Dashboard Overview

# PQCrypta Enterprise Discovery Agent Configuration
# This file controls the behavior of the crypto asset discovery agent

# API endpoint configuration
api_url = "https://api.pqcrypta.com"
api_key = "your-api-key-here"

# Filesystem paths to scan for certificates, keys, and SSH keys
# (SSH host/user keys are picked up automatically from .ssh directories,
# even without a matching file extension)
scan_paths = [
    "/etc/ssl/certs",
    "/etc/pki",
    "/usr/local/share/ca-certificates",
    "/root/.ssh",
    "/opt/",
]

# Enable deep scanning (slower but more thorough)
deep_scan = false

# Paths to exclude from scanning
excluded_paths = [
    "/proc",
    "/sys",
    "/dev",
    "/tmp",
]

# Source-code trees to scan for weak-crypto API calls (CBOM: MD5, SHA-1, DES,
# RC4, ECB mode, undersized RSA key generation). Off by default.
code_scan_paths = []

# Database connections to scan (optional — uncomment to enable). Reads actual
# column values for columns matching %cert%/%key%/%pem% and attempts to parse
# them; never stores the raw value, only structural metadata.
# [[database_connections]]
# name = "Production PostgreSQL"
# db_type = "postgres"
# dsn = "postgres://user:password@localhost/dbname"

database_connections = []

# Network services to inspect for live TLS certificates — reflects what's
# actually being served right now, not just files sitting in a cert store.
[[network_targets]]
host = "example.com"
port = 443

# Network appliances (F5 BIG-IP / Citrix NetScaler) — scanned agentlessly over
# their management API from any host that can reach it. A READ-ONLY account is
# enough (F5 Auditor role / NetScaler read-only command policy). Beyond the cert
# store this also records device facts and which virtual server serves each cert
# (or flags it an unbound spare). Uncomment and fill in to enable.
# [[appliance_targets]]
# name = "F5 BIG-IP Production"
# appliance_type = "f5"                 # "f5" or "netscaler"
# mgmt_url = "https://f5-mgmt.example.com"
# username = "readonly-user"
# password = "your-password-here"
# verify_tls = true                     # false only for a self-signed mgmt cert

# ── Run modes (pick one; not config keys — command-line flags) ────────────────
#   Submit to dashboard : ./pqcrypta-discovery --config agent-config.toml
#   Raw JSON file       : ./pqcrypta-discovery --config agent-config.toml --output results.json
#   Offline / air-gap   : ./pqcrypta-discovery --config agent-config.toml --offline-report ./assessment
#                         (report.html + cbom.json + inventory.json, ZERO network — no api_url/api_key needed)

Quick Start Guide

1. Download the agent for your platform above
2. Make executable (Linux/macOS): chmod +x pqcrypta-discovery
3. Run with your API key:

   ./pqcrypta-discovery \
     --api-url https://api.pqcrypta.com \
     --api-key YOUR_API_KEY

Common Options

• --deep-scan - Thorough scanning (slower)
• --allow-paths /path1,/path2 - Specific paths only
• --output results.json - Save locally instead of API
• --verbose - Detailed logging
• --config agent-config.toml - Use config file

What It Scans

• X.509 Certificates (PEM, DER, CRT, CER)
• Private Keys (RSA, ECC, Ed25519)
• SSH Keys (host + user, private and public, OpenSSH format)
• Java KeyStores (JKS, JCEKS, PKCS12, BKS/UBER), including Android and Windows PFX specializations
• TLS/SSL configurations
• Certificate bundles and chains
• Live network/TLS endpoints (what's actually being served)
• Database columns storing certificates or keys
• Source code calling deprecated crypto (MD5, SHA-1, DES, RC4, ECB, undersized RSA)