Skip to content
CERNIS PRO Logo CERNIS PRO
DE

Downloads

CERNIS PRO is a native desktop application — not a browser tool, not a web service. It brings along everything it needs; installation is a one-line command or a double-click.

System requirements

  • A running desktop (graphical environment) is required.
  • The passive observation functions (SNI capture, for example) need elevated system permissions. CERNIS sets this up via a slim, specialised helper and points out if something is missing.
  • The application brings its dependencies along; on Linux the installation pulls in the required system tools as package dependencies.
  • On Windows, packet capture additionally requires Npcap. Npcap is not part of CERNIS PRO and is not bundled; the user obtains and installs it from the vendor. Npcap is under a licence of its own, which is not open source and limits the number of installations for free use. On Linux and macOS Npcap is not required.

Supported systems

  • Windows 10 or 11, 64-bit (x64 or ARM64)
  • macOS: current versions on Apple Silicon
  • Debian 12 and newer, Ubuntu 22.04 LTS and newer including the distributions built on them
  • Fedora, RHEL, Rocky Linux and AlmaLinux from version 10, openSUSE Leap 16 and Tumbleweed
  • x86-64 and ARM64 in each case

Not supported

  • RHEL 9 and older including its derivatives
  • Ubuntu 20.04 and older, Debian 11 and older
  • 32-bit systems
  • Flatpak and Snap

On RHEL, Rocky Linux and AlmaLinux 10 two steps are required before installation:

sudo /usr/bin/crb enable
sudo dnf install epel-release
Known limitations are documented for this edition.

Available files

The checksum serves to detect a download that arrived incomplete or damaged; it is not proof of origin. On Linux and macOS the user places the checksum file in the same directory as the file itself and runs the verification command there; an output of “OK” means the file was transferred completely. On Windows the verification command prints the hash of the file; it is to be compared with the value shown in the block. If both match, the file was transferred completely.

After installation CERNIS PRO appears in the application menu and starts like any other program. The commands run without rework as soon as the downloaded file is in the current directory.

Linux

An AppImage is no longer provided; use the .deb or .rpm package.

The installation package sets up the network permission for the capture helper itself. If that fails, the installation reports it explicitly.

Windows

Npcap is required for reading real domain names and for packet capture. CERNIS PRO does not install it; if it is missing, the application says so and offers to install it afterwards. For source and licence see the system requirements.

macOS

When the outbound contacts are opened for the first time, CERNIS PRO asks once for consent to passively read along the domain names. The consent can be withdrawn at any time.

Source code

Older builds in the archive This edition at a glance

What CERNIS PRO brings in this edition, and the work behind it, is documented traceably in the changelog.

Known limitations

These points are known and being worked on. They are listed here so that the user knows them before downloading instead of discovering them.

This list refers to version 2.1.2.

Windows: antivirus software can block startup

Observation:
On Windows, CERNIS PRO is not signed with a publisher certificate. Some antivirus programs therefore block startup or packet capture.
Impact:
The program may have to be allowed by hand.
Commitment:
A certificate has not been decided on yet. As soon as the decision is made, it will be announced here.

openSUSE: the RPM package is not signed

Observation:
zypper refuses to install unsigned packages by default.
Impact:
The installation only succeeds if the signature check is deliberately bypassed for this package. The other RPM distributions accept the same package with a warning.
Commitment:
A package signature of its own is prepared and will arrive in one of the next versions.

openSUSE: the route measurement is unavailable

Observation:
The system tool required for it sits outside the search path where CERNIS PRO expects it.
Impact:
The display of the network path to a remote peer stays empty; all other functions work.
Commitment:
A fix in the next version.

Windows: a program part is left behind when uninstalling

Observation:
The uninstaller does not know the capture helper and does not terminate it reliably.
Impact:
After uninstalling, a program file can be left behind locked; restarting the computer resolves it.
Commitment:
A fix in the next version.

Removed devices can show up in the vulnerability cross-check again

Observation:
When devices are removed via “Clean up by network”, the vulnerability cross-check adds them again shortly afterwards — it relies on the result of the last scan, not on the device list.
Impact:
The removed devices appear in the CVE cross-check again, and the number of affected devices is too high there. The device list itself stays correct, and a new scan clears the state.
Commitment:
A fix in the next version.

Scheduled scans do run, but their outcome is not visible

Observation:
Recurring tasks can be created, and as of this version CERNIS PRO also remembers how the last run turned out — but there is no view for it yet.
Impact:
Whether a scheduled run succeeded can currently only be seen indirectly from the results.
Commitment:
A schedule view is planned.

Two device counts can differ

Observation:
The security report and the vulnerability cross-check count devices differently — a device without a detected hardware address counts in one but not in the other.
Impact:
The two numbers can be a few devices apart.
Commitment:
The two counting methods will be unified once it is decided which of them is the right one.

Data stays behind after uninstalling

Observation:
A normal uninstall removes the program, but not personal application data such as scans and settings.
Impact:
The data remains in the user-specific application-data directories. On Linux, the DEB and RPM packages name the two paths on the console during removal.
Commitment:
Anyone who wants to clear data beforehand will find “Factory state” under “Management → Delete data”. It deletes some of the stored results and settings. Saved credentials as well as PCAP, backup and log files may remain, so this is not a complete reset to the state of a fresh installation. To remove everything, manually delete the CERNIS application-data directories belonging to the user account afterwards.

NVIDIA graphics under Wayland

Observation:
On systems with NVIDIA graphics under Wayland, startup could abort.
Impact:
The program window did not appear.
Commitment:
A fix is built in, but not yet confirmed on a machine with this combination.