Support for Java 11 and later on Edge SWG (ProxySG) and Advanced Secure Gateway appliances

Products

• Advanced Secure Gateway Software - ASG
• ProxySG Software - SGOS

Issue/Introduction

In 2018, Oracle announced that a paid license is required to update Java 8 Standard Edition for commercial use. For details, refer to https://java.com/en/download/release_notice.jsp.

As a result of this licensing change, Symantec provides an updated Management Console Launcher, developed on OpenJDK, that is compatible with Java 11, 12, and 16. The updated Launcher is available, for free and without a licensing requirement, for versions of SGOS and Advanced Secure Gateway that currently support the Launcher (version 6.6.5.1 and later).

Prior to the Java change, you could use a Launcher JNLP file (Java Web Start) or go directly through a browser to access the Management Console. With Java 11, 12, and 16, the Launcher is available as a Java application that you use to access the Management Console.

Resolution

To create a Java application for the Management Console Launcher: 

1. Download a supported Java version. Only OpenJDK, and Oracle Java packages are supported.
2. Download and install JavaFX 11. Note the installation directory; you will need this information in step 6.
3. In the Control Panel, open System. Click Advanced system settings.
4. On the Advanced tab, click Environment Variables.
5. Add a new system variable with the following properties:
   • Variable name: JAVAFX_HOME
   • Variable value:  the lib folder in the JavaFX installation directory
     Note: If the directory includes a space, enter the value within quotation marks, such as "C:\Program Files (x86)\Java\javafx-sdk-11.0.2\lib"
6. Save the changes to the environment variables and close Control Panel.
7. Download the loader.jar file attached to this article.
   Alternatively, or if in an isolated environment, download the file from the appliance. Enter the following address in a browser:
   https://<appliance_address>:8082/Secure/Local/console/r<build_number>/loader.jar)
   where <build_number> is the Release ID of the default system in the output for #(config installed-systems)view
8. In the directory where you downloaded the JAR file, create a batch file containing the following commands:

java -Djdk.attach.allowAttachSelf --add-opens=java.base/sun.net.www.protocol.http=ALL-UNNAMED --add-exports=java.base/sun.net.www.protocol.jar=ALL-UNNAMED --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.desktop/javax.swing.plaf.basic=ALL-UNNAMED --add-opens=java.base/jdk.internal.loader=ALL-UNNAMED --illegal-access=permit -classpath loader.jar --module-path %JAVAFX_HOME% --add-modules javafx.controls,javafx.swing,javafx.web,javafx.base,javafx.graphics,javafx.media bluecoat.sgos.ui.loader.Loader

Note: On Linux and Mac systems, use ${JAVAFX_HOME.EN_US} instead of   %JAVAFX_HOME%.

To open the Management Console Launcher, double-click the batch file. Refer to the "Accessing the Appliance" chapter in the SGOS Administration Guide for details on using the Launcher.

Accessing the Management Console with multiple versions of Java

If prior versions exist on the system after installing Java, you can still access the Management Console using previous methods such as Java Web Start; however, Java must be the default version on the system in order to use the method described in this document.

Check the default version by entering java -version at the command prompt:

C:\Users\user1>java -version
java version "11.0.2" 2018-10-16 LTS
Java(TM) SE Runtime Environment 18.9 (build 11.0.2+7-LTS)
Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11.0.2+7-LTS, mixed mode)

If needed, set the correct Java version as the default version running on the system.

Additional Information

Depending on the security requirements of your system and the certificates you already have installed on your system, you might need to download and install a new root and intermediate Certificate for the Java Management Console Launcher to work.