SEB configuration

These appear when a student opens the .seb file in Safe Exam Browser, or when Config Key proof runs on the assessment page.

SEB cannot open a downloaded configuration

The device cannot decrypt the file, or the file is stale.

Check:

• It is a fresh download (grants are one-time and short-lived).
• The device's certificate profile is installed in the correct scope.
• The client's public-key hash matches the active service certificate — compare the device identity against the x-seb-public-key-hash header from ${TOOL_URL}/seb/config-encryption-certificate.pem.

If a device with no identity can open it, encryption is misconfigured — stop and review Certificate management.

A previously working device fails after rotation

The certificate was rotated but the new client profile had not arrived on the device before the service switched.

Fix: confirm the new client profile is installed, then download a fresh configuration. Rotation order matters — deploy the new profile to clients before switching the service certificate, with a planned overlap. See Certificate management → Rotation.

Config Key proof fails after a settings change

This is expected behavior, not a fault. The Config Key ties a running configuration to an exact set of settings; when a protected setting changes (tools, passwords, URL policy), the old configuration no longer proves.

Fix: have the student download a fresh .seb file. Communicate setting changes before an exam window so students are not caught mid-flow.

The service fails startup or download creation

The certificate configuration is invalid.

Check:

• SEB_CONFIG_ENCRYPTION_ENABLED is true (required when hardened).
• The configured certificate is a currently valid X.509 certificate.
• The secret value retained its PEM line breaks — a flattened PEM is a common cause when copying between secret stores.

A private key is exportable or usable by unrelated apps

A device-management misconfiguration — a serious one.

Fix: stop the rollout and correct the profile so the key is non-extractable and restricted to the approved SEB application. Do not weaken application restrictions to make a device work. See Device deployment.

Configuration opens but the exam behaves oddly on a client

The generated policy is strict and blocks application/VM/display switching, screen capture, developer console, printing, downloads, and non-SEB clipboard transfer, while leaving Canvas-required browser behavior available. Client releases that do not understand a newer configuration key cannot enforce it.

Fix: pin the approved SEB client version and integrity baseline in device policy, and validate the complete policy with a real supported client after any SEB or OS update. Behavior differences across client releases or operating systems are why acceptance testing on real devices is mandatory — see Verify the integration.