MCert User Guide

This guide covers every page in MCert: how to scan your servers, workstations and network devices, and reach every layer of cryptography they use, from the network down to the filesystem layer.

Key concepts

Four ideas come up on nearly every page in MCert. Learn these first and the rest of the product reads itself.

PQC status

Every cryptographic finding lands in one of four buckets, shown as a coloured pill wherever it appears:

Migration priority

Every finding also gets a priority score from 0 to 100, so you know what to fix first: Critical is 90 and above, High is 70 to 89, Medium is 40 to 69, and Low is under 40.

Scan lenses

Every scan job looks at a host from two angles and merges what it finds, removing duplicates:

• Network (outside-in): a port scan that probes exposed services for TLS certificates, cipher suites and protocol versions. No credential needed.
• Deep scan (inside-out): a full crypto-asset scan run from inside the host, either by an installed agent, or over SSH, or by the network-device scanner for tagged devices.

Scan profiles

First-time setup

Open the Manage Server in a browser on a fresh install and a three-step wizard launches. You cannot reach any other page until it finishes.

Step 1: create the first administrator

Press Create admin to continue.

Step 2: activate the license

A Machine ID Hash appears at the top. Send this to your vendor if you need an offline, air-gapped license bound to this specific machine. Otherwise, choose how to activate:

• Online (default): fill in the Server name, the License Server URL (for example https://activation.mcert.tech) and the License key, then press Activate.
• Upload a .lic file: for air-gapped deployments, upload the offline license file your vendor gave you.

Step 3: activation complete

The server confirms its Server name, assigns a Server ID, and restarts to switch on HTTPS with a self-signed certificate. Click Go to HTTPS now and accept the browser's certificate warning once.

Signing in and the layout

Sign in

Enter your email and password and press Sign in. Sessions last 24 hours by default. Five failed attempts in a row temporarily locks the account (see Administration).

The persistent layout

The left sidebar carries the MCert logo, a system-health pill (Ready or Checking, with a refresh button) and the grouped navigation: Dashboard, Inventory, Planning, Operations, Reports, Admin. Its footer shows the signed-in user, the version, and who built it.

The top bar shows a breadcrumb, and on the right:

Dashboard

Sidebar ▸ Dashboard. The page you land on after signing in, summarising your whole fleet.

• Readiness is the headline percentage of your inventory that is already SAFE.
• Stat cards break that down into SAFE, TRANSITIONAL, DEPRECATED and UNSAFE counts, plus a MACHINES card with a green/warn/critical split.
• PQC readiness trend charts readiness over time.
• Export manage server data gives one-click downloads of everything: CycloneDX, SARIF, and the NACSA Arahan 9 Excel workbook.
• Top priority blockers lists your highest-scoring problems; View all opens the Priority report.

Inventory: Tags

Sidebar ▸ Inventory ▸ Tags. Tags are coloured labels you attach to hosts so you can filter and scan them as a group.

Each row shows a tag's colour dot, name and host count, with Edit and Delete actions. The pre-seeded set covers linux, windows, server, workstation, production, staging, development, critical, database, web, net-device, pqc-scope, and a handful of network-vendor tags such as cisco-asa and fortinet.

New tag opens an editor: a name (stored lower-case) and a colour from 12 preset swatches. Press Create, or Save when editing.

Inventory: Hosts

Sidebar ▸ Inventory ▸ Hosts. The targets available to scan jobs and agent binding, split across two tabs: SSHs (hosts scanned over SSH or the network scanner) and Agents (hosts running an installed agent).

There are four ways to add a host:

This machine

Registers the Manage Server's own host as a scan target in one click.

New host

Discovery (network scan)

Enter a CIDR range (for example 192.168.1.0/24), SSH ports to probe (default 22,2200,2222), and optionally run with sudo for an ARP/ICMP sweep that also finds hosts hidden behind firewall rules. Press Start Scan. Results list only hosts not already in inventory: tick the ones you want, adjust each hostname if needed, then Import Selected.

