RHEL 9 Subscription Manager: Attaching Entitlements, Enabling Repos, and Going Offline

Red Hat's Subscription Model Is Different From What You're Used To

If you're coming from Ubuntu or CentOS, RHEL's subscription model feels like an obstacle. It's actually a contract for support and patch access, but the mechanics — entitlements, pools, repos — trip people up regularly.

This guide covers what you need to know operationally: how to register a system, enable the repos your workloads need, handle systems without internet access, and not get burned when entitlement counts are exhausted.

---

Registering a System

RHEL 9 uses subscription-manager to connect to Red Hat's Customer Portal (or your own Satellite server).

# Register with Red Hat Customer Portal
sudo subscription-manager register --username=<rh-username> --password=<rh-password>

# Or register with an activation key (preferred for automation)
sudo subscription-manager register \
  --org=<org-id> \
  --activationkey=<key-name>

# Verify registration
sudo subscription-manager status
sudo subscription-manager identity

With Simple Content Access (SCA) — which is the default on new RHEL 9 registrations — you don't need to attach a specific subscription pool. All repos your organization is entitled to are available automatically after registration.

---

Simple Content Access vs. Legacy Subscription Attachment

Simple Content Access (SCA) — enabled by default since 2022 — means:

• No pool attachment required
• All entitled content is available after register
• Entitlement certificates are still installed but pool selection is automatic

Legacy mode (if your org hasn't migrated):

# Find available subscriptions
sudo subscription-manager list --available

# Attach by pool ID
sudo subscription-manager attach --pool=<pool-id>

# Or attach all available
sudo subscription-manager attach --auto

# List what's attached
sudo subscription-manager list --consumed

Check whether SCA is active on your account:

sudo subscription-manager status | grep "Content Access Mode"

---

Enabling Repositories

After registration, most repos are disabled by default. You opt in to what you need:

# List all available repos
sudo subscription-manager repos --list

# Enable commonly needed repos
sudo subscription-manager repos \
  --enable rhel-9-for-x86_64-baseos-rpms \
  --enable rhel-9-for-x86_64-appstream-rpms

# Enable extras (CodeReady Linux Builder — development tools)
sudo subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms

# For High Availability
sudo subscription-manager repos --enable rhel-ha-for-rhel-9-x86_64-rpms

# Check what's enabled
sudo subscription-manager repos --list-enabled
dnf repolist

EPEL on RHEL 9

EPEL (Extra Packages for Enterprise Linux) provides packages not in the official repos:

# Enable EPEL
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm -y
sudo dnf repolist epel

---

DNF: Package Management on RHEL 9

RHEL 9 uses DNF (replacing yum, though yum is aliased to dnf):

# Search and install
sudo dnf search nginx
sudo dnf install nginx -y

# Check package info and what repo it comes from
dnf info nginx

# List installed packages
dnf list installed | grep nginx

# Check for updates
sudo dnf check-update

# Apply security updates only
sudo dnf upgrade --security

# Show update history
dnf history
dnf history info <id>

# Roll back a transaction
sudo dnf history undo <id>

DNF Module Streams

RHEL 9 uses module streams to provide multiple versions of the same software:

# List available module streams
dnf module list

# Enable a specific stream (e.g., Node.js 20)
sudo dnf module enable nodejs:20
sudo dnf install nodejs

# Reset a module stream
sudo dnf module reset nodejs

---

Air-Gapped / Offline Environments

For networks without internet access, you have two options: Red Hat Satellite (enterprise) or a local DNF repo mirror.

Option A: DNF Offline Plugin (Simple)

On an internet-connected system, download packages:

# Install reposync
sudo dnf install yum-utils -y

# Mirror a repo locally
sudo reposync \
  --repoid=rhel-9-for-x86_64-baseos-rpms \
  --download-path=/data/rhel9-mirror \
  --download-metadata

Serve it over HTTP (or NFS):

sudo dnf install httpd -y
sudo ln -s /data/rhel9-mirror /var/www/html/rhel9
sudo systemctl enable --now httpd

On offline systems, add a local repo:

cat > /etc/yum.repos.d/local-rhel9.repo << 'EOF'
[local-baseos]
name=RHEL 9 BaseOS Local Mirror
baseurl=http://<mirror-server>/rhel9/rhel-9-for-x86_64-baseos-rpms
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
EOF

Option B: Red Hat Satellite

Satellite is the enterprise solution for managing subscriptions, content views, and patch compliance across large RHEL fleets. It proxies all Red Hat content locally, provides lifecycle environments, and integrates with Ansible for remediation.

---

Subscription Compliance at Scale

For fleets, use activation keys to automate registration:

# Create activation key in the Customer Portal or Satellite
# Then register with it (no username/password needed)
sudo subscription-manager register \
  --org=<org-id> \
  --activationkey=production-rhel9-key

# Check compliance status across systems (via Satellite API or RHSM API)
curl -k -u admin:password \
  https://satellite.example.com/api/v2/hosts?search=subscription_status=invalid

For unregistering (decommissioning a VM):

# Unregister locally
sudo subscription-manager unregister
sudo subscription-manager clean

# Or remove from portal/Satellite remotely via API

---

Troubleshooting Common Issues

"This system is not registered" after you know it is:

sudo subscription-manager refresh
sudo dnf clean all
sudo dnf repolist

SSL certificate errors:

# Verify certificates are in place
ls /etc/pki/consumer/ /etc/pki/entitlement/
# Re-register if missing
sudo subscription-manager register --force

"No packages marked for update" despite known CVEs:

# Force metadata refresh
sudo dnf clean metadata
sudo dnf makecache
sudo dnf check-update

Repo enabled but packages not found:

# Check which repo provides a package
dnf provides */nginx
# Verify repo metadata
dnf repoinfo rhel-9-for-x86_64-appstream-rpms

---

Quick Reference

Task	Command
Register system	subscription-manager register --org=ID --activationkey=KEY
List available repos	subscription-manager repos --list
Enable repo	subscription-manager repos --enable <repo-id>
Install with DNF	dnf install <package>
Security updates only	dnf upgrade --security
Check subscription	subscription-manager status
Unregister	subscription-manager unregister

RHEL's subscription model rewards planning: set up activation keys, mirror content for offline environments, and use module streams to pin software versions. Once that infrastructure is in place, every new system registration is a single command.