Hostscan does support machine certificates since CSD version 3.5(1043) .
However there was a bug causing it not to check the Trusted Root Authorities, this was fixed in 3.6(095)
If your version is newer then I can only suggest to check the logfiles in
C:\Users\\AppData\Local\Cisco\Cisco HostScan\log
(vista/win7)
or
C:\Documents and Settings\\Local Settings\Application
Data\Cisco\Cisco HostScan\log
(XP)
And/or open a TAC case...
hth
Herbert