7.12. Updating Subscription Certificates

A subscription certificate represents a subscription that has been attached to a given system. It includes all of the products which are included in the subscription for service and support, the subscription's start and end dates, and the number of subscriptions included for each product. A subscription certificate does not list products that are currently installed on the system; rather, it lists all products that are available to the system.
The subscription certificate is an X.509 certificate and is stored in a base 64-encoded blob in a .pem file.
When a subscription expires or is changed, then the subscription certificate must be updated to account for the changes. The Red Hat Subscription Manager polls the subscription service periodically to check for updated subscription certificates; this can also be updated immediately or pulled down from the Customer Portal. The subscription certificates are updated by revoking the previous subscription certificate and generating a new one to replace it.

7.12.1. Updating Subscription Certificates

  1. Open the Red Hat Customer Portal.
    https://access.redhat.com/
  2. Click the Subscriptions tab to open the subscriptions menu, and select the Registered Consumers option under Certificate-based Management.
  3. Click the system name in the list of systems.
  4. Open the Applied Subscriptions tab for the list of all active, attached subscriptions for the system.
  5. Click the Download All Certificates button above the list of all attached subscriptions for the system. If there is only one subscription, then click the Download button by the certificate.
    To retrieve an individual subscription certificate, click the Download link in the subscription row.
  6. If all subscription certificates were downloaded in an archive file, then there are multiple archives in the downloaded certificates.zip file. Unzip the directories until the PEM files for the subscription certificates are available.
  7. Import the certificate PEM file. This can be done by using the Import Certificates menu option in the System menu of the Subscription Manager UI or by using the import command:
    # subscription-manager import --certificate=/tmp/export/entitlement_certificates/596576341785244687.pem --certificate=/tmp/export/entitlement_certificates/3195996649750311162.pem
    Successfully imported certificate 596576341785244687.pem
    Successfully imported certificate 3195996649750311162.pem

7.12.2. Updating Subscription Information

The refresh command updates all of the subscription information that is available to the system. This removes expired subscriptions and adds new subscriptions to the list. This does not attach any subscriptions to the system, but it does pull in the newest data for administrators to use.
[root@server1 ~]# subscription-manager refresh