Tripp Lite KVM Java Web Start (JNLP) Setup & SSL Fix#

This guide documents the fix for opening the Tripp Lite KVM virtual console (viewer.jnlp) on macOS when modern Java blocks connections due to legacy TLS/SSL cipher handshake failures.

1. Problem Overview#

When launching viewer.jnlp via Java Web Start (javaws), the applet fails with the following errors:

com.sun.deploy.net.FailedDownloadException: Unable to load resource: https://10.1.5.2:443/iClientJ12111.jar@pid=...
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

Cause#

Tripp Lite IP KVM switches (and rebranded ATEN/Avocent devices) rely on legacy SSL/TLS protocols (TLS 1.0 / TLS 1.1) and deprecated ciphers (e.g., 3DES, 1024-bit Diffie-Hellman keys). Modern Java runtimes (Java 8u291+ and newer) disable these protocols by default in java.security.

2. Implemented Solution (macOS Setup & TLS Fix)#

2.1. System-Level java.security Edit (Required for Resource Download Phase)#

Java Web Start (javaws) connects to HTTPS (https://10.1.5.2) using the system-level Java security config before spawning the application JRE. In Java 8u291+, Oracle disabled TLS 1.0/1.1 protocols AND legacy ciphers (TLS_RSA_*, 3DES_EDE_CBC) at the system level, causing SSLHandshakeException: Received fatal alert: handshake_failure during .jar file download.

To allow javaws to negotiate ciphers and download applet resources over TLS 1.0/1.1, run this command in Terminal:

sudo python3 -c "
import re
path = '/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/java.security'
with open(path, 'r') as f: content = f.read()
pattern = r'jdk\.tls\.disabledAlgorithms=.*?(?=\n\n|\n[a-zA-Z#])'
replacement = 'jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, anon, NULL\n'
with open(path, 'w') as f: f.write(re.sub(pattern, replacement, content, flags=re.DOTALL))
"

2.2. Create Custom User-Level java.security Override File#

Location: ~/.java/java.security (Note: Placing this file in a path without spaces prevents Java Web Start argument parsing failures).

# Custom Java Security overrides for Tripp Lite KVM legacy TLS support
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, anon, NULL
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 512, DSA keySize < 512

2.3. Configure Java Web Start & Disable CRL Checks#

Location: ~/Library/Application Support/Oracle/Java/Deployment/deployment.properties

Ensure the following properties are set so Java Web Start automatically passes the custom security configuration and skips online certificate revocation checks:

deployment.security.TLSv1=true
deployment.security.TLSv1.1=true
deployment.security.validation.crl=false
deployment.security.validation.ocsp=false
deployment.javaws.jre.0.args=-Djava.security.properties\=/Users/marc/.java/java.security

2.4. Add KVM IP to Exception Sites List#

Location: ~/Library/Application Support/Oracle/Java/Deployment/security/exception.sites

Ensure the target KVM URL is added (both with and without port):

https://10.1.5.2:443
https://10.1.5.2

2.5. Important: JNLP Session Tokens are One-Time Use Only#

The .jnlp file downloaded from the Tripp Lite KVM web interface contains one-time authentication tokens:

<argument>16ACB088155D066E2ED8</argument>
<argument>b022u08ipqmoz7ien80w0mwjo3k46win</argument>

Once a session is closed or disconnected, the KVM hardware invalidates these tokens. Re-opening an old viewer.jnlp file will cause the Java applet to fail silently or exit immediately.

To launch a new session: Always log back into the KVM web UI (https://10.1.5.2) and download/click a fresh viewer.jnlp file.

3. How to Reproduce / Launch#

Method A: Automated CLI Launcher Script (kvm Alias) - PRIMARY / RECOMMENDED#

Script location: /Users/marc/Scripts/MacOS/KVM-Launch.sh

To set up the alias on a new Mac, run this one-liner in Terminal (safe against duplicate entries):

grep -qF "alias kvm=" ~/.zshrc || echo "alias kvm='/Users/marc/Scripts/MacOS/KVM-Launch.sh'" >> ~/.zshrc && source ~/.zshrc

This is the primary and most reliable method on macOS. It automatically strips macOS Gatekeeper quarantine, picks the newest viewer.jnlp in ~/Downloads, fetches the applet JAR, and launches the Java session instantly without security prompts:

# Simply type kvm after downloading a fresh viewer.jnlp
kvm

# Or pass a specific JNLP file path
kvm /path/to/viewer.jnlp

Method B: Native Finder Double-Click (javaws)#

Standard Java Web Start execution automatically applies the TLS overrides when double-clicking .jnlp files in Finder or running via CLI:

javaws /path/to/viewer.jnlp

Method C: Manual CLI Execution (Fallback)#

# 1. Strip macOS Quarantine attribute from downloaded file
xattr -d com.apple.quarantine ~/Downloads/viewer.jnlp

# 2. Download the jar file from the KVM
curl -k -o /tmp/iClientJ.jar "https://10.1.5.2:443/iClientJ12111.jar@pid=A03AC91332A6A2027C41"

# 3. Execute applet with TLS properties passed directly
java -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 \
     -Djava.security.properties="/Users/marc/.java/java.security" \
     -cp /tmp/iClientJ.jar \
     iclientj.ClientApplet 10.1.5.2 9000 A03AC91332A6A2027C41 b022u08ipqmoz7ien80w0mwjo3k46win

4. Alternative Solution: Docker Container (Zero Host Java Configuration)#

If you migrate to a new system or prefer not installing/configuring Java on the host macOS machine, run a containerized legacy Java viewer exposed over noVNC (HTML5 Web Interface).

  • solarkennedy/docker-javaws / mikenowak/docker-kvm-viewer: Bundles Java Web Start in a virtual frame.
  • remote-kvm-docker / docker-firefox-java: Runs Firefox + legacy Java plugin in Docker.

4.2. Example Docker Execution#

# Run container mapping port 8080
docker run -d \
  --name kvm-viewer \
  -p 8080:8080 \
  -v ~/Downloads:/downloads \
  solarkennedy/docker-javaws
  1. Open http://localhost:8080 in Chrome/Safari.
  2. Load the .jnlp file inside the browser-based virtual display.
  3. Access the KVM console with zero local Java modifications required.
Backward Scripts Management Standard Starlink Forward