I am trying to stand up a minimal RHEL 8 server on VMware Fusion with RHEL Developer creds. When I attempt to run the command:

subscription-manager register --username my_username --password my_password

I receive the following error:

Unable to verify server's identity: [SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] unsafe legace renegotiation disabled (_ssl.c:897)

I am assuming this is because my organization is performing SSL inspection and breaking the cert. I have gone to the config file "/etc/rhsm/rhsm.conf" and changed the insecure flag to "1" (which is supposed to disable certificate verification)

Not sure what I am doing wrong here. Any thoughts on what else I need to do to get this to go through??


You likely need to lower your system's crypto policy to LEGACY:

update-crypto-policies --set LEGACY

Consider creating your own policy to better match your environment.



What does curl -v https://subscription.rhsm.redhat.com/subscription/ --cacert /etc/rhsm/ca/redhat-uep.pem yield? If your org does TLS inspection as you say, try adding your MITM device's CA cert to RHSMs config:

  • Place the cert in /etc/rhsm/ca/your-org.pem
  • Set RHSM to use it (in /etc/rhsm/rhsm.conf):
repo_ca_cert = /etc/rhsm/ca/your-org.pem
  • I ran this command and rebooted the server but I am still getting the same error
    – Joe
    Nov 23 '21 at 18:38
  • Review the crypto policy settings. You should be able to activate insecure renegotiation with a custom policy.
    – fuero
    Nov 23 '21 at 18:42
  • I've updated my answer
    – fuero
    Nov 23 '21 at 18:55
  • Thanks for the update. I tried this but now I am getting an error that there is a self signed cert in the chain. Although I am pretty sure my org's cert is not self signed
    – Joe
    Nov 23 '21 at 22:47

It looks like your crypto-policy may be set to future. If you set it back to the default, you should be able to successfully register your RHEL 8 system.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.