MacOS – How to connect OS X Yosemite to a Windows based SSTP VPN

Figured it out. First downgrade JAVA to Apple 1.6 as mentioned by Joe L. Farina above. That actually does work in some situations, but if your VPN provider only supports an old version of Network Connect then it will continue to hang.

To fix that, on the terminal run the following, then restart your computer:

sudo nvram boot-args="kext-dev-mode=1"

For some users it might be necessary to do this: https://discussions.apple.com/thread/6546349

Update: Some folks have been asking what the above command does, and fairly so. The above command basically disables kext signing on your OS X equipment. Kext signing is a security (Code signing) feature, that verifies if drivers and other software installed on your computer have been altered in anyway from what the developer of the application/driver had originally released. Old applications developed for the OS X (pre Yosemite) did not have this feature, since the feature was introduced with Yosemite. It does have a theoretical security risk, but if you know what you are installing and you do it from authentic sources (like the app store or well known developers you trust), then you should be fine. Otherwise refrain. To read more about kext signing see: https://developer.apple.com/developer-id/

I think the unerlying issue is that Yosemite will not load kext (kernel extensions) unless they are signed by an authorized kernel extension developer. However in 10.8 and earlier, kexts could not be signed and signed kexts for 10.9+ will not load in <10.9.

I experienced the same issue loading unsigned tuntaposx for the vpnc cisco client.

You can override this behavior and allow the cpfw.kext to load in Yosemite by putting your computer into kext developer mode. This essentially reverts to the 10.9 behavior by allowing unsigned kexts to load.

sudo nvram boot-args="kext-dev-mode=1" 

Now reboot and your kext should load.

You can revert by doing this:

sudo nvram -d boot-args