Bulk import

The CSV tab accepts columns hostname (required), ip (required), os, ssh_port (default 22) and tags (comma-separated, quoted when there is more than one). A Download CSV template link and a live preview validate every row as you go.

The JSON tab takes an array of host objects. Each needs hostname and ip, with optional os, ssh_port, and either tags (names) or tag_ids (UUIDs).

Agents: remote scan workers

Agents heartbeat every 5 minutes, and Last seen reflects the most recent one. They work best where SSH is not allowed, or where you want continuous, scheduled self-scanning.

After Enrol and download, an installation guide gives a copy-paste one-line installer per platform. On Linux, for example:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/agent/get.sh \
  | sudo bash -s -- --bundle ./<bundle>.tar.gz

The installer sets up the triton-agent daemon and the triton scanner, registers a service (systemd, launchd, or Windows Service), and authenticates with mutual TLS. On Linux, confirm it with systemctl status triton-agent. The agent then appears in the Agents table and starts on every reboot.

Inventory: Credentials

Sidebar ▸ Inventory ▸ Credentials. SSH keys and passwords, encrypted at rest with AES-256-GCM in a server-side vault.

Press Save to Vault. Editing a credential lets you rotate the username and private key, via Update Vault Secret.

Inventory: Applications

Sidebar ▸ Inventory ▸ Applications. Applications attribute crypto findings to a named business system, for the NACSA Arahan 9 attribution report.

Press Create. The Components button on each row opens a modal where you map the application's individual software components, which feeds the SBOM and attribution views.

Planning: Phases

Planning is where a scan's findings become a costed, dated migration programme. Phases records when each NACSA stage happens; Budget (next) records what it costs. Both flow straight into the NACSA Arahan 9 export, so an assessor sees your timeline and your ringgit figures alongside your findings.

Sidebar ▸ Planning ▸ Phases. The five standard NACSA migration phases (Fasa), each with its own colour and an Edit action for dates and activities.

Each phase's edit form has a Start Date, End Date, Main Activity (one line per activity), Notes, and a Fill with template button that drops in NACSA's standard activity list for that phase. Progress against these phases shows up on the NACSA report's Migration tab.

Planning: Budget

Sidebar ▸ Planning ▸ Budget. The resource budget behind the NACSA Arahan 9 export.

The table is a costed resource list: item number, item, details, estimated cost and allocation, with Edit and Delete per row. It ships pre-seeded with Training & Awareness, Technology Acquisition, Testing & Evaluation, Consulting & Audit Services, Operations & Maintenance, and Other.

Operations: Scan Jobs

Sidebar ▸ Operations ▸ Scan Jobs. The scan queue across agents and tags, polling every 5 seconds. This is the operation itself: each scan job runs the Network and/or Deep lens against the hosts and credentials you set up in Inventory, and its results populate every report below.

Two tabs. Jobs is the live queue, with a scans-used license meter, a status filter, and columns for type, profile, host, status, enqueued time, time taken and progress, with a Cancel action on running or queued jobs. Type is either Port Survey (the network lens) or SSH / agent (the deep lens). Status moves from queued to running to completed, failed or cancelled, and progress shows live stage text such as "4/6, Uploading scanner".

Creating a scan: the New Scan wizard

New Scan opens a six-step wizard. The left rail tracks your progress through it.

Step 1: Scan host. Explains the Network (outside-in) and Deep (inside-out) lenses that always run and merge. Press Next.

Step 2: Scan Profile. Choose Quick, Standard or Comprehensive. Standard is the default.

Step 3: Hosts. Tick the host or hosts to scan. A legend shows each host's readiness: blue means an enrolled agent, green means an SSH credential is on file, amber means no credential (the filesystem pass gets skipped). A search box filters by hostname or IP.

Step 4: Schedule. Run immediately (the default), Hourly, Daily at a set time, Weekly on a chosen day, or Monthly on a chosen day. Anything other than immediately creates an entry on the Schedules tab.

