepted the paste. The command worked but did not solve the problem, still getting the extraction error. The command as entered, which did change the password on the keystore was:

keytoolsudo keytool -storepasswd -new changeit -keystore /System/Library/Frameworks/JavaVM.framework/Resources/Deploy.bundle/Contents/Ho me/lib/security/cacerts -storepass changeme

I will now see if I can obtain the Juniper install.dmg image as recommended and give that a try later today.

Reply

Answer 9

Dec 15, 2009 2:23 AM in response to Brian Trimble

Please note; Karen's posted solution did work but, had to restart my system before it would work. I initially just closed Safari and gave it a shot which did not work. After restarting my system the posted issue is resolved.

THANK-YOU!

Reply

Answer 10

kmaybe

Level 1

15 points

Dec 17, 2009 7:14 AM in response to Brian Trimble

Brian,

Thanks for catching the typo in the command. You are correct, it should be modified to:

keytoolsudo keytool -storepasswd -new changeit -keystore /System/Library/Frameworks/JavaVM.framework/Resources/Deploy.bundle/Contents/Ho me/lib/security/cacerts -storepass changeme

The KB has been finalized and should be posted today. I'll update this thread with the URL later on

Reply

Answer 11

csnapp12

Level 1

0 points

Dec 18, 2009 5:18 AM in response to kmaybe

Our company just updated VPN last night and was having the same issue. I had to use the following code in order to get it to work correctly on my mac:

sudo keytool -storepasswd -new changeit -keystore /System/Library/Frameworks/JavaVM.framework/Resources/Deploy.bundle/Contents/Ho me/lib/security/cacerts -storepass changeme

Thanks for the help!

Reply

Answer 12

Jan 3, 2010 3:01 PM in response to kmaybe

The instructions on KB note worked for me. Great. A restart wasn't required. Carefully follow the instructions regarding a return or not in the long string.

Reply