Updating Entitlements Certificates

An entitlement certificate represents a subscription that has been consumed by a given system. It includes all of the products which are included in the subscription for service and support, the subscription's start and end dates, and the number of entitlements included for each product. An entitlement certificate does not list products that are currently installed on the system; rather, it lists all of that products that are available to the system.

The entitlement certificate is an X.509 certificate and is stored in a base 64-encoded blob in a .pem file.

When a subscription expires or is changed, then the entitlement certificate must be updated to account for the changes. The CentOS Subscription Manager polls the subscription service periodically to check for updated entitlement certificates; this can also be updated immediately or pulled down from the Customer Portal. The entitlement certificates are updated by revoking the previous entitlement certificate and generating a new one to replace it.

Updating Entitlement Certificates

Open the CentOS Customer Portal.

https://access.redhat.com/

Click the Subscriptions tab to open the subscriptions menu, and select the Consumers List option under Certificate-Based Management.

Click the system name in the list of consumers.
Open the Applied Subscriptions tab for the list of all active, assigned subscriptions for the consumer.
Click the Download All Certificates button above the list of subscriptions. If there is only one subscription, then click the Download button by the certificate.

To retrieve an individual entitlement certificate, click the Download link in the subscription row.
If all entitlement certificates were downloaded in an archive file, then there are multiple archives in the downloaded certificates.zip file. Unzip the directories until the PEM files for the entitlement certificates are available.

Import the certificate PEM file. This can be done using the Import Certificates button in the Subscription Manager GUI or using the import command:

# subscription-manager import --certificate=/tmp/export/entitlement_certificates/596576341785244687.pem --certificate=/tmp/export/entitlement_certificates/3195996649750311162.pem
Successfully imported certificate 596576341785244687.pem
Successfully imported certificate 3195996649750311162.pem

Updating Subscription Information

The refresh command updates all of the subscription information that is available to the consumer. This removes expired subscriptions and adds new subscriptions to the list. This does not subscribe the machine, but it does pull in the newest data for administrators to use.

[root@server1 ~]# subscription-manager refresh