Step 5: Resource Limits. Optional caps enforced in-process on the target, no root needed: a CPU limit that throttles, a memory limit that a watchdog kills at 1.5 times the cap, and a max duration that cancels the scan when the wall clock runs out. Leave these Unlimited unless you are scanning a sensitive production box.

Step 6: Summary. Review your choices. The wizard creates one Port Survey job plus one deep job per host. Press Enqueue N jobs.

Scan job detail

Click any job row to open its detail page: status, the exact command that ran, host, profile, worker, timestamps, and a live activity log walking through the six SSH stages, connecting, detecting platform, fetching the scanner binary, uploading it, scanning remotely, and submitting results. Failed jobs show the full error here (see Troubleshooting).

The report pages let you drill from a summary down to the individual finding, and most can be exported. Everything from here on is built from completed scan jobs: this is where raw findings become the CBOM, SBOM, priority list and NACSA Arahan 9 workbook you actually hand to auditors, management or NACSA.

Reports: Scans

Sidebar ▸ Reports ▸ Scans. Every scan across your fleet, as a history table: date, host, findings, and a breakdown by status.

Click a row for the scan detail: host, profile, scan source, download buttons for CycloneDX, SARIF and NACSA Excel, headline stat cards, and two filter rows, one by module (binaries, python_ast, scripts, webapp, certificates, packages, configs, keys, libraries and more) and one by PQC status. The findings table lists PQC status, module, subject, algorithm, key size, location and priority: for example, UNSAFE, binaries, MD5, /usr/bin/curl, priority 100.

Reports: Hosts

Sidebar ▸ Reports ▸ Hosts. Every machine ranked by readiness, worst first.

Reports: Inventory

Sidebar ▸ Reports ▸ Inventory. Every crypto asset across your fleet, grouped by algorithm and key size.

The table lists algorithm, key size, PQC status, instance count, machine count and max priority, for example MD5, UNSAFE, 166 instances, 1 machine, priority 100. Click any algorithm to see every occurrence:

Reports: Certificates

Sidebar ▸ Reports ▸ Certificates. Expiring certificates: cards for Expired, Within 30 days, Within 90 days and Shown, with range chips for 30, 90, 180 days or All.

Reports: Priority

Sidebar ▸ Reports ▸ Priority. Assets grouped by host and module, so you can attack the biggest problem areas first. Cards show Critical (90 and above), High (70 to 89), Medium (40 to 69), and total findings.

Click a row to list the individual files or assets behind it:

Reports: NACSA Arahan 9

Sidebar ▸ Reports ▸ NACSA Arahan 9. The flagship compliance report. The ↓ NACSA Arahan 9 Excel button exports the full government workbook. An "All Servers" selector focuses the per-host views. Seven tabs:

The remaining two tabs are Migration, progress against the five phases from Planning, and Attribution, which maps findings to the Applications you registered and their owners.

Reports: PQC Config

Sidebar ▸ Reports ▸ PQC Config. Override how algorithms are classified, per group. Changes affect the NACSA summary readiness percentage, SBOM, CBOM and risk register for the active group. Scan data itself is never modified: overrides apply at query time only.

Administration: Users and Security

Users

Sidebar ▸ Admin ▸ Users. Manage portal operators. Temporary passwords are shown once, at creation.

New user takes an email, name and role. On creation, a temporary password is shown once: copy it for the user, since they must change it at first login.

Security

Sidebar ▸ Admin ▸ Security. Active login lockouts. Unlocking an account restores access immediately.

Administration: Audit Log and License

Audit Log

Sidebar ▸ Admin ▸ Audit Log. A tamper-evident record of every significant action.

License

Sidebar ▸ Admin ▸ License. Activation status for this Manage Server instance.

• Tier (for example enterprise) and whether the Manage feature is enabled.
• Limits: seats, hosts, agents and total scans, each with a cap, used count and utilisation percentage.
• Heartbeat: last pushed time, license server, instance ID, machine ID hash.
• Buttons: Refresh (re-validate now), Replace Key (enter a new key), Deactivate (release this activation).

Administration: Binaries and Settings

Binaries

Sidebar ▸ Admin ▸ Binaries. The Manage Server distributes small worker binaries to agents and SSH targets.

