Juniper Network Connect hangs at “Establishing Secure Session” after upgrading to OS X El Capitan I have a problem trying to connect to a VPN using "Juniper Network Connect". It happened after I upgraded from Mac OS X Yosemite (10.10) to Mac OS X El Capitan (10.11).

Ever since I upgraded to OS X El Capitan, though, Juniper Network Connect (VPN client) stopped working. First it just wouldn't launch. I also upgraded to the latest Java version from Oracle. Now although Network Connect launches it hangs at the "Establishing Secure Session" step. It seems as though the connection is established (since I lose internet access in this period) but it can't create a tunnel.

Before I had the same problem, and solved it using the solution provided here only making this:

sudo nvram boot-args="kext-dev-mode=1"


But for "El Capitan" it's not working.

Here are some lines of the log:


  20151022170309.742528 Network Connect[p430.t2567] ncsvccontrol.error The service failed to configure the tunnel (ncsvccontrol.mm:262) 
  
  20151022170309.856101 Network Connect[p430.t2567] nc.mac.app.1202.error DSError 0x2cbc0fa0 domain=nc.mac.app code=1202
  "ncproxyd failed to establish a tunnel, status = 4"
  20151022170310.316057 Network Connect[p430.t76719] dsssl.error Cert hash is not SHA256. len=32 (DSSSLSock.cpp:1781)
As of July, it appears Juniper is still working on this. The conclusion of that thread claims you can get Pulse working again by:


Downloading the Symantic Certificate Authority
Rename Symc_Cross_Root.txt to Symc_Cross_Root.crt
Open Keychain Access, select 'System' in the left pane
Choose File>Import File... And navigate to the file you just renamed
If you see something about a VeriSign class 3 certificate you're doing the right thing. Click the drop down next to 'Trust'
Select 'Always Trust'. If you get a little blue icon next to the cert, you should be good to go. 


Please note I've not tried this myself. It's a hack to get around unpatched and misbehaving software. While I generally like Juniper, I don't use their software products and I don't trust their tech team as far as I can throw the SRX550 that once shit out on me during a server move. This advice is coming to you from a stranger on the Internet, your mileage may vary, failure to fully test before upgrading in a production environment may cause herpes, etc. etc.