Chapter 3. Creating an entitlement certificate and a client configuration RPM RHUI uses entitlement certificates to ensure that the client making requests on the repositories is authorized by the cloud provider to access those repositories. The entitlement certificate must be signed by the cloud provider's Certificate Authority (CA) Certificate. The CA Certificate is installed on the CDS as part of its configuration. 3.1. Creating a client entitlement certificate with the Red Hat Update Infrastructure Management Tool When Red Hat issues the original entitlement certificate, it grants access to the repositories you requested. When you create client entitlement certificates, you decide how to subdivide your clients and create a separate certificate for each one. Each certificate can then be used to create individual RPMs. Prerequisites The entitlement certificate must be signed by the cloud provider's CA Certificate. Procedure Navigate to the Red Hat Update Infrastructure Management Tool home screen: Press e to select create entitlement certificates and client configuration RPMs . Press e to select generate an entitlement certificate . Select which repositories to include in the entitlement certificate by typing the number of the repository at the prompt. Typing the number of a repository places an x to the name of that repository. Continue until all repositories you want to add have been checked. Important Include only repositories for a single RHEL version in a single entitlement. Adding repositories for multiple RHEL versions leads to an unusable yum configuration file. Press c at the prompt to confirm. Enter a name for the certificate. This name helps identify the certificate within the Red Hat Update Infrastructure Management Tool and generate the name of the certificate and key files. Enter a path to save the certificate. Leave the field blank to save it to the current working directory. Enter the number of days the certificate should be valid for. Leave the field blank for 365 days. The details of the repositories to be included in the certificate display. Press y at the prompt to confirm the information and create the entitlement certificate. Verification You will see a similar message if the entitlement certificate was created: 3.2. Creating a client entitlement certificate with the CLI When Red Hat issues the original entitlement certificate, it grants access to the repositories you requested. When you create client entitlement certificates, you decide how to subdivide your clients and create a separate certificate for each one. Each certificate can then be used to create individual RPMs. Prerequisites The entitlement certificate must be signed by the cloud provider's CA Certificate. Procedure Use the following command to create an entitlement certificate from the RHUI CLI: Note Use Red Hat repository labels, not IDs. To get a list of all labels, run the rhui-manager client labels command. If you include a protected custom repository in the certificate, use the repository's ID instead. Verification A similar message displays if you successfully created and entitlement certificate: 3.3. Verifying whether the client entitlement certificate is compliant with the FUTURE cryptographic policy You can verify which cryptographic policies your instance of RHUI is compliant with by checking the client entitlement certificate: Certificates that are generated by RHUI versions 3.1 to 4.0 are compliant with FIPS and DEFAULT cryptographic policies. Certificates that are generated by RHUI versions 4.1 and later are compliant with FIPS , DEFAULT and FUTURE cryptographic policy. Prerequisites Ensure that you know the location of the client entitlement certificate. The default location is /etc/pki/rhui/product/content.crt . Procedure In your client RPM, or on the machine where the RPM is installed, run the following command specifying the path where the client entitlement certificate is stored: Check the RSA key length: If the length is 2048 bits, then the client entitlement certificate is not compliant with the FUTURE policy. If the length is 4096 bits, then the client entitlement certificate is compliant with the FUTURE policy. Additional resources Creating a client entitlement certificate with the Red Hat Update Infrastructure Management Tool Creating a client entitlement certificate with the CLI 3.4. Changing the repository ID prefix in a client configuration RPM using the CLI When creating RPMs, you can either set a custom repository ID prefix or remove it entirely. By default, the prefix is rhui- . Procedure On the RHUA node, use the RHUI installer command to set or remove the prefix: Set a custom prefix: Remove the prefix entirely by using two quotation marks instead of the prefix. 3.5. Creating a client configuration RPM with the Red Hat Update Infrastructure Management Tool When Red Hat issues the original entitlement certificate, it grants access to the repositories you requested. When you create client entitlement certificates, you need to decide how to subdivide your clients and create a separate certificate for each one. You can then use each certificate to create individual RPMs for installation on the appropriate guest images. Use this procedure to create RPMs with the RHUI Management Tool. Procedure Navigate to the Red Hat Update Infrastructure Management Tool home screen: Press e to select create entitlement certificates and client configuration RPMs . From the Client Entitlement Management screen, press c to select create a client configuration RPM from an entitlement certificate . Enter the full path of a local directory to save the configuration files to: Enter the name of the RPM. Enter the version of the configuration RPM. The default version is 2.0. Enter the release of the configuration RPM. The default release is 1. Enter the full path to the entitlement certificate authorizing the client to access specific repositories. Enter the full path to the private key for the entitlement certificate. Select any unprotected custom repositories to be included in the client configuration. Press c to confirm selections or ? for more commands. Verification A similar message displays if the RPM was successfully created: 3.6. Creating a client configuration RPM with the CLI When Red Hat issues the original entitlement certificate, it grants access to the repositories you requested. When you create client entitlement certificates, you need to decide how to subdivide your clients and create a separate certificate for each one. You can then use each certificate to create individual RPMs for installation on the appropriate guest images. Use this procedure to