IPMI/iDRAC Console with Java: Exception List Guide | SistemDC

On older-generation physical servers the remote screen is still delivered through Java Web Start technology. Chrome and Edge have not run the Java plugin for years; the Java 8 security policy also stops unsigned or self-signed BMC applications by default. The result is a classic: Application blocked by Java security. This guide explains step by step how to connect to the IPMI / iDRAC / iLO / BMC console with Java on a dedicated (physical) server, and why adding the server IP and the IPMI IP to Java's trusted list (the Exception Site List) removes this block.

What Are IPMI, iDRAC, iLO and BMC?

If the operating system crashes on a dedicated server, SSH and RDP go with it. The BMC (Baseboard Management Controller) is a separate small controller on the motherboard; it stays up on its own IP even when the server is off. Manufacturers give it different names:

• IPMI: The industry standard (Intelligent Platform Management Interface). SuperMicro and many AMI boards use this name.
• iDRAC: Dell's BMC (Integrated Dell Remote Access Controller).
• iLO: HPE's BMC (Integrated Lights-Out).

All three do the same job: power on/off, sensors, virtual media (ISO) and KVM over IP (remote keyboard-video-mouse). A VDS does not have this layer; the hypervisor provides VNC. On a dedicated server the card is yours. For plans and stock, see the dedicated server hub.

The management port is an RJ45 separate from the production LAN (it can also be shared LAN). The green lights at the back are usually operating system traffic; the BMC's own port lights up separately. This separation explains why the IP-adding step in the next section asks for two addresses.

Why Is There Still a Java Console?

BMC firmware from the 2010s delivers the console as a Java applet or a .jnlp (Java Web Start) file. Because browsers removed the NPAPI plugin, the applet does not open directly in the page; you download the file and run it with OpenWebStart or Oracle Java 8.

Since Java 7u51, unsigned or self-signed applications are blocked by default. BMC manufacturers rarely ship a JAR signed by a public CA; so the Exception Site List is not a security hole but an allow list specific to the BMC. Lowering the global security level to “Medium” opens up all sites; do not do that.

Java Console from the SistemDC Panel

With a dedicated server service, the BMC management IP is not opened directly to the customer network. The console comes through the bridge in the client area. Steps:

1. sistemdc.com/en/myaccount — open the relevant dedicated service from here.
2. Remote Access card: find the KVM via Java Application row. This row appears on hardware without HTML5 or with Java as a backup.
3. On your computer, have OpenWebStart (recommended) or a 64-bit Java 8 JRE installed.
4. Download Java Console File gives you the .jnlp file — save it and open it.
5. If a Java security warning appears, follow the Exception List steps below and open the file again.

Short knowledge base summary: How do I connect with IPMI / KVM? If it does not open, also see the IPMI / KVM will not open checklist.

Adding the Server and IPMI IP to Java's Trusted List

Java's “trusted network” is not the Home/Work network in Windows. Its name is the Exception Site List — unsigned or self-signed code runs only from the origins you enter. When you add the server IP and the IPMI IP here, Java treats those two addresses as trusted origins; random sites on the public internet are not affected.

Which addresses should be added?

From the service details, copy the server (OS) IP and IPMI / iDRAC / iLO IP values. Then enter the following in the list, without a trailing slash and including the protocol:

The IPs are examples; use the ones in your own service details. If the warning window shows the host as https://x.x.x.x:443 then add exactly the same spelling to the list. Java's origin matching is strict: http and https, and with-port and without-port, are separate entries.

Windows: Java Control Panel

1. In the Start menu, type Configure Java or Java Control Panel and press Enter. If it does not open, try the path %ProgramFiles%\Java\jre1.8.0_xxx\bin\javacpl.exe instead.
2. Security is the tab to open. Leave the security level at High (do not lower it).
3. Exception Site List — under it, click the list edit button / Edit Site List to open the list.
4. Add lets you enter each origin above on a separate line. If the confirmation box shows an “HTTP is not secure” warning, continue only if the BMC really uses HTTP.
5. OK > Apply. Close all browser windows and javaws processes, then reopen the .jnlp file.

OpenWebStart (recommended)

The Oracle Java 8 browser plugin is dead; for JNLP, OpenWebStart is current and maintained. After installation, add the same URLs under OpenWebStart settings > Security / Exception list. Verify that the .jnlp file association belongs to OpenWebStart (Windows: Default apps).

Internet Options: Trusted sites

Some iDRAC 6/7 versions still lean on the Internet Explorer engine. If the Java list is not enough:

1. Control Panel > Internet Options > Security > Trusted sites > Sites.
2. Temporarily clear the “Require server verification (https:) for all sites in this zone” box if the BMC is self-signed.
3. Add the same https://IPMI_IP and https://SERVER_IP addresses.

This makes Windows place those IPs in the trusted zone instead of the restricted “Internet” zone. It does not replace the Java Exception List; it complements it.

Keeping IPMI on a Separate IP: Why Is Java Unaffected?

There are three common reasons Java breaks: (1) signature/certificate, (2) wrong origin, (3) HTTPS inspection on the path. IP separation solves all three.

• A separate management IP: The BMC is on its own address and OS traffic is on another. Once you enter two origins in the Exception List, Java can take the JAR from one and the console session from the other; no mixed codebase error occurs.
• The shared LAN trap: On some cards IPMI shares the server's public IP. Java then sees a single host but the certificate CN is the BMC hostname. Add both the IP and (if any) the BMC hostname to the list as https://ilo-servername (for example).
• Corporate proxies and antivirus: On a “Public” network profile, HTTPS scanning breaks the JNLP signature; Java takes the application for a fake. Do management access over a VPN or a Private network profile. The origins in the Exception List are independent of the browser; the JNLP needs to be excluded from scanning so that the proxy does not re-sign it.
• SistemDC dedicated servers: The BMC is not open to the customer's internet. The Java client talks to the panel bridge. That is why the right approach is to add konsol.sistemdc.com and the public server IP shown in the service — not the IPMI RFC1918 address — to the list. In colocation, on the other hand, the BMC IP is on your management VLAN; add that IP.

IPMI Security Settings

The Exception List does not mean opening the BMC to the internet. The opposite is true: keep the origin you allow Java as small as possible.

1. Change the default password. Factory accounts (e.g. the common defaults on many cards) should be changed at first login. On SistemDC dedicated servers the credentials are generated in the service details; in colocation they are your responsibility.
2. Do not expose IPMI to the public internet. 623/UDP (RMCP) and BMC HTTPS listening on 0.0.0.0 invite brute force and old IPMI 2.0 vulnerabilities, regardless of the Java problem in the browser. On dedicated servers this isolation is on the infrastructure side. In colocation, use a management VLAN + VPN.
3. Turn off HTTP, leave TLS. If you had to add HTTP to the Exception List, when you are done turn off HTTP on the BMC, leave only HTTPS and delete the HTTP entry from the list.
4. Turn off unused services. Old SNMP, IPMI 1.5, anonymous IPMI, unnecessary virtual media sharing.
5. Source IP restriction. In the BMC ACL or firewall, narrow console access down to your office/VPN exit IP. The Exception List is client-side; the server-side ACL is separate.
6. Firmware. HTML5 patches carry security fixes just as much as the iLO/iDRAC Java console does. Move to the manufacturer's recommended version in a maintenance window.

For the distinction between physical access and remote hands, see the Remote Hands guide for details. If the console is not enough, on-site intervention is a separate channel.

Common Java Errors

If it still does not open, add the service ID, the Java/OpenWebStart version and the full text of the warning to your support ticket. A BMC reset does not bring down the operating system; it only restarts the management controller.

Frequently Asked Questions

Isn't it easier to lower the Java security level?
Easier, and wrong. Lowering the level loosens all origins. The Exception List opens only your server and IPMI IPs; the rest of Java's policy stays high.

Why both the server IP and the IPMI IP?
The JNLP/JAR usually comes down from the host of the web interface (or the panel bridge); the live KVM session connects to the BMC's own IP (or the bridge). With a single address added, Java blocks the second origin.

Is it the same on macOS or Linux?
The same origin list applies. Add the URLs to the Exception list in the OpenWebStart settings. Oracle Java has no browser plugin on macOS; open the JNLP file with OpenWebStart.

Is Java needed if HTML5 is available?
No. On modern firmware HTML5 is the primary route. Keep Java only for older cards where HTML5 does not exist or the WebSocket is cut. Details: HTML5 KVM guide.

Should I share my IPMI password on the blog?
No. Do not send passwords even in a support ticket unless asked. The credentials field in the panel is enough.

Related SistemDC Guides

• HTML5 KVM console: IPMI access without Java
• What is an AMD Ryzen dedicated server?
• Remote Hands and SLA
• Knowledge base: IPMI / KVM connection