RCT(8)

📦 version 1.30.16, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

✨ rct — the RHSM Certificate Tool ✨

okay bestie, welcome to rct(8), aka the RHSM Certificate Tool 💅 this is the little icon that spills the tea on the certificates Red Hat Subscription Manager is out here using every day. we're talking entitlement certs, product certs, and identity certs. she reads them, she measures them, she tells you what's inside. no cap.

🌸 NAME 🌸

rct — shows you info (the headers) about a certificate, plus the size and stats of an entitlement, product, or identity certificate that Red Hat Subscription Manager uses. basically: she looks at the cert and tells you everything, fr fr. 🔍

🎀 SYNOPSIS 🎀

rct cat-cert [--no-content] [--no-products] /path/to/certificate.pem rct
stat-cert /path/to/certificate.pem rct cat-manifest [--no-content]
/path/to/consumer_export.zip rct dump-manifest  [--destination /path]
[--force] /path/to/consumer_export.zip

that's the whole vibe check right there. four commands, a couple of flags, and a path. slay. ✨

🦋 DESCRIPTION 🦋

so Red Hat Subscription Manager is out here using X.509 certificates to identify a bunch of stuff, and here's the breakdown bestie:

the identity certificate identifies a registered system
the product certificates identify the products installed on that system
the entitlement certificates identify the subscriptions attached to the system, and those include the available content repositories, products, and support levels

and the way that everything Subscription Manager needs is literally just sitting inside the body of the certificate. all of it. the whole personality. 👑

👑 COMMANDS 👑

`stat-cert`

prints the size of the certificate plus other deets about it. the precise details depend on what type of certificate you're checking, so like, the vibes vary by cert type. 💫

`cat-cert`

prints the info contained in the certificate itself — certificate headers, serial numbers, products, content sets, the whole crew. and there are two options, --no-content and --no-products, that shorten the output down to just header and descriptive info if you want the abridged version. 🙈

`cat-manifest`

prints the info contained in the subscription service manifest. the manifest is an archive of JSON files that hold all the subscription information for subscriptions allocated to the on-premise service. and the --no-content option can reduce the detail shown in the output if it's giving too much. ✨

`dump-manifest`

extracts the contents of the manifest archive. that's it, that's the job. 💅

💖 THE STAT-CERT COMMAND 💖

so rct is the tool you use to gather info about the already-issued certificates being used by Subscription Manager. the main reason for that? certificate sizes, for a number of reasons, impact content delivery service performance. yes really. size matters here. 😭

for large accounts and organizations, there can be a very large number of products and content sets available. older versions of entitlement certificates (version 1.0) used different (less efficient) DER encoding, so big amounts of information turn into very large certificates. (this is literally what caused timeouts or crashes when dealing with some content services. not cute.) newer entitlement certificate versions (version 3.0) use more efficient encoding on large content sets, resulting in smaller certificate content sizes and better service performance. glow up. 🦋

if there are problems with the content service timing out or returning errors, then the rct stat-cert command can be used to check the size and version of a given entitlement certificate quickly. she's fast. 💨

a large number of content sets is anything over 185 total sets. both the total number of content sets and the size of the DER encoding in the certificate could affect performance. so if you're over 185, that's the threshold bestie, keep an eye on it. 👀

🌈 OPTIONS 🌈

/path/to/cert.pem — gives the full path and filename to the PEM certificate for the given subscription, product, or system. this one is required, you cannot skip it, she needs the path. 🫶

⭐ EXAMPLES ⭐

the statistics for an entitlement certificate show both the DER size and the number of content sets, among other info:

Type (entitlement certificate)
Version (of the certificate style); newer versions will be 3.x, with better performance for handling large content sets
DER size, which gives the size of the certificate contents (not the size of the certificate file itself, okay, important distinction)
Key size, for the associated key file, in bytes
the total number of available content sets in the subscription

for example:

[root@server ~]# rct stat-cert /etc/pki/entitlement/2027912482659389239.pem
Type: Entitlement Certificate
Version: 1.0
DER size: 47555b
Subject Key ID size: 553b
Content sets: 100

while the size of the certificate is less of an issue for identity and product certificates (which are quite small), the stat-cert command can still be used to view the size and statistics of the certificates. she's versatile like that. 💅

for a product certificate, the stat-cert command shows:

Type (product certificate)
Version (of the certificate style)
DER size, which gives the size of the certificate contents (not the size of the certificate file itself)

for example:

[root@server ~]# rct stat-cert /etc/pki/product/69.pem
Type: Product Certificate
Version: 1.0
DER size: 1558b

for an identity certificate:

Type (identity certificate)
Version (of the certificate style)
DER size, which gives the size of the certificate contents (not the size of the certificate file itself)
Key size, for the associated key file, in bytes

for example:

