In October 2026 the private keys of several intermediate CA certificates issued by eMudhra (emSign) were reported as compromised. All Browsers and most operating system vendors responded by revoking the affected intermediate certificates or removing the related root certificates.

Netsweeper has removed the following emSign root certificates from the NSProxy Trusted Root CA store.

• emSign ECC Root CA - G3

• emSign Root CA - C1

• emSign ECC Root CA - C3

While reviewing how Netsweeper handles these intermediate certificates, we found that NSProxy 8.2.1 to 8.2.15, 9.1.1 to 9.1.12, and 9.2.1 to 9.2.3, along with the Client Filter 11.30 to 13.80 do not properly validate the certificate chains. Customers who are decrypting with impacted versions of NSProxy or the Client Filter must upgrade.

• Impacts: NSProxy 8.2.1 to 8.2.14 fixed in 8.2.14.602

• Impacts: NSProxy 9.1.1 to 9.1.12 fixed in 9.1.12.602

• Impacts NSProxy 9.2.1 to 9.2.3 fixed in 9.2.3.602

• Impacts: Client Filter 11.30 to 13.80 fixed in 13.90

The following is required to run on Netsweeper servers. The following will perform:

• Upgrade the operating system certificate bundle

• Upgrade the NSProxy RPM depending on product revision if required

• Stop NSProxy so the in memory certificate cache is dumped to disk

• Remove the NSProxy certificate cache from disk.

  • By default caches persist for 24 hours, but many customers adjust this to months or more.

• Start the NSProxy if it was enabled on the system

Customers running any release of the Netsweeper Server on Enterprise Linux 8 can run the following to upgrade their operating system root certificates.

dnf upgrade \
https://repo.netsweeper.com//tickets/Ticket-NS3114-nsproxy-cabundle-emudhra/ca-certificates-2026.2.92_v9.0.319-81.3.el8_10.noarch.rpm

systemctl stop nsproxyctl

rm -f /usr/local/netsweeper/var/lib/nsproxy/cache/*

systemctl is-enabled --quiet nsproxyctl && systemctl start nsproxyctl

The following is required if you are running Netsweeper 8.2.1 to 8.2.14 with NSProxy and decrypting traffic.

dnf upgrade \
https://repo.netsweeper.com//tickets/Ticket-NS3114-nsproxy-cabundle-emudhra/ca-certificates-2026.2.92_v9.0.319-81.3.el8_10.noarch.rpm \
https://repo.netsweeper.com//tickets/Ticket-NS3114-nsproxy-cabundle-emudhra/ns_proxy-8.2.14.602-1.el8.x86_64.rpm

systemctl stop nsproxyctl

rm -f /usr/local/netsweeper/var/lib/nsproxy/cache/*

systemctl is-enabled --quiet nsproxyctl && systemctl start nsproxyctl

The following is required if you are running Netsweeper 9.1.1 to 9.1.12 with NSProxy and decrypting traffic

dnf upgrade \
https://repo.netsweeper.com//tickets/Ticket-NS3114-nsproxy-cabundle-emudhra/ca-certificates-2026.2.92_v9.0.319-81.3.el8_10.noarch.rpm \
https://repo.netsweeper.com//tickets/Ticket-NS3114-nsproxy-cabundle-emudhra/ns_proxy-9.1.12.602-1.el8.x86_64.rpm

systemctl stop nsproxyctl

rm -f /usr/local/netsweeper/var/lib/nsproxy/cache/*

systemctl is-enabled --quiet nsproxyctl && systemctl start nsproxyctl

The following is required if you are running Netsweeper 9.2.1 to 9.2.3 with NSProxy and decrypting traffic.

dnf upgrade \
https://repo.netsweeper.com//tickets/Ticket-NS3114-nsproxy-cabundle-emudhra/ca-certificates-2026.2.92_v9.0.319-81.3.el8_10.noarch.rpm \
https://repo.netsweeper.com//tickets/Ticket-NS3114-nsproxy-cabundle-emudhra/ns_proxy-9.2.3.602-1.el8.x86_64.rpm

systemctl stop nsproxyctl

rm -f /usr/local/netsweeper/var/lib/nsproxy/cache/*

systemctl is-enabled --quiet nsproxyctl && systemctl start nsproxyctl

Customers running the Client Filter 11.10 to 13.80 are required to upgrade to the 13.90 GA release on the following platforms.

• Windows Client Filter

• MacOS Client Filter

• Netsweeper nFilter VPN Client for iOS

The Chrome Extension, and Browser based Client Filters are not impacted as they do not decrypt.

To download the Client Filter 13.90 release, please see our Client Filter 13.90 Release Notes.