Can't get kext to install on macOS Mojave, utilities install button is greyed out

[Petr Bena]

Hello,

I upgraded both my MacOS and tunnel blick on my old MacBook air some time ago and now I can't get it to work.

Every time I try to connect I get this message:

Tunnelblick was not able to load a system extension that is needed to connect to VPN.
To allow Tunnelblick to install its system extensions, you must allow loading of system software by developer 'Jonathan Bullard'. You can do that on the 'General' tab of 'Security & Privacy' in 'System Preferences'.
If you do not see a button to allow loading of system software by developer 'Jonathan Bullard', try to connect this configuration (which will fail), then look on the 'General' tab of 'Security & Privacy' in 'System Preferences' again.
More information [tunnelblick.net]

There is never any button to allow loading anything by Jonathan Bullard in general tab of security, not after restarting app, rebooting OS, or reconnecting, it's just never there. It seems to be Tunnelblick doesn't even try to load it.

In utilities there is button to initiate the kext installation, but it's greyed out.

How can I force install the kexts so that I can use VPN?

[Tunnelblick developer]

You do not need to install the kexts on Mojave. You only need to do that on macOS Big Sur and later.

But you must tell macOS to allow Tunnelblick to load the kexts. To do that, follow the procedure described in Tunnelblick on macOS High Sierra and macOS Mojave.

Specifically, note the last two paragraphs. After a restart, to get macOS to display the System Preferences message asking if the kexts should be loaded, you must try to connect a VPN which uses them.

[Petr Bena]

But that's what I did multiple times, it always just show that message I pasted here 'Tunnelblick was not able to load a system extension' and there is nothing in security panel in settings, no button to allow anything.

BTW from terminal sudo openvpn command with same ovpn config works fine and VPN connects, just tunnelblick can't seem to start it.

[Tunnelblick developer]

Please post the diagnostic info obtained by following the instructions at Read Before You Post (https://tunnelblick.net/cBeforeYouPost.html).

[Petr Bena]

Here is logs:

2022-11-02 12:38:41.623198 *Tunnelblick: macOS 10.14.6 (18G103); Tunnelblick 3.8.7a (build 5770); prior version 3.8.4a (build 5601)
2022-11-02 12:38:41.940509 *Tunnelblick: Attempting connection with XenNetwork using shadow copy; Set nameserver = 769; monitoring connection
2022-11-02 12:38:41.941413 *Tunnelblick: openvpnstart startXenNetwork.tblk510717690101098098-ptADGNWradsgnw2.5.4-openssl-1.1.1l <password>
2022-11-02 12:38:52.050391 *Tunnelblick:

Could not start OpenVPN (openvpnstart returned with status #247)

Contents of the openvpnstart log:
openvpnstart log:
     Failed to load the tap kext; status = -603946985
     
     Failed to load the tap kext; status = -603946985
     
     Failed to load the tap kext; status = -603946985
     
     Failed to load the tap kext; status = -603946985
     
     Failed to load the tap kext; status = -603946985
     
     Unable to load net.tunnelblick.tun and/or net.tunnelblick.tap kexts in 5 tries. (It was not loaded even though the system said it was loaded.)

[Tunnelblick developer]

Log doesn't help; that's why I asked for the diagnostic info.

[Petr Bena]

[Tunnelblick developer]

The problem is shown here:

     Tunnelblick Kext Policy Data:

     net.tunnelblick.tap|Z2SG5H3HC8|Jonathan Bullard|1|1
     net.tunnelblick.tun|Z2SG5H3HC8|Jonathan Bullard|1|1

This data comes from a macOS internal database and indicates that when asked (perhaps for the first time), you told macOS to not allow Tunnelblick to load the kexts.

The original versions of macOS Mojave this caused the problem you describe, but a later version fixes the problem.

Here are two possible solutions:

1. Update your Mojave configuration to include security fixes past the ones you have. (Per this Wikipedia article, there are 15 security updates that your system doesn't have -- all the updates after 18G103). You should do this anyway, of course, to get the security vulnerabilities fixed.
   
2. Reboot the computer into Safe Mode, which might clear out the database entries. Then, after rebooting normally, try to connect, get the failure, and look in the System Preferences.