[root@server ~]# rct stat-cert /etc/pki/consumer/cert.pem
Type: Identity Certificate
Version: 1.0
DER size: 1488b
Subject Key ID size: 20b

and that's the stat-cert situation bestie, more coming your way 💜

💖 THE CAT-CERT COMMAND 💖

okay so every certificate is basically carrying a whole info dump about whatever it's identifying — every single deet. and cat-cert is the command that shows you all of it in pretty-print form. slay. ✨

🎀 OPTIONS 🎀

/path/to/cert.pem — the full path and filename to the PEM certificate for whatever subscription, product, or system you're looking at. this one is required, no skipping it bestie 🫶
--no-content — gives you back all the certification info, order info, and product info, but drops every single Content section, which significantly cuts down how much stuff gets printed to stdout. this is for an entitlement certificate only.
--no-products — gives you back all the certification info, order info, and content (repository) info, but drops every single Product section, which significantly cuts down how much stuff gets printed to stdout. this is for an entitlement certificate only.
/path/to/cert.pem — the full path and filename to the PEM certificate for the given subscription, product, or system. (yes it's listed twice on the page, that's just the vibe, we don't gatekeep 💅)

🌸 OUTPUT 🌸

the command hands back the most basic info about the certificate — like its directory path, its serial number and subject name, and its validity period (start and end dates) — all tucked into the Certificate section:

Path — the filesystem location where the certificate is installed
Version — the certificate format version
Serial — the serial number for the certificate
Start/End Date — the validity period for the certificate
Alt Name — the subject alternative name, which uses the hostname of the system rather than the UUID (for identity certificates only)

the Subject DN of the certificate lives in the Subject section. 🦋

so for example, for the identity certificate:

[root@server ~]# rct cat-cert /etc/pki/consumer/cert.pem

+-------------------------------------------+
        Identity Certificate
+-------------------------------------------+

Certificate:
        Path: /etc/pki/consumer/cert.pem
        Version: 1.0
        Serial: 824613308750035399
        Start Date: 2012-11-09 16:20:22+00:00
        End Date: 2013-11-09 16:20:22+00:00
        Alt Name: server.example.com

Subject:
        CN: e94bc90e-44a1-4f8c-b6fc-0a3e9d6fac2b

a product certificate has extra stuff in a Product section, which defines the info for that specific installed product — its name, product version, and any yum tags used for it. like:

[root@server ~]# rct cat-cert /etc/pki/product/69.pem

+-------------------------------------------+
        Product Certificate
+-------------------------------------------+

Certificate:
        Path: /etc/pki/product/69.pem
        Version: 1.0
        Serial: 12750047592154746449
        Start Date: 2012-10-04 18:45:02+00:00
        End Date: 2032-09-29 18:45:02+00:00

Subject:
        CN: Red Hat Product ID [b4f7ac9e-b7ed-45fa-9dcc-323beb20e916]

Product:
        ID: 69
        Name: Red Hat Enterprise Linux Server
        Version: 6.4
        Arch: x86_64
        Tags: rhel-6,rhel-6-server

the entitlement certificate is where you get the MOST info, it's the main character fr. along with Certificate and Subject, it also has a Product section that defines the product group covered by the subscription. 👑

then it has an Order section that details everything about the purchase of the subscription — contract number, service level, total quantity, quantities assigned to the system, and other subscription details.

a subscription for a product covers the version you purchased and every previous version of the product. so if a subscription is bought for Red Hat Enterprise Linux 6.4, that subscription gives full access to all RHEL 6 repositories, plus access to all RHEL 5 repositories, and then other included product content repositories, like Subscription Asset Manager. every available content repository gets listed in a Content section that has the repository name, associated tags, its URL, and a notice on whether the yum repository is enabled by default. like:

[root@server ~]# rct cat-cert /etc/pki/entitlement/2027912482659389239.pem
+-------------------------------------------+
        Entitlement Certificate
+-------------------------------------------+

Certificate:
        Path: /etc/pki/entitlement/2027912482659389239.pem
        Version: 1.0
        Serial: 2027912482659389239
        Start Date: 2011-12-31 05:00:00+00:00
        End Date: 2012-12-31 04:59:59+00:00

Subject:
        CN: 8a99f9843adc8b8f013ae5f9de022b73

Product:
        ID: 69
        Name: Red Hat Enterprise Linux Server
        Version:
        Arch: x86_64,ia64,x86
        Tags:

Order:
        Name: Red Hat Enterprise Linux Server, Premium (8 sockets) (Up to 4 guests)
        Number: 2673502
        SKU: RH0103708
        Contract: 10011052
        Account: 5206751
        Service Level: Premium
        Service Type: L1-L3
        Quantity: 100
        Quantity Used: 1
        Socket Limit: 8
        Virt Limit:
        Virt Only: False
        Subscription:
        Stacking ID:
        Warning Period: 0
        Provides Management: 0

Content:
        Type: yum
        Name: Red Hat Enterprise Linux 6 Server (RPMs)
        Label: rhel-6-server-rpms
        Vendor: Red Hat
        URL: /content/dist/rhel/server/6/$releasever/$basearch/os
        GPG: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
        Enabled: True
        Expires: 86400
        Required Tags: rhel-6-server

