Your organization might have noticed in the last year that sites which require Java and were working before, have suddenly been blocked with newer Java updates. This is due to a default security change that Oracle made in the Java web applet installer.

This is not a new issue, but was refreshed in my mind after reading an excellent post on Der Flounder  (you really should be following him), and in a recent meeting at my organization.

Summary:
Starting with Java 7 Update 51 …. the default security setting has changed from Medium to High. This causes errors when trying to run applications or websites that are unsigned, or use a self-signed certificate.

Workarounds:
1 – Changing the default security from High to Medium. (Most organization could do this, but I don’t think it’s best solution)
2 – Add the site to the “exceptions” list. ( This can be as one-offs with the intent that long-term plans should be to deploy machines with an “organization specific” exceptions list, either manually editing before deploying, repacking java, or scripting exceptions)

Manually Add A Site To The Exceptions List

To manually add a site to the exceptions list is pretty straight forward and the locations are listed below.

Windows 7 Location:
Start > Control Panel  > Java > Security Tab

MAC OS X:
Apple Icon > System Preferences > Java > Security Tab

You can test the exceptions list by visiting the site below. You should receive an error message if you have a version newer then 7 Update 51 and have not changed the default security level. Adding the site to the exceptions list and restarting the browser, should display the correct Java version in use.

http://javatester.org/version.html

Which on a side not … the last “Java Update” pop-up I got my Windows 7 system, automatically took me from Java 7 Update 67 to Java 8 Update 31. So this is coming and it’s best to figure out now how you are going to handle this default security change, if you haven’t already.

Scripting A Site To The Exceptions List

You can also manually add a site to the exceptions list, as it appears to be just a plain text file. This of course means we can script it. Locations for the “exception.site” file are below.

Windows 7:
C:\Users\%USERNAME%\AppData\LocalLow\Sun\Java\Deployment\security\exception.sites

Mac OS X:
/Users/$USER/Library/Application Support/Oracle/Java/Deployment/security/exception.sites

A basic command on Windows 7 might look like this:

echo http://javatester.org/version.html >> C:\Users\%USERNAME%\AppData\LocalLow\Sun\Java\Deployment\security\exception.sites

A basic command on OS X might look like this:

echo http://javatester.org/version.html >> "/Users/$USER/Library/Application Support/Oracle/Java/Deployment/security/exception.sites"

Getting Current Java Version

If you first need to know the current version of Java installed on the machines, here’s the basic commands to pull the version info. This could be useful for a script that checks the version and then uses it in some kind of comparison operator.

On Windows 7:

java -fullversion

On Mac OS X:

defaults read /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info CFBundleShortVersionString