create RPMs with the CLI. Procedure Use the following command to create an RPM with the RHUI CLI: Note When using the CLI, you can also specify the URL of the proxy server to use with RHUI repositories, or you can use _none_ (including the underscores) to override any global yum settings on a client machine. To specify a proxy, use the --proxy parameter. Verification A similar message displays if you successfully created a client configuration RPM: 3.7. Typical client RPM workflow As a CCSP, you can offer various versions of Red Hat Enterprise Linux and a variety of layered products available on top of it. In addition to the Red Hat repositories that provide this content, you will need custom repositories to provide updates to client configuration RPMs for these Red Hat Enterprise Linux versions and layered products. You must create a custom repository for each Red Hat Enterprise Linux version and each layered product sold separately. For example, you will need separate custom repositories for the base Red Hat Enterprise Linux 8 offering and for SAP on Red Hat Enterprise Linux. These custom repositories will store the corresponding client configuration RPMs. Whenever you update these RPMs-for example, to add a new repository or to update an expiring certificate-you will upload newer versions to the corresponding custom repositories. It is good practice to sign all RPMs with a GPG key, ensuring that users are installing official packages from you that have not been tampered with. However, signing packages is outside the scope of RHUI, so you need to sign your client configuration RPMs using tools available in your company. To create the custom repository, you only need the public GPG key on the RHUA to configure it for use with the custom repository. Note that rhui-manager will automatically include the key in the client configuration RPM and use it for the custom repository in dnf configuration. Procedure In the following example, you will create a custom repository for the client configuration RPM for base Red Hat Enterprise Linux 8 on the x86_64 architecture: You can use a different repository ID and display name if desired, and ensure you specify the actual GPG key file. Add the relevant Red Hat repositories. The following YAML file contains the typical set of repositories for base Red Hat Enterprise Linux 8 on the x86_64 architecture, using unversioned repositories: To add and synchronize all these repositories using the YAML file above, run the following command: Create an entitlement certificate. You will need a list of repository labels that are to be allowed in the certificate. Repository labels are often identical to repository IDs, except when the repository ID contains a specific Red Hat Enterprise Linux minor version, in which case the label does not contain the minor version but only the major version. In the case of base Red Hat Enterprise Linux repositories, the IDs are identical, so you can extract them from the YAML file above, using the following Python code: Copy the output to the clipboard and store it as an environment variable; for example, USDlabels: In addition to the Red Hat Enterprise Linux repository labels, you also need to add the custom repository to the comma-separated list of labels when creating the entitlement certificate. Run the following command to create the entitlement certificate allowing access to both the Red Hat Enterprise Linux repositories and the custom repository: If your company's policy allows certificates to be valid for only one year, two years, etc., change the value of the --days argument accordingly. This command creates the files /root/rhel-8-x86_64.crt and /root/rhel-8-x86_64.key . You will need them in the step. Create a client configuration RPM: Use an RPM name or version of your choice. With the values above, the command creates the RPM and prints its location, which is: /tmp/rhui-client-rhel-8-x86_64-1.0/build/RPMS/noarch/rhui-client-rhel-8-x86_64-1.0-1.noarch.rpm Transfer this RPM from the RHUA to your system and sign it with the appropriate GPG key-the private key that corresponds to the public key that you used as the --gpg_public_keys parameter when you created the custom repository. You can then, for example, have the signed RPM preinstalled on Red Hat Enterprise Linux 8 x86_64 images in your cloud environment. You also need to transfer the signed RPM back to the RHUA and upload it to the custom repository for Red Hat Enterprise Linux 8 on x86_64: Verification Check the contents of the custom repository: This command is supposed to print the RPM file that you have uploaded. Once you have configured your CDS and HAProxy nodes, which is described later in this guide, you can also install the client configuration RPM on a test VM and verify access to all the relevant repositories by running the following command on the test VM: This command is supposed to print the configured Red Hat Enterprise Linux 8 repositories and the custom repository for client configuration RPMs. Updating the client configuration RPM When it is necessary to rebuild the client configuration RPM, increase the version number. If you used 1.0 in the invocation, use e.g. 2.0 now, and keep the rest of the parameters: Then, again, sign the newer RPM, transfer it to the RHUA, and upload it to the custom repository: Client VMs on which the version of the RPM is installed will now be able to update to the newer version. Note that it may be necessary to clean the dnf cache on the client VM to make dnf reload the repodata, which was updated when the newer RPM was uploaded. Note Do not combine x86_64 and ARM64 repositories in one entitlement certificate. The client configuration RPM created by rhui-manager using such a certificate would provide access to both architectures on the target client VM, which might cause conflicts. You would have to modify the rh-cloud.repo file and rebuild the RPM outside of rhui-manager . Note that, as long as you used --dir /tmp when creating the client configuration RPM, the artifacts are now stored in /tmp/rhui-client-rhel-8-x86_64-1.0/build/ . For detailed information about rebuilding RPMs, see Packaging and distributing software in the Red Hat Enterprise Linux documentation. Note It is currently impossible to make rhui-manager create the rh-cloud.repo file with certain repositories-for example, -debug and -source repositories-disabled by default. You would have to modify the rh-cloud.repo file and rebuild the RPM outside of rhui-manager . This issue is tracked in BZ#1772156 . Additional resources See also How to sign rpms with GPG for general information about package signing using basic tools.

