RHSM download plugin no longer compatible with Red Hat Customer Portal

1

We’ve been using the RHSM download plugin for 4 years, but Red Hat recently made changes in how systems are managed. We are not directed to the Hybrid Cloud Console, which not longer allows us to add systems and pull down entitlements. Our plugin is nolonger working and Red Hat Patch is dead in the water. And yes, I have opened a case with Big Fix.

2

I have the same problem. Do you already get a Update from HCL?

3

My case has been sent to development and then L3. I don’t believe there is a solution as of this monent.

2 Likes
4

Thanks for your update

5

Hi @RichCampbell and @KevinD, in my lab I was able to obtain the subscription entitlement certificate without accessing Red Hat Customer Portal https://access.redhat.com. It was obtained directly from a registered RHEL endpoint. Then I used this certificate in my root server’s RHSM download plugin configuration. Obtain the certificate located here from the RHEL endpoint:

/etc/pki/entitlement

You should see 2 PEM files located here. Then I will combine these 2 files into 1 PEM file using the following command (my example certificate files are 1234567890123456789.pem and 1234567890123456789-key.pem):

cat /etc/pki/entitlement/1234567890123456789.pem /etc/pki/entitlement/1234567890123456789-key.pem > /tmp/1234567890123456789.pem

Then use the new combined file /tmp/1234567890123456789.pem in your RHSM download plugin configuration and I then validated via the command RHSMPlugin.exe --check-baserepos and inspected the output to confirm that the cert can access the base repos that are listed.

-Gus

5 Likes
6

Hi everyone,
I’ve got an old developer account, and I was able to create an offline system and attach some subscription to it.
What are you seeing on your end?

I’ve captured it in a GIF File - Can you check it?
RHEL Subscription Management Capture Sample

7

Works for me! Thank you!

8

I also got it to work after I moved a system to use Red Hat’s CDN instead of our internal Satellite. Then coping the entitlement certificate worked. I also received an update from HCL but it only says L3 is still working the issue.

1 Like
9

Thanks @gus. We typically patch against offline repo so RHSM plugin is not used frequently in our installation and it seems RH makes changes and it needs attention/upgrade before use when it does get used.
Your post provided the steps needed to quickly resolve the issue this time.

10

This example is the old Red Hat site view. The new view does not contain a header for Systems. Do we have a resolution to this yet?

11

HCL case opened for this same issue as our certs expire soon. Also cannot add the RHEL 7 ELS entitlement to access the required repos.

12

@BearPaw, can you review this knowledge base article to see if it addresses this issue:

13

Thanks Gus! Ya, this appears to be basically taking the subscription allocation certificate from an active server and letting the RHSM download plugin piggy back on the entitlement. It also may not have all subscription allocations if they were not relevant to that client server. While a workaround for sure, the legitimacy of it as a solution in the eyes of Red Hat subscription allocation rules seems questionable.

Good news though! In addition to the KB you linked, support has replied with the following option also:

Regarding the issue informed I researched internally for the dev case (as mentioned in the forum) and found the information from previous cases we had for same request.

Dev response was that RedHat had suggested following steps to download manifest certificates, so this would be the required alternative procedure:

=====================

  1. Please go to below URL
    Log In | Red Hat IDP

  2. Click on New subscription allocation, give any name like testing and select Type as "Satellite 6.12"or “SAM 1.4” and click on create. (Anything like "Satellite 6.12"or “SAM 1.4” will work here.)

  3. Once you select this testing allocation, click on “subscriptions” tab and then click on “Add Subscriptions”

Select subscription of your choice with Entitlements Qty as 1 and click on Submit.

This subscription will be added to satellite allocation and can be seen in “Subscriptions” tab now.

  1. Then click on “Export Manifest”

A file named like manifest_testing_XXXXX.zip will be downloaded. You need to extract this file to get the required entitlement certificate.

We didn’t have other response from previous cases since another alternative way was found so we couldn’t confirm those steps. But if they are still not resolving the problem I can contact the team again.

We will have to reclaim the allocations from the now missing BigFix system in the Red Hat site so we can add them to this new manifest method. As such, it may take me a bit before we can validate these steps.

14

After freeing up an allocation on our subscriptions, we were able to validate steps 1-4 as outlined by support today!

One note I see different than the previous procedure is that there is no longer an identity certificate for the system in the downloaded manifest. It does not appear to be needed either as the RHSMplugin.exe --check-baserepos is able to access the repos with only the entitlement certificate(s). You will have a separate entitlement certificate per subscription that you associate with your newly created “subscription allocation” object (previously referred to as system).

1 Like