Installing Netskope Client on Ubuntu 20.04, 22.04, 24.04, and 26.04 (2026 Guide)

Sysadmin Desk — Tue, 02 Jun 2026 18:15:05 +0000

Deploying the Netskope client on Ubuntu is straightforward on 20.04, 22.04, and 24.04, and requires a workaround on 26.04 where Netskope has no official support yet. This guide covers all four versions based on real deployments, including the exact commands to fix certificate errors in snap-packaged browsers after enrollment.

Overview: what works where

Ubuntu version	Install method	GUI	Snap browser cert fix needed
20.04 LTS	`./NSClient.run -i`	✅ Works	✅ Yes
22.04 LTS	`./NSClient.run -i`	✅ Works	✅ Yes
24.04 LTS	`./NSClient.run -i`	✅ Works	✅ Yes
26.04 LTS	Symlinks first, then `./NSClient.run -i`	✅ Works	✅ Yes

The snap browser certificate issue is present on all versions — it is not a bug, it is how snap sandboxing works. The 26.04 workaround is the only version-specific step.

What do you need before installing the Netskope client?

Before you start you need:

The Netskope .run installer downloaded from your tenant. The URL pattern is:

  https://<your-tenant>.goskope.com/dlr/linux/get

Get the exact link from your Netskope admin console under Settings → Security Cloud Platform → Netskope Client → Device Management.

sudo access on the target machine.
Enrollment details from the admin console: tenant hostname and org key.

How do you install the Netskope client on Ubuntu 20.04, 22.04, and 24.04?

On Ubuntu 20.04, 22.04, and 24.04, install the Netskope client by downloading the .run installer from your tenant, making it executable with chmod 766, and running sudo ./NSClient.run -i. The system-tray icon then appears so you can enroll with your tenant hostname and org key — no extra preparation is needed on these versions.

# Download the installer
wget https://<your-tenant>.goskope.com/dlr/linux/get -O ./NSClient.run

# Make it executable
chmod 766 ./NSClient.run

# Install
sudo ./NSClient.run -i

After installation the Netskope icon appears in the system tray. Click it, complete enrollment with your tenant hostname and org key or SSO login, and the client connects.

Verify the services are running:

sudo systemctl status stagentd
sudo systemctl status stagentapp

Both should show active (running). If either is not running:

sudo systemctl start stagentd
sudo systemctl start stagentapp

How do you install the Netskope client on Ubuntu 26.04?

Netskope does not officially support Ubuntu 26.04 yet. The .run installer will report missing dependencies and the GUI may warn during the process. The fix is to install the required GTK libraries and create two symlinks that point the library names Netskope expects to the newer versions present on the system.

Step 1 — Install the required libraries:

sudo apt update
sudo apt install libgtk-3-0 libwebkit2gtk-4.1-0 libayatana-appindicator3-1

Step 2 — Confirm the webkit library is present:

find /usr/lib/x86_64-linux-gnu -name "libwebkit2gtk*"

Expected output:

/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.1.so.0
/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.1.so.0.21.7

Step 3 — Create the symlinks:

sudo ln -s /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.1.so.0 \
           /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37

sudo ln -s /usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.1.so.0 \
           /usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18

These symlinks tell the installer that the old library names exist by pointing them at the newer equivalents.

Step 4 — Run the installer:

sudo ./NSClient.run -i

The installer will still mention the dependency gap during the process, but it completes successfully and the GUI launches for enrollment.

Why snap browsers need a separate certificate fix

After enrollment, Netskope performs SSL inspection by acting as a local proxy and re-signing HTTPS traffic with its own CA certificate. Browsers need to trust this CA or they will show certificate errors on every HTTPS site.

Updating the system certificate store handles most applications:

sudo cp /opt/netskope/stagent/data/nscacert.pem \
        /usr/local/share/ca-certificates/netskope.crt
sudo update-ca-certificates

This works for curl, wget, apt, and any application that reads from the system store — but not for snap-packaged browsers. Firefox and Chrome installed as snaps run in an isolated sandbox and ignore the system certificate store entirely. Each maintains its own NSS certificate database that needs to be updated separately.

This is the same across all Ubuntu versions because the isolation comes from snap packaging, not the OS version.

