Protected assessment workflows, built for Canvas.

Create, configure, validate, and rotate the SEB configuration-encryption identity — the certificate that decides which devices can open a configuration.

Every hardened deployment encrypts generated .seb files to a configured public X.509 certificate. The service holds only the public certificate; the matching private identity is installed only on approved exam devices. This is one of the two independent protections — encryption stops an unapproved device from opening a configuration at all, while Config Key proof stops an access code from being released against stale settings.

Do not disable either control

Never work around a rollout problem by disabling encryption or Config Key proof. The service refuses to start with encryption disabled in a hardened runtime.

Trust model

Component	Holds	Must not hold
Application runtime	Public certificate (or permitted local public-key fallback)	Private key, `.p12`, passphrase
Secret manager	Public certificate PEM	Private key or `.p12`
Device-management system / vault	Private identity + its protection material	Broad user or runtime access
Approved SEB client	Non-extractable, SEB-scoped private identity	An exportable identity available to a student account or unrelated app

Generate an identity

The repository generator writes private artifacts under the git-ignored .local/ directory. Put the passphrase in a protected file — never in a command argument or environment variable.

umask 077
mkdir -p .local
openssl rand -base64 48 > .local/seb-cert-p12-password

SEB_CERT_NAME=seb-config-encryption \
SEB_CERT_SUBJECT="/CN=Safe Online Exam Configuration Encryption/O=Organization" \
bash scripts/generate-seb-config-cert.sh \
  .local/seb-certs \
  .local/seb-cert-p12-password

It produces:

seb-config-encryption.crt.pem

seb-config-encryption.cer

seb-config-encryption.key.pem

seb-config-encryption.p12

Move the private artifacts immediately

Move the private PEM, .p12, and passphrase into approved restricted storage, then remove workstation copies once the vault upload and client deployment are verified. Never commit, log, email, attach, or pass these through command arguments, tickets, or chat.

Configure the service

Store the public certificate in Secret Manager and inject it as SEB_CONFIG_ENCRYPTION_CERT_PEM (the dev_seb_config_encryption_cert_pem / prod_seb_config_encryption_cert_pem secret in the Google Cloud guide).

Provide the public certificate as a protected runtime file at the path referenced by SEB_CONFIG_ENCRYPTION_CERT_PATH — for the checked-in Compose secret mount, secrets/seb-config-encryption.crt.pem.

The service validates the certificate at startup and at every download. In a hardened runtime, SEB_CONFIG_ENCRYPTION_ENABLED must be true, a valid public X.509 certificate is required, and a public-key-only fallback is not sufficient.

The configured certificate is served for verification at:

${TOOL_URL}/seb/config-encryption-certificate.pem
${TOOL_URL}/seb/config-encryption-certificate.cer

These never serve private material. Their x-seb-public-key-hash response header is what you compare against the client identity during rollout checks.

Client deployment (summary)

Use your device-management platform's certificate/profile mechanism — not a user-facing script. The profile should install the PKCS#12 identity into the intended scope, mark the private key non-extractable where supported, restrict it to the approved SEB application, prevent removal by an ordinary student account, and be scoped to a test group first.

scripts/install-seb-config-cert-login-keychain.sh is intentionally non-operational for identities — it does not import secrets. Do not build a distribution workflow around command-line PKCS#12 import. Full device steps are in Device deployment.

Pre-assessment validation

Before a rollout window:

Confirm the active revision has encryption enabled and the expected certificate secret version or mounted file.

Request the public certificate endpoint and record its x-seb-public-key-hash.

Confirm the client profile reports installed on every intended test device.

On an approved test device, run the setup check and open the encrypted setup configuration.

Confirm Config Key proof succeeds after SEB starts.

Confirm a device without the identity cannot open the encrypted configuration.

Confirm an unrelated app and an ordinary student account cannot export or use the private key.

Confirm the certificate remains valid for the assessment and recovery window.

Rotation

Perform routine rotation outside active assessments:

Generate and secure a replacement identity.

Create the matching non-extractable, SEB-restricted client profile.

Deploy it to a test group and pass the setup check.

Deploy it to all intended clients, with a planned overlap period if needed.

Add the replacement public certificate to the service secret and deploy a new revision.

Verify the active public-key hash and download fresh configurations.

Remove the old profile and revoke/delete the old private material after the overlap window.

Any relevant SEB settings change invalidates old configurations — tell students to download a fresh .seb file after rotation. If the private identity is suspected compromised, pause the affected workflow, rotate, deploy the replacement public certificate, invalidate affected settings through the normal flow, and require fresh configurations. Never introduce a plaintext fallback.

Troubleshooting

Symptom	Check
SEB cannot open a downloaded configuration	Confirm a fresh download, the profile is installed in the correct scope, and the public-key hash matches the active service certificate.
A working device fails after rotation	Confirm the new profile arrived before the service switched certificates, then download a fresh configuration.
Service fails startup or download creation	Confirm encryption is enabled, the certificate is a currently valid X.509, and the secret value retained its PEM line breaks.
A private key is exportable or usable by unrelated apps	Stop the rollout and correct the device-management profile. Do not weaken application restrictions.

More symptoms are in Troubleshooting → SEB configuration.

Certificate management