Register RHEL with Subscription Manager

Red Hat Enterprise Linux downloads updates and add-on content from Red Hat CDN repositories after the host is registered with Subscription Manager. On RHEL 10, Simple Content Access lets registered systems consume content available to the organization without attaching a subscription to each host.

RHEL 10 also supports registration with rhc connect, which can enable content access and Red Hat Lightspeed services together. This guide focuses specifically on the traditional subscription-manager workflow.

When you need Subscription Manager

You need registration when:

• A fresh RHEL install should pull packages from cdn.redhat.com instead of installation media only.
• dnf repolist shows no Red Hat CDN repos or reports subscription errors.
• You are building an RHCSA certification course or RHCE lab on official RHEL media.

Registration is not required on Rocky or AlmaLinux lab hosts that intentionally mirror upstream without a Red Hat subscription.

Prerequisites

• A Red Hat account with an active RHEL subscription. For a personal lab, the no-cost Red Hat Developer Subscription for Individuals is enough. The account and activation steps are covered in how to get RHEL for free. In an organization, use the subscription and credentials provided by your Red Hat administrator.
• Outbound HTTPS to the RHSM and CDN endpoints Red Hat requires (port 443), or a configured proxy documented below. Environments with hostname allowlists may also need Red Hat's documented Akamai CDN domains — see How to access RHSM through a firewall or proxy.
• Root or sudo on the RHEL host.

Confirm the OS major version before you register:

cat /etc/redhat-release

Red Hat Enterprise Linux release 10.2 (Coughlan)

Choose a registration method

RHEL 10 also provides rhc connect as Red Hat's simplified registration method. It can register the system for Red Hat content while optionally connecting Red Hat Lightspeed analytics and remote-management services. This article focuses on subscription-manager; see Registering RHEL with the RHC client for the current RHC workflow.

Check whether the system is already registered

Start with overall status:

sudo subscription-manager status

+-------------------------------------------+
   System Status Details
+-------------------------------------------+
Overall Status: Registered

On RHEL 10, Overall Status: Registered is the high-level signal that Subscription Manager considers the host registered. For the authoritative registration check, use identity:

subscription-manager identity

system identity: 2967b906-fcc1-451b-ad94-6129221e37a6
name: localhost.localdomain
org name: 20654856
org ID: 20654856

A valid system identity UUID and org ID confirm the host is registered to your organization.

subscription-manager list shows installed product certificates on the host. It describes which Red Hat products the system reports; it does not prove that a legacy entitlement is attached or that content is available under Simple Content Access.

List the Red Hat products identified on the installed system:

subscription-manager list

+-------------------------------------------+
    Installed Product Status
+-------------------------------------------+
Product Name: Red Hat Enterprise Linux for x86_64
Product ID:   479
Version:      10.2
Arch:         x86_64

On this lab host the system was already registered, so the steps below show what you run on a new install and how to verify success afterward.

Register with portal username and password

The interactive method prompts for credentials in your terminal. Run the command interactively so the password is read at the prompt and is not stored in shell history or scripts.

Use the same Red Hat login and password you use to sign in to the Red Hat Customer Portal or Hybrid Cloud Console. If you do not have an account, create one from the Red Hat account registration page.

sudo subscription-manager register

Sample output after a successful registration:

Registering to: subscription.rhsm.redhat.com:443/subscription
Username: your-portal-user
Password:
The system has been registered with ID: 2967b906-fcc1-451b-ad94-6129221e37a6

You can pass the username on the command line and still type the password only at the prompt:

sudo subscription-manager register --username your-portal-user

Do not put portal passwords in shell history, Kickstart %post scripts, or documentation. Prefer activation keys for automation.

Register with an activation key

Activation keys avoid storing your portal password on the host, which is why they are the right choice for Kickstart, image builds, and shared lab templates. Registering this way needs two values from the portal, and both appear on one page in the Red Hat Hybrid Cloud Console. Red Hat replaced the legacy access.redhat.com/management/activation_keys interface, so the old Customer Portal subscription pages no longer manage keys.

Open Services > System Configuration > Activation Keys in the console. This page shows your numeric Organization ID along with any existing activation keys. If you need a new key and have the required permissions, click Create activation key, give it a name that says what it is for, such as rhcsa-lab, set any system purpose or repository options your systems need, and click Create.

One detail catches people out here. The Key Name shown on the Activation Keys page is the value you pass to --activationkey. You do not need to look for a separate password or secret value to use with this command.

With both values in hand, register the host in one command:

sudo subscription-manager register --org YOUR_ORG_ID --activationkey YOUR_KEY_NAME

Sample output after a successful registration:

The system has been registered with ID: 62edc0f8-855b-4184-b1b8-72a9dc793b96

The returned ID is the system's identity in your organization, and subscription-manager identity confirms afterwards which organization the host joined. If the console shows an organization ID of 12345678 and a key named rhcsa-lab, the same command reads like this:

sudo subscription-manager register --org 12345678 --activationkey rhcsa-lab

Substitute your own organization ID and key name in those two positions. Because the key carries the entitlement decisions, no portal password appears in shell history, Kickstart %post blocks, or image build logs.

Confirm registration and refresh subscription data

After you register with either method above, confirm identity and refresh local RHSM data:

subscription-manager identity

A valid system identity UUID and matching org ID mean the host joined your organization.

sudo subscription-manager refresh

All local data refreshed

subscription-manager refresh updates local subscription and entitlement data from Red Hat. It does not rebuild DNF package metadata. RHEL 10 uses Simple Content Access — you do not attach a subscription or pool to an individual system after registration.