How do you fix Netskope certificate errors in Firefox (snap)?

Snap-packaged Firefox ignores the system certificate store, so import the Netskope CA into its own NSS database. Install libnss3-tools, locate your profile folder under ~/snap/firefox/common/.mozilla/firefox/, run certutil to add the CA as "Netskope CA", then restart Firefox — the certificate errors disappear.

First make sure libnss3-tools is installed — you need the certutil command:

sudo apt install libnss3-tools

Find your Firefox snap profile directory:

ls $HOME/snap/firefox/common/.mozilla/firefox/

You will see something like:

gilh571z.default   profiles.ini   Crash Reports

The folder with the random string prefix is your profile. Import the Netskope CA into it:

certutil -d sql:$HOME/snap/firefox/common/.mozilla/firefox/<your-profile-name> \
  -A -t "CT,," -n "Netskope CA" \
  -i /opt/netskope/stagent/data/nscacert.pem

Restart Firefox. Certificate errors will be gone.

If the profile directory does not exist, Firefox has not been opened yet on this machine. Open it once, let it fully load, close it, then run the command above.

How do you fix Netskope certificate errors in Chrome?

Chrome on Linux uses its own NSS database at ~/.pki/nssdb and ignores the system certificate store, just like snap Firefox. Create the database if needed, import the Netskope CA with certutil, then fully quit Chrome — every background process — and reopen it. Certificate inspection then works without errors.

# Create the database if it does not exist yet
mkdir -p $HOME/.pki/nssdb
certutil -d sql:$HOME/.pki/nssdb -N --empty-password 2>/dev/null

# Import the Netskope CA
certutil -d sql:$HOME/.pki/nssdb \
  -A -t "CT,," -n "Netskope CA" \
  -i /opt/netskope/stagent/data/nscacert.pem

Close Chrome completely — all windows, not just the current tab — and reopen it. To confirm it is fully closed before reopening:

pgrep -a chrome

If any processes show up, they are background Chrome processes still running. Let them exit and reopen Chrome.

Quick reference — all certificate commands

# 1. System certificate store (curl, wget, apt, non-snap apps)
sudo cp /opt/netskope/stagent/data/nscacert.pem \
        /usr/local/share/ca-certificates/netskope.crt
sudo update-ca-certificates

# 2. Firefox snap — find your profile name first
ls $HOME/snap/firefox/common/.mozilla/firefox/

# Then import (replace <profile> with the actual folder name)
certutil -d sql:$HOME/snap/firefox/common/.mozilla/firefox/<profile> \
  -A -t "CT,," -n "Netskope CA" \
  -i /opt/netskope/stagent/data/nscacert.pem

# 3. Chrome
mkdir -p $HOME/.pki/nssdb
certutil -d sql:$HOME/.pki/nssdb -N --empty-password 2>/dev/null
certutil -d sql:$HOME/.pki/nssdb \
  -A -t "CT,," -n "Netskope CA" \
  -i /opt/netskope/stagent/data/nscacert.pem

Run steps 2 and 3 after enrollment, restart both browsers, and certificate inspection will work across all of them.

Troubleshooting

Why does the Netskope tray icon disappear and reappear after installation?
Normal behavior. The stagentapp watchdog monitors the client process and restarts it automatically. Check the logs if it keeps happening after the initial startup settles:

sudo journalctl -u stagentd -n 50
sudo journalctl -u stagentapp -n 50

Why is nscacert.pem not found when running the certificate commands?
The file is created during enrollment, not during installation. Run the certificate import commands only after enrollment completes.

Why is the Firefox profile directory missing at the snap path?
Firefox creates the profile directory the first time it launches. If the machine is fresh, open Firefox once, close it, then run the certutil command.

Why does Chrome still show certificate errors after importing the CA?
Make sure Chrome was fully quit before reopening. Use pgrep -a chrome to confirm no background processes are still running.

Why does the 26.04 installer still exit with dependency errors after creating the symlinks?
Remove the symlinks and recreate them — a failed previous attempt may have left them pointing at the wrong target:

sudo rm /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37
sudo rm /usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18

Then repeat Steps 2–4 from the 26.04 section above.

Originally published at thesysadmindesk.com

DEV Community: Sysadmin Desk