Commands:
rhui-manager
Name of the certificate. This will be used as the name of the certificate file (name.crt) and its associated private key (name.key). Choose something that will help identify the products contained with it.
Repositories to be included in the entitlement certificate: Red Hat Repositories Red Hat Enterprise Linux 8 for ARM 64 - AppStream (Debug RPMs) from RHUI Red Hat Enterprise Linux 8 for ARM 64 - AppStream (RPMs) from RHUI Red Hat Enterprise Linux 8 for ARM 64 - AppStream (Source RPMs) from RHUI Proceed? (y/n)
..........................+++++ ....+++++ Entitlement certificate created at ./rhel8-for-rhui4.crt ------------------------------------------------------------------------------
rhui-manager client cert --repo_label rhel-8-for-x86_64-appstream-eus-rhui-source-rpms --name rhuiclientexample --days 365 --dir /root/clientcert .............................................+++++ ...............................................................................+++++ Entitlement certificate created at /root/clientcert/rhuiclientexample.crt
Entitlement certificate created at /root/clientcert/rhuiclientexample.crt
openssl x509 -noout -text -in /etc/pki/rhui/product/content.crt | grep bit
rhui-installer --rerun --client-repo-prefix CUSTOM_PREFIX
rhui-installer --rerun --client-repo-prefix ""
rhui-manager
Full path to local directory in which the client configuration files generated by this tool should be stored (if this directory does not exist, it will be created):
Successfully created client configuration RPM. Location: /tmp/clientrpmtest-2.0/build/RPMS/noarch/clientrpmtest-2.0-1.noarch.rpm
rhui-manager client rpm --entitlement_cert /root/clientcert/rhuiclientexample.crt --private_key /root/clientcert/rhuiclientexample.key --rpm_name clientrpmtest --dir /tmp --unprotected_repos unprotected_repo1 Successfully created client configuration RPM. Location: /tmp/clientrpmtest-2.0/build/RPMS/noarch/clientrpmtest-2.0-1.noarch.rpm
Successfully created client configuration RPM. Location: /tmp/clientrpmtest-2.0/build/RPMS/noarch/clientrpmtest-2.0-1.noarch.rpm
rhui-manager repo create_custom --protected --repo_id client-config-rhel-8-x86_64 --display_name "RHUI Client Configuration for RHEL 8 on x86_64" --gpg_public_keys /root/RPM-GPG-KEY-my-cloud
cat rhel-8-x86_64.yaml name: Red Hat Enterprise Linux 8 on x86_64 repo_ids: - codeready-builder-for-rhel-8-x86_64-rhui-debug-rpms-8 - codeready-builder-for-rhel-8-x86_64-rhui-rpms-8 - codeready-builder-for-rhel-8-x86_64-rhui-source-rpms-8 - rhel-8-for-x86_64-appstream-rhui-debug-rpms-8 - rhel-8-for-x86_64-appstream-rhui-rpms-8 - rhel-8-for-x86_64-appstream-rhui-source-rpms-8 - rhel-8-for-x86_64-baseos-rhui-debug-rpms-8 - rhel-8-for-x86_64-baseos-rhui-rpms-8 - rhel-8-for-x86_64-baseos-rhui-source-rpms-8 - rhel-8-for-x86_64-supplementary-rhui-debug-rpms-8 - rhel-8-for-x86_64-supplementary-rhui-rpms-8 - rhel-8-for-x86_64-supplementary-rhui-source-rpms-8
rhui-manager repo add_by_file --file rhel-8-x86_64.yaml --sync_now
import yaml with open("rhel-8-x86_64.yaml") as repoyaml: repodata = yaml.safe_load(repoyaml) print(",".join(repodata["repo_ids"]))
labels=<paste the contents of the clipboard here>
rhui-manager client cert --name rhel-8-x86_64 --dir /root --days 3650 --repo_label USDlabels,client-config-rhel-8-x86_64
rhui-manager client rpm --dir /tmp --rpm_name rhui-client-rhel-8-x86_64 --rpm_version 1.0 --entitlement_cert /root/rhel-8-x86_64.crt --private_key /root/rhel-8-x86_64.key
rhui-manager packages upload --repo_id client-config-rhel-8-x86_64 --packages /root/signed/rhui-client-rhel-8-x86_64-1.0-1.noarch.rpm
rhui-manager packages list --repo_id client-config-rhel-8-x86_64
yum -v repolist
rhui-manager client rpm --dir /tmp --rpm_name rhui-client-rhel-8-x86_64 --rpm_version 2.0
rhui-manager packages upload --repo_id client-config-rhel-8-x86_64 --packages /root/signed/rhui-client-rhel-8-x86_64-2.0-1.noarch.rpm