Java Runtime installation failure (Error 1330)

For security reasons, our network is completely disconnected from the Internet.  And I mean completely… we are not allowed to connect, ever.  In this situation, you quickly realize almost every vendor assumes you have Internet access (really? people still assume) and management of your network becomes harder by an order of magnitude.

As an example, earlier this week, I was trying to create an install package for the latest JRE, version 6 update 21.  I ended up getting an error 1330, invalid digital signature in data1.cab during the installation process.  After some research, I came across the following forum posts:

http://forums.sun.com/thread.jspa?threadID=5403715 and
http://forums.sun.com/thread.jspa?threadID=5380073
EDIT: Sorry, I know these links are broken, but Oracle changed the forum structure when Sun got gobbled by them and I haven’t had the time, or patience, to find where they went.  Personally, I consider this an HFE failure (the fact that the links broke when the site was migrated).  Shame on you Oracle.

Based on our connectivity (or lack of it), I realized this was due to the fact that JRE has a CAB file that uses a VeriSign code signing certificate that is NOT part of the Microsoft Root CA list.  To make matters worse, the CAB wants to run a CRL check that goes back to VeriSign.  After fiddling around trying different security options to bypass the CRL check, I finally gave up and went another way.

It turns out, that this issue only affects the JRE installer that is available for general consumer download.  The JDK, on the other hand, has a copy of the JRE as part of the package that doesn’t have this issue.  The bad part, is that the JDK makes you install, well, JDK stuff in addition to the JRE (which is an option).  Of course, I took this on as a challenge to split out the JRE as a standalone installer.

Most installers work the same way.  You download a single file and the file extracts all of the actual installation files into a temporary directory.  Since we only want the JRE from the JDK package, we will begin the install process.  Do not continue with the installer, or exit it.  Doing either action will cause the temporary files to be deleted.

At this point, the files are extracted to a temp directory located at:

C:\Users\<username>\AppData\LocalLow\Sun\Java\jdk1.6.0_21

(EDIT: This post was originally done with version 6 update 21.  Use the appropriate directory if your version is different.  This process has been most recently tested on version 6 update 25).  If you look inside this directory, you will see a msi file for the JDK along with a number of CAB files.

The one we’re interested in is the sj160210.cab file.  (EDIT: This filename is specific to the 32-bit version.  The 64-bit version may differ.  What you’re looking for is the cab that begins with ‘SJ’).  Double-clicking on this will show you the files within the CAB:

The jre.msi is the standalone JRE installer! You can use this by simply double-clicking on it, or rolling it as an SCCM package or script with msiexec support.  The adjacent MST files are language transforms (and are not needed for English).  Now, you can install JRE without the pesky CRL check!

Advertisements

11 Comments

  1. WireBug
    Posted December 16, 2010 at 7:26 pm | Permalink | Reply

    This is great, of all the solutions that I found in researching this error this is THE best solution by far and still applies to the latest editions of the JDK.

    Thank you for posting this. From now on I will get the JDK and extract the JRE MSI as it is PERFECT for GPO deployment.

    Thank You

  2. Posted December 16, 2010 at 7:54 pm | Permalink | Reply

    Thanks for the comment, WireBug. It is always nice to hear that my content has helped someone else!

  3. Stephen
    Posted January 31, 2011 at 3:44 pm | Permalink | Reply

    Thank you, thank you, thank you. I was at my wits end trying to figure this out. Awesome solution!!! Shame on you Oracle for making this such a complicated process

  4. Posted February 3, 2011 at 11:59 pm | Permalink | Reply

    Thank you! Oracle just has to do things their way and breaking the links is just the beginning. I had seen this error before Oracle gobbled up Sun but I expect things will only get worse over time. At least we have a work around that works thanks to you.

  5. Crossover
    Posted February 16, 2011 at 10:05 am | Permalink | Reply

    Excellent blog!
    One additional thing the JDK version gets rid off is the annoying ‘Update’ tab. You only have the General, Java, Security and Advanced.

  6. mney
    Posted November 9, 2011 at 3:23 pm | Permalink | Reply

    THANKS THIS worked with java Update 29

  7. Rincewind
    Posted December 7, 2011 at 3:55 pm | Permalink | Reply

    Thanks!! Worked with Java 7 Update 1

  8. Chuck
    Posted April 11, 2012 at 9:20 pm | Permalink | Reply

    Thank you. This was driving us nuts. They need to remove the digital sig check.

  9. MJBox
    Posted December 11, 2012 at 10:10 am | Permalink | Reply

    This drove me nuts briefly, until I remembered that I was installing in a UAT environment in a separate domain from Production. UAT routes Internet access through a firewall back via the Production domain and the firewall requires a log-in. I started an IE session, punched in Google’s URL and presented my credentials to the firewall. Once Google’s home page was loaded, I restarted the installation. Bingo! The installer could then “see” the signing authority and continued until successful conclusion.

    So, before embarking on a major investigation, see if the workstation can see the web first!

    • Posted December 11, 2012 at 4:21 pm | Permalink | Reply

      Thanks for the tip. This would absolutely cause the error. The network I work on is intentionally air-gapped from the Internet, so that’s why we had this problem…

  10. Ray
    Posted March 5, 2014 at 10:35 pm | Permalink | Reply

    Thank you! I was trying everything to install Java 6.24 and couldn’t find a solution.

One Trackback

  1. […] option). Of course, I took this on as a challenge to split out the JRE as a standalone installer. (Source) Reply With Quote […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: