I've created a Java Deployment Ruleset that looks like this:

<ruleset version="1.0+">
    <rule>
        <id location="http://hpfweb.mydomain.com/" />
        <action permission="run" version="1.6.0_20" />
    </rule>
    <rule>
        <id location="http://*.mydomain.com" />
        <action permission="run" />
    </rule>
    <rule>
</ruleset>

I've created a self-signed cert, added it into the keystore as well as Trusted Certification Authorities. I have an app at http://hpfweb.mydomain.com that requires Java v1.6.20 and will error out if any other version is attempted. When only this version is installed on the computer the application works. However, if a newer version is installed, it does not. As you can see, I've attempted to force the version to 1.6.0_20 in the ruleset.

I've confirmed the deployment rule set is being applied successfully by going into the Java Control Panel --> Security and "view the active deployment rule set". It is exactly as you see here. I've also looked at the web source for the application and all references point to http://hpfweb* links.

When the applet is launched I've brought up task manager and have confirmed the java.exe launched is coming from the jre6 directory.

When the newer version is installed, I'm getting the error "accesscontrolexception - access denied (java.awt.AWTPermission.accessEventQueue".