1

Create a collector token

In the left-hand menu go to Settings → Collectors and click Add collector. Give it a descriptive name (e.g. Office network or DMZ scanner) and click Save. Copy the generated token — it starts with cwc_. You will need this in step 4.

Save the token now — it is only shown once. If you lose it, delete the collector and create a new one.
2

Download the agent JAR

Download the agent from Settings → Collectors → Download agent. The file is a self-contained JAR — no installation needed, just Java 17 or newer on the host.

To check your Java version on the target server:

java -version
3

Copy the JAR to your server

Transfer the JAR to the server you want to scan from — this should be a machine that has network access to the internal hosts you want to monitor.

# Example using scp scp certops-agent.jar user@internal-server:/opt/certcontrol/
4

Run the agent

Start the agent with your collector token and the URL of your CertControl instance:

java -jar certops-agent.jar \
  --certops.collector-token=cwc_YOUR_TOKEN \
  --certops.platform-url=https://app.certcontrol.pro

The agent will start scanning reachable hosts and push results back to the platform. The first scan typically completes within a few minutes depending on network size.

5

Run as a service (recommended)

For production use, run the agent as a systemd service so it restarts automatically and runs on a schedule:

# /etc/systemd/system/certcontrol-agent.service [Unit] Description=CertControl Agent After=network.target [Service] ExecStart=java -jar /opt/certcontrol/certops-agent.jar \ --certops.collector-token=cwc_YOUR_TOKEN \ --certops.platform-url=https://app.certcontrol.pro Restart=on-failure RestartSec=30 [Install] WantedBy=multi-user.target
# Enable and start systemctl enable certcontrol-agent systemctl start certcontrol-agent
Firewall note: The agent makes outbound HTTPS connections only — no inbound ports need to be opened. Only port 443 outbound to your CertControl instance is required.
6

Verify in the platform

Go to Settings → Collectors and check that your collector shows a green status and a recent "last seen" timestamp. Discovered endpoints will begin appearing under Endpoints with a collector source tag.