For older devices, also note that the ScreenOS signing key changed in June 2014. If your OS is older than this you will need to update the signing key on the device BEFORE the upgrade process.
http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16496