• Binary Directory is /bins, with filenames in the form {name}-{platform}-{arch} (for example triton-sshagent-linux-amd64). Copy path copies it.
• Available Binaries lists triton-netdevice, triton-portscan, triton-sshagent and the triton scanner itself, each with a platform, architecture and copyable install URL.

Upload Binary lets you manually supply a binary (binary, platform, architecture, then choose a file and upload) for air-gapped sites.

Settings

Sidebar ▸ Admin ▸ Settings. Read-only runtime information.

Workflow: scan your first server

1. Inventory ▸ Credentials ▸ Add Credential: type SSH Key, paste the key, set the username, and add a sudo password if you want full-depth scans. Save to Vault.
2. Inventory ▸ Hosts ▸ New host: enter hostname and IP, pick the credential, click Test connection and wait for it to confirm, then Create.
3. Operations ▸ Scan Jobs ▸ New Scan: Next, choose Standard, tick your host, leave it on Run immediately, leave limits unlimited, then Enqueue 2 jobs.
4. Watch the jobs move from queued to running to completed. A deep SSH scan on a small host typically takes about a minute.
5. Reports ▸ Scans: click the scan to read what it found.

Workflow: produce the NACSA Arahan 9 workbook

1. Fill in Inventory ▸ Applications with your business systems and their owners.
2. Set dates in Planning ▸ Phases (use Fill with template) and figures in Planning ▸ Budget.
3. Scan every in-scope host (the workflow above), and tag them pqc-scope.
4. Reports ▸ NACSA Arahan 9: review Summary, Inventory, SBOM, CBOM, Risk, Migration and Attribution.
5. Click ↓ NACSA Arahan 9 Excel.

Workflow: onboard a host where SSH is blocked

1. Inventory ▸ Hosts ▸ Agents ▸ Enrol agent: confirm the gateway address is reachable from the target, then Enrol and download. Save the .tar.gz bundle.
2. Copy the bundle to the target and run the one-line installer from the guide modal. It needs sudo or Administrator rights.
3. The agent appears on the Agents tab. Scan it exactly like any other host.

Reference: status, action and job types

Reference: Risk Matrix

Sidebar ▸ Reference ▸ Risk Matrix. Configures the 5x5 Impact by Likelihood grid used to score every algorithm's risk in NACSA Arahan 9 reports. A finding's score is Impact times Likelihood, from 1 to 25, and the band that score lands in sets its colour and label everywhere in MCert.

Likelihood scale, 1 to 5, how probable the risk is:

Impact scale, 1 to 5, how severe the consequence is:

Reference: Risk Register

Sidebar ▸ Reference ▸ Risk Register. Configures the Risk Categories and Root Causes used when NACSA Arahan 9 risk assessments are generated. Categories group findings by the part of the system at fault. Root Causes explain why the risk exists and, uniquely, carry ready-made mitigation steps.

Two examples of a Root Cause with its mitigation steps:

Reference: Scoring Config

Sidebar ▸ Reference ▸ Scoring Config. Sets the Impact and Likelihood values MCert auto-fills for every PQC Status by Risk Category combination, so a risk score never has to be entered by hand. Score is Impact times Likelihood, using the scale above, and it feeds the 4_RiskAssessment sheet of the exported Arahan 9 workbook (columns Impak and Kemungkinan).

Reference: Crypto Map

Sidebar ▸ Reference ▸ Crypto Map. A read-only registry of every algorithm and protocol MCert recognises, pulled from the scanning engine itself. You cannot edit it here. It exists so you can look up what a Category, Primitive or Function label in a scan result actually means, in effect, the full list of what MCert supports.

Protocols map to the algorithm suite they typically negotiate, so a finding of "TLS 1.0" traces straight back to the weak algorithms that made it UNSAFE:

Troubleshooting

This guide is produced from a live MCert installation and a real Standard-profile scan of a Linux host. Questions this guide does not answer are usually fastest solved by a demo request, so we can walk your specific environment together.