Use > Server patching > Patch management for Red Hat Linux Enterprise > Import Red Hat Errata and Channels in SA using SA Red Hat Importer tool > Entitlement certificates

Entitlement certificates

Red Hat subscriptions provide software entitlements. The actual content is delivered through the Red Hat Content Delivery Network (CDN) or through Red Hat Satellite 6.

Note In the following sections, CDN is used to denote content imported from either Red Hat CDN or Satellite 6. When there are specifics to the online portal, Red Hat CDN will be used to denote the difference.

RHSM uses the following X.509 certificates for managing subscriptions:

  • Identity certificate - Issued to a system upon registration with the subscription management service. This certificate is used to authenticate and identify the system to the subscription management service.
  • Product certificate - Generated and installed on a system once a product is installed. This certificate contains information about the specific system that the product is installed on (such as its hardware and architecture) and the product name, version, and namespace.
  • Entitlement certificate - Contains a list of subscriptions for a system, including information about the products and quantities, content repositories, roles, and different namespaces.

To be able to connect to Red Hat CDN or Satellite 6 and download content, redhat_import requires an entitlement certificate from RHSM. This must be available on the SA Core where redhat_import is run. redhat_import does not use the identity and product certificates.

The entitlement certificate must be generated on the Red Hat Customer Portal or on the Satellite 6 if you want to import content from the Satellite. The next step is to download the certificate and place it on the SA Core.

To generate an entitlement certificate, perform the following steps:

  1. Register a system (unit):
    • For Red Hat Customer Portal, the easiest way to achieve this is to register an offline system by providing the system details on the Red Hat Customer Portal. However, if you already have a suitable system that is registered on the Red Hat Customer Portal, you can reuse it.
    • For Red Hat Satellite 6, there is no official way of registering offline systems. To proceed to the next step, you need to have a suitable system that can be registered to the Satellite server using the subscription_management tool provided by Red Hat.
  2. Attach a subscription to the registered system.
    • The attached subscription is required to cover the Red Hat product(s) that you need to download using redhat_import. For example, if you need to download content for RHEL 7, x86_64, the subscription needs to cover Red Hat Enterprise Linux product.
    • For the Red Hat Customer Portal, the entitlement certificate is available on the portal.
    • For Satellite 6, the default path for entitlement certificate is /etc/pki/entitlement. This is available on the system registered with the Satellite server. Usually you will find two .pem files (a public and a private key). You should concatenate these two files into a single .pem file. This will be the entitlement certificate that must be downloaded to the SA Core.

    Multiple entitlement certificates

    redhat_import supports multiple entitlement certificates. If you need to import content that is not covered by any of the existing entitlement certificates, you can generate a new entitlement certificate, covering the required CDN content and add it to the redhat_import configuration file.

    No entitlement certificate is required when redhat_import binary is only used to download content from RHN.

    Note As a best practice, do not mix entitlements for Red Hat Customer Portal with entitlements for Red Hat Satellite 6.

Send Help Center feedback