May 17, 2026 · 6 min read

Installing Netskope Client on Ubuntu 20.04, 22.04, 24.04, and 26.04 (2026 Guide)

Deploying the Netskope client on Ubuntu is straightforward on 20.04, 22.04, and 24.04, and requires a workaround on 26.04 where Netskope has no official support yet. This guide covers all four versions based on real deployments, including the exact commands to fix certificate errors in snap-packaged browsers after enrollment.

Overview: what works where

Ubuntu version	Install method	GUI	Snap browser cert fix needed
20.04 LTS	`./NSClient.run -i`	✅ Works	✅ Yes
22.04 LTS	`./NSClient.run -i`	✅ Works	✅ Yes
24.04 LTS	`./NSClient.run -i`	✅ Works	✅ Yes
26.04 LTS	Symlinks first, then `./NSClient.run -i`	✅ Works	✅ Yes

The snap browser certificate issue is present on all versions — it is not a bug, it is how snap sandboxing works. The 26.04 workaround is the only version-specific step.

Prerequisites

Before you start you need:

The Netskope .run installer downloaded from your tenant. The URL pattern is:
```
https://<your-tenant>.goskope.com/dlr/linux/get
```
Get the exact link from your Netskope admin console under Settings → Security Cloud Platform → Netskope Client → Device Management.
sudo access on the target machine.
Enrollment details from the admin console: tenant hostname and org key.

Ubuntu 20.04, 22.04, and 24.04 — standard install

The .run installer handles everything on these three versions with no preparation needed.

# Download the installer
wget https://<your-tenant>.goskope.com/dlr/linux/get -O ./NSClient.run

# Make it executable
chmod 766 ./NSClient.run

# Install
sudo ./NSClient.run -i

After installation the Netskope icon appears in the system tray. Click it, complete enrollment with your tenant hostname and org key or SSO login, and the client connects.

Verify the services are running:

sudo systemctl status stagentd
sudo systemctl status stagentapp

Both should show active (running). If either is not running:

sudo systemctl start stagentd
sudo systemctl start stagentapp

Ubuntu 26.04 — unofficial workaround

Netskope does not officially support Ubuntu 26.04 yet. The .run installer will report missing dependencies and the GUI may warn during the process. The fix is to install the required GTK libraries and create two symlinks that point the library names Netskope expects to the newer versions present on the system.

Step 1 — Install the required libraries:

sudo apt update
sudo apt install libgtk-3-0 libwebkit2gtk-4.1-0 libayatana-appindicator3-1

Step 2 — Confirm the webkit library is present:

find /usr/lib/x86_64-linux-gnu -name "libwebkit2gtk*"

Expected output:

/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.1.so.0
/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.1.so.0.21.7

Step 3 — Create the symlinks:

sudo ln -s /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.1.so.0 \
           /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37

sudo ln -s /usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.1.so.0 \
           /usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18

These symlinks tell the installer that the old library names exist by pointing them at the newer equivalents.

Step 4 — Run the installer:

sudo ./NSClient.run -i

The installer will still mention the dependency gap during the process, but it completes successfully and the GUI launches for enrollment.

Why snap browsers need a separate certificate fix

After enrollment, Netskope performs SSL inspection by acting as a local proxy and re-signing HTTPS traffic with its own CA certificate. Browsers need to trust this CA or they will show certificate errors on every HTTPS site.

Updating the system certificate store handles most applications:

sudo cp /opt/netskope/stagent/data/nscacert.pem \
        /usr/local/share/ca-certificates/netskope.crt
sudo update-ca-certificates

This works for curl, wget, apt, and any application that reads from the system store — but not for snap-packaged browsers. Firefox and Chrome installed as snaps run in an isolated sandbox and ignore the system certificate store entirely. Each maintains its own NSS certificate database that needs to be updated separately.

This is the same across all Ubuntu versions because the isolation comes from snap packaging, not the OS version.

Fixing certificate errors in Firefox (snap)

First make sure libnss3-tools is installed — you need the certutil command:

sudo apt install libnss3-tools

Find your Firefox snap profile directory:

ls $HOME/snap/firefox/common/.mozilla/firefox/

You will see something like:

gilh571z.default   profiles.ini   Crash Reports

The folder with the random string prefix is your profile. Import the Netskope CA into it:

certutil -d sql:$HOME/snap/firefox/common/.mozilla/firefox/<your-profile-name> \
  -A -t "CT,," -n "Netskope CA" \
  -i /opt/netskope/stagent/data/nscacert.pem

Restart Firefox. Certificate errors will be gone.

If the profile directory does not exist, Firefox has not been opened yet on this machine. Open it once, let it fully load, close it, then run the command above.

Fixing certificate errors in Chrome

Chrome on Linux uses its own NSS database at ~/.pki/nssdb.

# Create the database if it does not exist yet
mkdir -p $HOME/.pki/nssdb
certutil -d sql:$HOME/.pki/nssdb -N --empty-password 2>/dev/null

# Import the Netskope CA
certutil -d sql:$HOME/.pki/nssdb \
  -A -t "CT,," -n "Netskope CA" \
  -i /opt/netskope/stagent/data/nscacert.pem

Close Chrome completely — all windows, not just the current tab — and reopen it. To confirm it is fully closed before reopening:

pgrep -a chrome

If any processes show up, they are background Chrome processes still running. Let them exit and reopen Chrome.

Quick reference — all certificate commands

# 1. System certificate store (curl, wget, apt, non-snap apps)
sudo cp /opt/netskope/stagent/data/nscacert.pem \
        /usr/local/share/ca-certificates/netskope.crt
sudo update-ca-certificates

# 2. Firefox snap — find your profile name first
ls $HOME/snap/firefox/common/.mozilla/firefox/

# Then import (replace <profile> with the actual folder name)
certutil -d sql:$HOME/snap/firefox/common/.mozilla/firefox/<profile> \
  -A -t "CT,," -n "Netskope CA" \
  -i /opt/netskope/stagent/data/nscacert.pem

# 3. Chrome
mkdir -p $HOME/.pki/nssdb
certutil -d sql:$HOME/.pki/nssdb -N --empty-password 2>/dev/null
certutil -d sql:$HOME/.pki/nssdb \
  -A -t "CT,," -n "Netskope CA" \
  -i /opt/netskope/stagent/data/nscacert.pem

Run steps 2 and 3 after enrollment, restart both browsers, and certificate inspection will work across all of them.

Troubleshooting

The Netskope icon disappears and reappears briefly after installation Normal behavior. The stagentapp watchdog monitors the client process and restarts it automatically. Check the logs if it keeps happening after the initial startup settles:

sudo journalctl -u stagentd -n 50
sudo journalctl -u stagentapp -n 50

nscacert.pem not found when running certificate commands The file is created during enrollment, not during installation. Run the certificate import commands only after enrollment completes.

Firefox profile directory not found at the snap path Firefox creates the profile directory the first time it launches. If the machine is fresh, open Firefox once, close it, then run the certutil command.

Chrome still shows errors after import Make sure Chrome was fully quit before reopening. Use pgrep -a chrome to confirm no background processes are still running.

On 26.04: installer exits with dependency errors even after creating symlinks Remove the symlinks and recreate them — a failed previous attempt may have left them pointing at the wrong target:

sudo rm /usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37
sudo rm /usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18

Then repeat Steps 2–4 from the 26.04 section above.