# SEB configuration

> Problems inside Safe Exam Browser and with the .seb file — configurations that will not open, failures after rotation, and Config Key proof failures.

[Canonical HTML page](https://safeonlineexam.com/docs/troubleshooting/seb-configuration)

These appear when a student opens the `.seb` file in Safe Exam Browser, or when
Config Key proof runs on the assessment page.

## SEB cannot open a downloaded configuration (certificate mode) [#seb-cannot-open-a-downloaded-configuration-certificate-mode]

When certificate encryption is enabled, the device cannot decrypt the file, or
the file is stale.

**Check:**

* It is a **fresh** download (grants are one-time and short-lived).
* The device's certificate **profile is installed in the correct scope**.
* The client's public-key hash matches the active service certificate — compare the
  device identity against the `x-seb-public-key-hash` header from
  `${TOOL_URL}/seb/config-encryption-certificate.pem`.

If a device with no identity can open a configuration that was issued in
certificate mode, encryption is misconfigured — stop and review
[Certificate management](/docs/deploy/certificates). In explicit plaintext
compatibility mode, no device identity or certificate endpoint is expected.

## A previously working device fails after rotation [#a-previously-working-device-fails-after-rotation]

The certificate was rotated but the new client profile had not arrived on the
device before the service switched.

**Fix:** confirm the new client profile is installed, then download a fresh
configuration. Rotation order matters — deploy the new profile to clients **before**
switching the service certificate, with a planned overlap. See
[Certificate management → Rotation](/docs/deploy/certificates#rotation).

## Config Key proof fails after a settings change [#config-key-proof-fails-after-a-settings-change]

This is expected behavior, not a fault. The Config Key ties a running configuration
to an exact set of settings; when a protected setting changes (tools, passwords,
URL policy), the old configuration no longer proves.

**Fix:** have the student download a **fresh** `.seb` file. Communicate setting
changes before an exam window so students are not caught mid-flow.

## The service fails startup or download creation [#the-service-fails-startup-or-download-creation]

The certificate configuration is invalid.

**Check:**

* If encryption is enabled, the configured certificate is a **currently valid**
  X.509 certificate.
* The secret value retained its **PEM line breaks** — a flattened PEM is a common
  cause when copying between secret stores.

If the instance intentionally uses plaintext compatibility mode
(`SEB_CONFIG_ENCRYPTION_ENABLED=false`), the certificate endpoints return `404`
and an assessment configuration is plaintext unless its instructor has set a
start password. Confirm that this lower-assurance mode is intentional before
treating certificate absence as a defect.

## A private key is exportable or usable by unrelated apps [#a-private-key-is-exportable-or-usable-by-unrelated-apps]

A device-management misconfiguration — a serious one.

**Fix:** stop the rollout and correct the profile so the key is non-extractable and
restricted to the approved SEB application. **Do not** weaken application
restrictions to make a device work. See
[Device deployment](/docs/operate/devices).

## Configuration opens but the exam behaves oddly on a client [#configuration-opens-but-the-exam-behaves-oddly-on-a-client]

The generated policy is strict and blocks application/VM/display switching, screen
capture, developer console, printing, downloads, and non-SEB clipboard transfer,
while leaving Canvas-required browser behavior available. Client releases that do
not understand a newer configuration key cannot enforce it.

**Fix:** pin the approved SEB client version and integrity baseline in device
policy, and **validate the complete policy with a real supported client** after any
SEB or OS update. Behavior differences across client releases or operating systems
are why acceptance testing on real devices is mandatory — see
[Verify the integration](/docs/operate).