# Red Hat Linux Patching

**Last Updated On**: 16 Jul 2026  
**11 minutes read**

## Overview of Red Hat Patching

Patch Management for Red Hat Enterprise Linux enables administrators to effectively manage all security and non-security patches released by Red Hat. This process is crucial for maintaining a high level of security across Linux endpoints by allowing the identification, installation, and auditing of Red Hat package updates on subscribed machines and servers.

## Pre-Requisites

> **Note**  
> It is mandatory that all managed endpoints possess Standard subscriptions for Red Hat Enterprise Linux.

### Agent

1. To receive updates from the Red Hat portal, you need to have an active subscription.
   - Refer [here](https://www.redhat.com/en/store) for purchasing a Red Hat subscription.
   - Refer [here](https://docs.redhat.com/en/documentation/subscription_central/1-latest/html/getting_started_with_rhel_system_registration/index) for managing your subscriptions.
2. Verify your purchased subscription.
   - Check the subscription status of the system by running the command: `sudo subscription-manager status` in the Linux terminal.
   - If you have Simple Content Access (SCA) enabled in your Red Hat account, then systems simply need to be registered (via subscription-manager) to get access to the repositories. Ensure that either of the following status is displayed.

**When SCA is enabled**

```
subscription-manager status
+-------------------------------------------+
   System Status Details
+-------------------------------------------+
Overall Status: Disabled
Content Access Mode is set to Simple Content Access. This host has access to content, regardless of subscription status.

System Purpose Status: Disabled
```

**When SCA is disabled**

```
subscription-manager status
+-------------------------------------------+
   System Status Details
+-------------------------------------------+
Overall Status: Current

System Purpose Status: Matched
```

- If the Red Hat Subscription status is "Unknown", then it could be because your machine was registered when it was offline. If that's the case, refer to the steps [here](https://access.redhat.com/solutions/7065718?utm_source=pmp).
- If the Red Hat Subscription Status is "Insufficient", then it could be because you have subscribed a VM machine which was migrated. In that case, refer to the steps [here](https://access.redhat.com/solutions/3328401).
- If you still face a problem or the subscription status was neither of the above two cases, then try to reattach the subscription or try executing the command `subscription-manager refresh`, which updates your system with the latest subscription information from Red Hat. Then verify that the entitlement certificates are present in `/etc/pki/entitlement/` directory.
- If the purchased subscription is expired, renew your subscription. Refer [here](https://www.redhat.com/en/about/subscription-renewal-guide?utm_source=pmp) for the renewal steps.

3. Verify if valid Red Hat repository is configured in your systems,
   - Check if it meets the required criteria, as mentioned [here](https://www.manageengine.com/vulnerability-management/kb/patch-management/invalid-redhat-repo-found-in-agent-machine.html#criteria).
   - If the valid `.repo` file is missing, ensure `/etc/rhsm/rhsm.conf` has `manage_repos` set to "1".
4. **Systems registered with Red Hat Update Infrastructure (RHUI)** in the cloud require an active connection to access the RHUI-subscribed mirrors.
5. Systems registered with Red Hat Satellite Server: the agent must be installed in the Satellite server installed system, as it is expected to point to **cdn.redhat.com**.

### Server

Ensure whether **cdn.redhat.com** is accessible from the central server.

The following domains need to be whitelisted for the Red Hat packages to be downloaded:

1. https://cdn.redhat.com

## Configuring Red Hat Linux Settings For Patching

### Automatic Upload of Red Hat Entitlement Certificate to Server

When an agent is installed and the system meets the prerequisites, then the Red Hat Entitlement Certificate will automatically upload from the system. For systems upgraded from below version 11.3.2440.1, the previously configured nominated system will be considered by default. If the certificate is not uploaded after a few refresh cycles, any other agent with a valid subscription will upload the certificate.

### Manual Upload of Red Hat Entitlement Certificate to Server

Instead of automatic upload, you can manually select the system to upload the certificate.

If you prefer to manage the unmanaged edition again, then:

- Navigate to Patch Management -> Redhat Linux Settings Page -> Choose Alternate System.
- Select the system to upload the certificate.

> **Note**  
> If an uploaded Red Hat Entitlement Certificate has expired, the agent will not automatically fetch the latest certificate from available systems. Certificate re-upload will only occur on manually configured systems; hence, always maintain an active subscription on these systems.

### Disable Edition

If you do not wish to manage a particular edition, you can delete it from the Red Hat Linux settings page. Removing an edition will impede patching operations such as scans and deployments.

**Steps to Configure:**

- Navigate to Patch Management -> Redhat Linux Settings Page -> Disable Edition.

> **Note**  
> If any edition is disabled, then patch scan and deployment cannot be performed. If you wish to manage the disabled edition again, kindly contact [vulnerabilitymanagerplus-support@manageengine.com](mailto:vulnerabilitymanagerplus-support@manageengine.com).

## RHUI Subscribed Systems

1. All systems are registered with Red Hat Update Infrastructure (RHUI) in the cloud, with none directed to cdn.redhat.com.
   - The agent will directly download the required meta files and patches directly from the RHUI configured repositories.
2. A hybrid environment where some systems are subscribed through RHUI in the cloud, while others are directly registered with Red Hat.
   - For systems registered directly with Red Hat, the agent will download the necessary metadata files and patches directly from the Vulnerability Manager Plus Server.
   - For systems registered with RHUI in the cloud, the agent will directly retrieve the necessary meta files and patches from the configured RHUI repositories.
   - If you wish to change this behavior to download the meta files and patches from the Vulnerability Manager Plus Server, an internal setting has to be enabled. Please contact [vulnerabilitymanagerplus-support@manageengine.com](mailto:vulnerabilitymanagerplus-support@manageengine.com) for assistance.

## RedHat Entitlement Certificates

Red Hat entitlement certificates are essential for managing and verifying a RHEL system's subscription. These certificates ensure secure and authenticated access to Red Hat repositories, allowing the system to receive updates and patches according to its subscribed entitlements.

- **Entitlement Certificates (*.pem):** These certificates represent the entitlements granted to the system based on the attached subscriptions. Each entitlement certificate is typically named with a unique identifier and has a `.pem` extension. They contain details about the products and services the system is entitled to, including the start and end dates of the subscription.
- **Entitlement Key Files (*-key.pem):** For each entitlement certificate, there is a corresponding private key file with a `*-key.pem` extension. These key files are used in conjunction with the entitlement certificates for SSL/TLS authentication when accessing Red Hat content delivery networks (CDN) or repositories.

### Purpose of Certificates

The Vulnerability Manager Plus server will use these certificates to securely download metadata files and patches from cdn.redhat.com.

> **Note**  
> Once the certificate is successfully uploaded to the server, it will initiate the offline metadata download. Allow for a minimum of one refresh cycle for the server to download all required offline meta files before initiating the patch scan or deployment process.