Configure a proxy in rhsm.conf

When the host must reach Red Hat through an HTTP proxy, edit /etc/rhsm/rhsm.conf under the [server] section:

proxy_hostname = proxy.example.com
proxy_port = 3128
proxy_user = proxyuser
proxy_password = proxypass
no_proxy = .example.com,localhost

Leave proxy_hostname and proxy_port empty when no proxy is required. An invalid value such as proxy_port =-1 causes errors like unable to connect to host:-1 on identity and repos subcommands — clear the port or set a real proxy port.

Hosts that must reach Red Hat directly for some destinations but use a proxy for others can set no_proxy in the same [server] section (comma-separated host suffixes or names). You can also persist the value with:

sudo subscription-manager config --server.no_proxy='.example.com,localhost'

For persistent proxy settings without editing the file by hand:

sudo subscription-manager config --server.proxy_hostname=proxy.example.com --server.proxy_port=3128

Verify what Subscription Manager will use — populated proxy_hostname and proxy_port lines confirm the settings took effect:

subscription-manager config --list

proxy_hostname = [proxy.example.com]
   proxy_port = [3128]

Register through a proxy for a single session with the register subcommand's --proxy flag (not the config option names):

sudo subscription-manager register --proxy=proxy.example.com:3128

Confirm CDN repositories in dnf

Once Subscription Manager enables CDN repos, dnf repolist should show BaseOS and AppStream for your major version — see the dnf command if you need to filter or inspect individual repos.

Enabled repositories should include BaseOS and AppStream for your major version:

sudo dnf repolist

repo id                           repo name
rhel-10-for-x86_64-appstream-rpms Red Hat Enterprise Linux 10 for x86_64 - AppStream (RPMs)
rhel-10-for-x86_64-baseos-rpms    Red Hat Enterprise Linux 10 for x86_64 - BaseOS (RPMs)

List repositories Subscription Manager knows about:

subscription-manager repos --list-enabled

Repo ID:   rhel-10-for-x86_64-baseos-rpms
Repo Name: Red Hat Enterprise Linux 10 for x86_64 - BaseOS (RPMs)
Enabled:   1

Repo ID:   rhel-10-for-x86_64-appstream-rpms
Repo Name: Red Hat Enterprise Linux 10 for x86_64 - AppStream (RPMs)
Enabled:   1

If dnf still reports no repos, see no enabled repos troubleshooting after subscription-manager identity succeeds and you have checked enabled repositories.

Enable and disable repositories

BaseOS and AppStream are required RHEL 10 content sets — keep them enabled. To reduce the enabled content set or test repository-dependent package availability, disable an optional repository such as CodeReady Linux Builder (confirm the exact repo ID on your system with subscription-manager repos --list):

sudo subscription-manager repos --disable codeready-builder-for-rhel-10-x86_64-rpms

Repository 'codeready-builder-for-rhel-10-x86_64-rpms' is disabled for this system.

Re-enable it when you need development packages again:

sudo subscription-manager repos --enable codeready-builder-for-rhel-10-x86_64-rpms

Repository 'codeready-builder-for-rhel-10-x86_64-rpms' is enabled for this system.

Wildcards work for families of repos (use carefully):

sudo subscription-manager repos --disable='*debug*'

After you change enabled repositories, refresh DNF metadata so dnf sees the updated redhat.repo file:

sudo dnf makecache

Updating Subscription Management repositories.
Metadata cache created.

Unregister from Subscription Manager

Unregister before you delete a VM or clone a golden image so the portal does not keep stale system profiles.

sudo subscription-manager unregister

Sample output:

Unregistering from: subscription.rhsm.redhat.com:443/subscription
System has been unregistered.

subscription-manager unregister removes the registration and locally deletes identity and subscription certificates. Use subscription-manager clean only when you also need to remove remaining local subscription, identity, and cached RHSM data before re-registering — for example after a failed registration or when troubleshooting a clone. clean does not reset proxy or other settings in /etc/rhsm/rhsm.conf.

sudo subscription-manager clean

You can also remove a system profile from the Hybrid Cloud Console if the host is already destroyed.

Troubleshooting

References

• Red Hat Subscription Management — official documentation
• Chapter 16: Registering your RHEL system — Subscription Manager procedure — RHEL 10 automatically installing RHEL guide (section 16.2)
• How to access RHSM through a firewall or proxy — required hostnames and Akamai CDN domains
• Red Hat Hybrid Cloud Console — system inventory and subscriptions
• Activation Keys — organization ID, plus creating the keys used with --activationkey
• Red Hat Developer account registration — no-cost Red Hat Developer Subscription for Individuals

Summary

Registering RHEL with subscription-manager connects the host to your organization under Simple Content Access. Check subscription-manager status and subscription-manager identity first — many lab VMs are already registered after install. For new systems, run register interactively (password at the prompt only) or use an activation key, taking both the organization ID and the key name from the Activation Keys page in the Hybrid Cloud Console.

After registration, run subscription-manager refresh to update local subscription data, confirm BaseOS and AppStream with dnf repolist, and use dnf makecache after you change enabled repositories. Optional repos such as CodeReady Linux Builder can be toggled with subscription-manager repos; you do not attach a pool per host on RHEL 10. Fix proxy settings in /etc/rhsm/rhsm.conf or with subscription-manager config when identity or repo commands fail with proxy errors.

Before you delete a VM, run subscription-manager unregister so portal inventory stays accurate. Use subscription-manager clean only when leftover local subscription, identity, or cached RHSM data blocks a clean re-registration. RHEL 10 also offers rhc connect as a simplified registration path; this article documents the subscription-manager workflow, which remains available when you specifically need the Subscription Manager client.