Important Content Delivery Network CDN Moderinzation If you are using Red Hat Linux 7.3 (please use a current edition)

This is here to point to this Red Hat article: https://access.redhat.com/articles/cdn_modernization

Note: please use a supported edition of Red Hat. The only way to acquire updates for Red Hat 7 is with Extended Update Support which is not free.

Running on previous editions of Red Hat Linux without recurring updates incurs significant security risks. Please either migrate to a current edition of Red Hat Linux, or buy Extended Update Support and use it.

Red Hat Content Delivery Network (CDN) & Entitlement Network Modernization

Summary
On January 14th, 2026 Red Hat will be making a number of changes to our CDN (cdn.redhat.com) and entitlement network (subscription.rhsm.redhat.com). If you maintain systems running Red Hat Enterprise Linux 7.3 or earlier or you configure your firewall to allowlist particular IP addresses to connect to Red Hat networks you will be required to make configuration changes before January 14th to avoid losing access to content.

Why are these changes happening?
While our current network configuration has received iterative updates over the years we’ve been running a relatively consistent environment for the past 10+ years. Continuing to strengthen the security of our network is important, but some older clients may not support those new features and could end up in a broken state unable to pull content. We take consideration to balance the improvement to the network and the number of customers affected based on usage analytics and the time has come to make some important changes. This doesn’t mean we’re leaving our older generation systems behind, but they may require some manual changes to continue functioning as before. Check the “What do I need to do?” section for more information on what could be required.

What is changing?
New CIDR lists - For customers that need to allowlist specific IPs in their firewall systems to talk with Red Hat services, we’re publishing a new set of IP addresses. Because of the modernization changes we’re making, this new list is smaller than previously and includes both IPv4 and IPv6 addresses, but clients will be required to support TLS Server Name Indication (SNI). The old CIDR list will remain to support the legacy deployment of the CDN and the Entitlement legacy deployment will share the same CIDR list as the Red Hat Insights platform. For a full list of IP addresses please review the CIDR list kbase article.

IPv6 - cdn.redhat.com and subscription.rhsm.redhat.com will begin announcing DNS for IPv6 as well as for the traditional IPv4. While we’ve supported IPv6 on our CDN in the past it required manually changing your system setups to point to cdn6.redhat.com. The cdn6.redhat.com network will remain as is, and systems can continue to use it. However, after these changes have been made we recommend reconfiguring them to use cdn.redhat.com.

Elliptic Curve (EC) certificates - When a client connects it will begin negotiations using a new Elliptic Curve certificate. This certificate type increases the strength of the encryption between the client and our network. If the client does not support Elliptic Curve certificates it will fall-back to the traditional RSA certificate. The legacy deployment will only serve RSA certificates.

TLS version compatibility - Our network will only support TLSv1.2 and higher. This will help prevent a number of security weaknesses in the earlier versions of the protocol.

Ciphers - Our supported cipher list will be updated to remove a few weak ciphers.

Please visit this link for steps to take https://access.redhat.com/articles/cdn_modernization

Regards,
RJ