🌈 THE CAT-MANIFEST COMMAND 🌈

so a subscription management service gets allocated a specific bloc of subscriptions that are available to an account, and that list of subscriptions is the manifest for the service. the cat-manifest command reads and prints the details of the manifest — creation date, system UUID and name, available products, subscription details, all of it. ✨

there are multiple JSON files in the archive, each identifying a different aspect of the subscription service and subscription configuration — like the general manifest properties, subscription info, content and repository info, and product info. it's giving organized 🎀

💜 OPTIONS 💜

--no-content — excludes all of the Content Sets sections, which significantly reduces the info printed to stdout.
/path/to/consumer_export.zip — gives the path and filename (by default, consumer_export.zip) for the manifest file on the local system. this is required. 🫶

⭐ EXAMPLES ⭐

the command pretty-prints all the details about the manifest itself and the allocated subscriptions, products, and content.

[root@server ~]# rct cat-manifest /tmp/consumer_export.zip
+-------------------------------------------+
                Manifest
+-------------------------------------------+
General:
    Server: candlepin
    Server Version: 1.3
    Date Created: 13 April 2013
    Creator: admin

Consumer:
    Name: server.example.com
    UUID:
    Content Access Mode: entitlement
    Type: system

Subscriptions:
    Name:                Red Hat Enterprise Linux
    Quantity:            249237
    Created:             12/01/2011
    Start Date:          01/01/2012
    End Date:            01/01/2022
    Service Level:       Premium
    Service Type:        Physical
    Architectures:       x86,x86_64
    SKU:                 SYS0395
    Contract:            12345678
    Order:               09876543
    Account:             abcd1234
    Entitlement File:    /etc/pki/entitlement/2027912482659389239.pem
    Certificate File:    /etc/pki/product/69.pem
    Certificate Version: 3

🧚 THE DUMP-MANIFEST COMMAND 🧚

okay so same deal — a subscription management service is allocated a specific bloc of subscriptions available to an account, that list is the manifest for the service. the cat-manifest command prints the contents of the manifest. (yes bestie that's literally what the page says, i'm not making it up 🙈)

💅 OPTIONS 💅

/path/to/consumer_export.zip — gives the path and filename (by default, consumer_export.zip) for the manifest file on the local system. this is required.
--destination=PATH — specifies an export directory to which to extract and save the contents of the manifest archive. if no destination is given, then the archive is extracted to the local directory.
--force, -f — overwrites any existing archive files. if a manifest archive already exists in the specified location (for example, if the manifest has already been dumped once), then trying to dump the manifest to the same location will fail. using --force forces the dump operation to complete and overwrites the previous file. 🔥

🌸 EXAMPLES 🌸

this command just extracts the manifest files to a given location (the working directory by default). the manifest itself contains multiple JSON files, with separate JSON files providing details on the manifest itself, each individual product, each individual subscription, and details for the specific, on-premise subscription management service.

for example:

[root@server ~]# rct dump-manifest --destination /export/archives/sam/manifest /tmp/consumer_export.zip
The manifest has been dumped to the /export/archives/sam/manifest directory.

🎀 FILES 🎀

Product certificates: /etc/pki/product/*.pem
Subscription certificates: etc/pki/entitlement/<serial#>.pem
System identity certificates: /etc/pki/consumer/cert.pem
The manifest: consumer_export.zip

💀 BUGS 💀

this tool is part of Red Hat Subscription Manager. to file bugs against this command-line tool, go to <https://bugzilla.redhat.com>, and select Red Hat > Red Hat Enterprise Linux > subscription-manager. go off bestie, report that bug 🫶

👑 AUTHORS 👑

okay so who actually made this iconic lil tool?? say thank u to the girlies and guys:

Deon Lackey <dlackey@redhat.com>
Michael Stead <mstead@redhat.com>
James Bowes <jbowes@redhat.com>

and fun fact bestie — the rct tool itself? written by James Bowes. main character energy fr 💅

📜 COPYRIGHT 📜

This is licensed under the GNU General Public License, version 2 (GPLv2). a copy of this license is available at:

http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt

ngl the GPL is the blueprint and we respect it, so go read the license if you wanna know your rights 🫶

and that's a wrap on the RCT(8) girlies!! 🌈✨ thank u for reading this whole thing, ur officially a cert-manifest scholar now 👑📜 this page is RCT(8) — section 8 of the manual, certified vintage (2012 vibes 💖), and it lives in the system's man pages where all the good stuff does. go forth and stat-cert responsibly bestie, mwah 💋🎀🦋

📦 where this page comes from

centos-stream 10: subscription-manager 1.30.16-1.el10 · GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later
centos-stream 9: subscription-manager 1.29.55-1.el9 · GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later
fedora 43: subscription-manager 1.30.5-5.fc43 · GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later
fedora 44: subscription-manager 1.30.5-6.fc44 · GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms