Device deployment
Install the SEB configuration-encryption identity onto exam devices through your device-management platform, non-extractably and scoped to SEB.
The service holds only the public certificate. For a device to open an encrypted
.seb configuration, it must hold the matching private identity, installed
through your device-management platform. This page is the device side of
Certificate management.
Never hand a student the private identity
Do not distribute the .p12 or its passphrase to users, and do not build a
workflow around command-line PKCS#12 import. The private identity is deployed by
your MDM into a protected scope — nowhere else.
What the profile must do
Use your platform's certificate/profile mechanism to install the identity so that it:
Use the code-signing requirement and bundle/application identity documented for your supported SEB build. A mutable filesystem path alone is not sufficient application restriction.
Unmanaged or student-administered devices
An unmanaged device cannot provide the same non-extractability assurance. If a
lower-assurance activity permits such a device, use a separately scoped,
short-lived identity and document the exception — never reuse the high-integrity
assessment identity, and never hand a student the .p12 or passphrase.
Validate before a rollout window
${TOOL_URL}/seb/config-encryption-certificate.pem and record its x-seb-public-key-hash.The setup check is not device management
The setup check confirms the application's SEB integration. It does not replace device-management policy, operating-system requirements, or a real assessment test. Treat it as one signal among the checks above.
Platform notes from the generated policy
The generated configuration is strict by design. A couple of platform facts affect your device baseline:
- macOS requires Automatic Assessment Configuration (AAC), installation from the system Applications location, and a macOS 12.1 floor. AAC may block some third-party assistive technology — plan such accommodations as a separately approved arrangement. See the AAC glossary entry.
- Windows requires the OS-session and SEB-service controls and a supported SEB version floor. Client releases that do not understand a newer configuration key cannot enforce it, so pin the approved SEB client version and integrity baseline in device policy.
Always validate the complete policy with a real supported client after SEB or OS updates. Rotation of the identity itself is covered in Certificate management → Rotation.
Verify the integration
The full acceptance sequence — administrator, instructor, student-in-browser, and student-in-SEB — to run before any real exam.
Administrator dashboard
What the root-account Safe Exam Browser Admin dashboard does — recovery, active-course connection, and reusable tool presets with bulk rollout.