Installation

Download Binary

Download the latest binary for your platform from the HCL customer portal. The scanner is available for the following platforms:

• macOS - Intel (amd64) and Apple Silicon (arm64)
• Windows - 64-bit (amd64)
• Linux - 64-bit (x64)

Contact your HCL account representative for portal access credentials.

License Configuration

A valid license key is required to activate the full scanning capabilities of the BigFix Quantum Risk Analyzer scanner. The license serves as both an authentication mechanism and feature enabler, ensuring authorized deployment across enterprise environments while unlocking comprehensive cryptographic discovery, remote scanning, third-party integrations, and advanced reporting capabilities. Without a license, the utility operates in a restricted trial mode suitable only for basic evaluation.

Trial Mode vs Licensed Mode

The scanner operates in trial mode by default with limited functionality. A license key unlocks all features, enterprise capabilities, and removes trial restrictions.

Trial Mode (No License)

• Single port scan only (port 443)
• Local mode only (no remote scanning)
• No filesystem scanning
• No memory scanning
• No VPN/IPSec detection
• No quantum readiness scoring
• JSON output only

Licensed Mode

• Remote scanning - Network infrastructure
• Filesystem scanning - All certificate stores
• Memory scanning - Running processes
• VPN/IPSec detection - Tunnel configuration
• Quantum readiness - PQC assessment
• Outlook archives - PST/OST scanning
• All output formats - JSON, HTML, CBOM, SIEM
• Unlimited hosts - Based on license tier

How to Apply Your License Key

The scanner supports multiple methods for license activation, listed in priority order:

Command-line Flag (Highest Priority)

Pass the license key directly as a command-line argument. Best for testing or one-time scans.

Windows:

.\certscanner-windows-amd64.exe -license-key "xxxxxxxxxxxxxxxxxxxxx" -host example.com

Linux/macOS:

./certscanner-linux-amd64 -license-key "xxxxxxxxxxxxxxxxxxxxx" -host example.com

Environment Variable

Set the LICENSE_KEY environment variable. Recommended for automation and container deployments.

Windows (PowerShell):

# Option 1: Temporary (current session only) - Works immediately
$env:LICENSE_KEY = "xxxxxxxxxxxxxxxxxxxxx"

# Option 2: Permanent (current user) - REQUIRES RESTART OF POWERSHELL
[Environment]::SetEnvironmentVariable("LICENSE_KEY", "xxxxxxxxxxxxxxxxxxxxx", "User")
#   IMPORTANT: Close PowerShell completely and open a NEW window for this to take effect!

# Option 3: Permanent AND works immediately (RECOMMENDED)
$key = "xxxxxxxxxxxxxxxxxxxxx"
[Environment]::SetEnvironmentVariable("LICENSE_KEY", $key, "User")
$env:LICENSE_KEY = $key  # Also set for current session

# Verify it's set:
$env:LICENSE_KEY

Linux/macOS (Bash):

# Temporary (current session)
export LICENSE_KEY="xxxxxxxxxxxxxxxxxxxxx"

# Permanent (add to ~/.bashrc or ~/.zshrc)
echo 'export LICENSE_KEY="xxxxxxxxxxxxxxxxxxxxx"' >> ~/.bashrc
source ~/.bashrc

Docker/Kubernetes:

# Docker (Remote Mode Only)
docker pull tychoncorp/cryptographic-analyzer
docker run -e LICENSE_KEY="xxxxxxxxxxxxxxxxxxxxx" tychoncorp/cryptographic-analyzer

# Kubernetes Secret
kubectl create secret generic license --from-literal=license-key="xxxxxxxxxxxxxxxxxxxxx"

Docker Hub: see tychoncorp/cryptographic-analyzer

User Configuration File

Store the license in your home directory. Best for individual user workstations.

Location:

• Windows: C:\Users\YourName\.the scanner\license.key
• Linux/macOS: ~/.the scanner/license.key

Setup:

# Windows (PowerShell)
New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\.tychon"
Set-Content -Path "$env:USERPROFILE\.tychon\license.key" -Value "xxxxxxxxxxxxxxxxxxxxx"

# Linux/macOS
mkdir -p ~/.tychon
echo "xxxxxxxxxxxxxxxxxxxxx" > ~/.tychon/license.key
chmod 600 ~/.tychon/license.key

System Configuration File (Lowest Priority)

System-wide license for all users. Requires administrator/root privileges. Best for enterprise deployments.

Location:

• Windows: C:\ProgramData\the scanner\license.key
• Linux/macOS: /etc/the scanner/license.key

Setup:

# Linux/macOS (requires root)
sudo mkdir -p /etc/tychon
echo "xxxxxxxxxxxxxxxxxxxxx" | sudo tee /etc/tychon/license.key
sudo chmod 644 /etc/tychon/license.key

License Information

• Grace Period: Licenses include a 60-day grace period after expiration date
• License Format: Keys are 52 characters
• Validation: License keys are validated locally - no internet connection required

Troubleshooting Windows Environment Variables

If the LICENSE_KEY environment variable is not working on Windows, follow these steps:

1. VERIFY THE ENVIRONMENT VARIABLE IS SET

Open a new PowerShell window and check if the variable exists:

# Check if the variable is set
$env:LICENSE_KEY

# Should output your license key, e.g.: xxxxxxxxxxxxxxxxxxxxx
# If it outputs nothing, the variable is not set

Most Common Issue: If you used [Environment]::SetEnvironmentVariable(), you are likely still in the same PowerShell session where you set it. This method sets the registry value but does NOT update the current session. You MUST close all PowerShell windows and open a completely new one.

2. COMMON ISSUES AND SOLUTIONS

• Issue: Variable only works in the current PowerShell session. Solution: Set permanently for current user ([Environment]::SetEnvironmentVariable("LICENSE_KEY", "xxxxxxxxxxxxxxxxxxxxx", "User")), then close and reopen PowerShell to apply changes.
• Issue: Running executable from Command Prompt (cmd.exe) instead of PowerShell. Solution: Set system-wide (requires Administrator privileges). Open PowerShell as Administrator, then run [Environment]::SetEnvironmentVariable("LICENSE_KEY", "xxxxxxxxxxxxxxxxxxxxx", "Machine"). Or set in cmd.exe for current session: set LICENSE_KEY=xxxxxxxxxxxxxxxxxxxxx.
• Issue: Variable not available after setting it permanently. Solution: You MUST close and reopen your terminal/PowerShell window. Environment variables are loaded when the shell starts; simply setting it in one window won't affect other windows already open.
• Issue: Running from a different shell than where you set it. Solution: Use the -license-key flag instead: .\certscanner-windows-amd64.exe -license-key "xxxxxxxxxxxxxxxxxxxxx" -host example.com.

Best Practice for Windows: If environment variables continue to cause issues, use the file-based method instead (User Configuration File). This is more reliable across different shells and terminal sessions.