There are two things to be aware of before you will see subscription-manager copy attached entitlement certs to the /etc/docker/certs.d/<registery_hostnames> directories....

1. Are the registry_hostnames that you are concerned about (redhat.com and redhat.io) included in the container_content.ContainerContentPlugin.conf configuration file?

[root@jsefler-7 ~]# cat /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf 
[main]
enabled = 1
registry_hostnames = registry.access.redhat.com,cdn.redhat.com,access.redhat.com

Note: The default configuration for registry_hostnames does NOT include redhat.com and redhat.io

2. Only entitlement certs that provides "containerimage" content will get copied to the /etc/docker/certs.d/<registery_hostnames> directories.

For example...
I have the following two entitlements attached to my system....
[root@jsefler-7 ~]# ls /etc/pki/entitlement/
2867554618564241832-key.pem  2867554618564241832.pem  8620967711851798975-key.pem  8620967711851798975.pem

But only one of them (2867554618564241832) has "containerimage" content as follows...

[root@jsefler-7 ~]# rct cat-cert /etc/pki/entitlement/2867554618564241832.pem | grep containerimage
	Type: containerimage
	Type: containerimage
	Type: containerimage
	Type: containerimage
	Type: containerimage
	Type: containerimage
[root@jsefler-7 ~]# rct cat-cert /etc/pki/entitlement/8620967711851798975.pem | grep containerimage
[root@jsefler-7 ~]# 

Hence only the entitlement and key with "containerimage" content is copied to all of the <registery_hostnames> directories...

[root@jsefler-7 ~]# ls /etc/docker/certs.d/registry.access.redhat.com
2867554618564241832.cert  2867554618564241832.key
[root@jsefler-7 ~]# ls /etc/docker/certs.d/cdn.redhat.com/
2867554618564241832.cert  2867554618564241832.key  redhat-entitlement-authority.crt
[root@jsefler-7 ~]# ls /etc/docker/certs.d/access.redhat.com
2867554618564241832.cert  2867554618564241832.key
[root@jsefler-7 ~]# 
[root@jsefler-7 ~]# ls /etc/docker/certs.d/redhat.io/
redhat-ca.crt
[root@jsefler-7 ~]# ls /etc/docker/certs.d/redhat.com/
redhat-ca.crt
[root@jsefler-7 ~]# 


In conclusion, I believe subscription-manager is working as designed and you need to decide if want to add a configuration workflow that appends redhat.com and redhat.io registry_hostnames in /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf.  Or do the defaults need to change in container_content.ContainerContentPlugin.conf?

John thank you, this is really helpful. In the case where we DO want the keys linked as you described, what would be the change process to make this true for all RHEL clients? Currently the RHMAP team is providing manual steps to link the certs but your way sounds more sustainable and more correct.

The mission here is to have a RHEL user acquire protected Red Hat content from our registry (registry.access.redhat.com / registry.redhat.io). A properly-entitled system can access, for example, Red Hat Mobile Application Platform (RHMAP). Container-wise, the rules should be the same. If they have an entitlement to this content, they should be able to use it from Docker as well.

Does that help clarify?

Be careful...  In comment 0 I see that docker is now providing these two directories:
/etc/docker/certs.d/redhat.io/
/etc/docker/certs.d/redhat.com/

If the new registries are registry.access.redhat.com and registry.redhat.io as Chris states in comment 5, then I think the directory names will need to be fully qualified and appended to the registery_hostnames in /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf as a fully qualified names.  Also make sure the proper CA cert is in the directories.

*** This bug has been marked as a duplicate of bug 1328729 ***

Commenting to resolve needifo.