Junos Pulse DOA with El Capitan (Mac OS 10.11)

[sjlee0_]

I don't see that with my install (5.0.5). The following is my errors in system.log:

6/25/15 10:44:43.525 AM Junos Pulse[44489]: *** -[NSThread initWithTarget:selectorbject:]: target does not implement selector (*** -[ConsoleAppDelegate scriptRunningProc])
6/25/15 10:44:43.532 AM Junos Pulse[44489]: .sdef warning for argument 'FileType' of command 'save' in suite 'Standard Suite': 'saveable file format' is not a valid type name.
6/25/15 10:44:43.939 AM Junos Pulse[44489]: Attempting to deallocate <NSMachPort: 0x79ab9000> that has not had -invalidate called on it. Breakpoint on _NSPortError debug.
6/25/15 10:44:45.610 AM Junos Pulse[44489]: Attempting to deallocate <NSMachPort: 0x79ab9000> that has not had -invalidate called on it. Breakpoint on _NSPortError debug.
6/25/15 10:44:47.378 AM Junos Pulse[44489]: Attempting to deallocate <NSMachPort: 0x79ab9000> that has not had -invalidate called on it. Breakpoint on _NSPortError debug.
6/25/15 10:44:48.955 AM Junos Pulse[44489]: Attempting to deallocate <NSMachPort: 0x79ab9000> that has not had -invalidate called on it. Breakpoint on _NSPortError debug.
6/25/15 10:44:50.474 AM Junos Pulse[44489]: Attempting to deallocate <NSMachPort: 0x79ab9000> that has not had -invalidate called on it. Breakpoint on _NSPortError debug.
6/25/15 10:44:52.015 AM Junos Pulse[44489]: Attempting to deallocate <NSMachPort: 0x79ab9000> that has not had -invalidate called on it. Breakpoint on _NSPortError debug.
6/25/15 10:44:53.596 AM Junos Pulse[44489]: Attempting to deallocate <NSMachPort: 0x79ab9000> that has not had -invalidate called on it. Breakpoint on _NSPortError debug.
6/25/15 10:44:55.125 AM Junos Pulse[44489]: Attempting to deallocate <NSMachPort: 0x79ab9000> that has not had -invalidate called on it. Breakpoint on _NSPortError debug.

[Kita_]

Not the system log.  The debuglog.log under /var/log/Juniper Networks/Logging.

[sjlee0_]

Oh OK. I do see the same message in that log.

I went into the Keychain Access, and found "VeriSign Class 3 Primary Certification Authority - G5" under the system roots. Is taht the cert you're referring to?

Currently it is marked as valid. What is the workaround? Could you elaborate on the steps for the workaround? Thanks!

[Kita_]

It should exist under SYSTEM, not SYSTEM ROOTS.  Do you have a G5 root existing under SYSTEM?  If so, mark this as ALWAYS TRUSTED.

[sjlee0_]

Thanks. I have it only under "system roots". I marked it always trusted anyway which put it under system. But I still see the errors... I guess it might be a different cert in our install? Is there a way to find out which cert junos is failing to verify?

[Kita_]

Add the following intermediate to the SYSTEM store and change to "Always Trusted"

https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id...

[mdesc_]

Hi Kita,

I changed my G5 certificate to always trust and it is now in the System keychain. I keep getting the same errors and logging messages. Anything else that we can try?

Thanks

[Kita_]

The cert you have added is not correct.  It is showing the expiration date is 2036.  Please grab the one from the following URL:

https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id...

It should state it is valid until 2021.

[mdesc_]

that did the trick! thank you very much. I first removed all g5 certs from my keychains. Downloaded the new one and installed it.

[Kita_]

Thank you for the confirmation.  I would not recommend remove any certificate from the SYSTEM ROOT store.  This could cause other issues as the G5 root is used as a trust anchor for a majority of issued VERISIGN/SYMANTEC certificates.  I foudn that adding it the G5 intermediate to the SYSTEM store is enough to workaround the issue.  

We are investigating this issue to see if there is any fault on our side and we will continue testing this scenario with each beta release.