In order to avoid issues around clock sku.. the start date on certificates should be the start date of the subscription. The entitlement start and end date should remain the same.
ommit 22c76f2c61e019ecba206e156e53077404a0de0a Author: Adrian Likins <alikins> Date: Fri Jan 21 11:07:40 2011 -0500 670831: use subscription start date for start of certs instead of entitlement date
[root@jsefler-betaqa-1 ~]# curl -u foo:bar -k https://subscriptions.rhn.webqa.redhat.com:443/subscription/status {"version":"0.1.34","result":true,"release":"1%{?dist}"}[root@jsefler-betaqa-1 ~]# [root@jsefler-betaqa-1 ~]# date Mon Feb 7 12:02:51 EST 2011 [root@jsefler-betaqa-1 ~]# subscription-manager register --username=jsefler-qabetauser-12 --password=***** 06579bb4-f019-4a0e-beab-a698df833dc2 jsefler-betaqa-1.usersys.redhat.com [root@jsefler-betaqa-1 ~]# subscription-manager unsubscribe --all [root@jsefler-betaqa-1 ~]# subscription-manager list --available +-------------------------------------------+ Available Subscriptions +-------------------------------------------+ ProductName: Red Hat Enterprise Linux Server Entitlement Beta for Certified Engineers and System Administrators - NOT FOR SALE ProductId: RH3036913 PoolId: 8a9b90882df297d5012df34b6b13010a Quantity: 10 Expires: 2011-08-02 [root@jsefler-betaqa-1 ~]# subscription-manager subscribe --pool=8a9b90882df297d5012df34b6b13010a [root@jsefler-betaqa-1 ~]# openssl x509 -text -in /etc/pki/entitlement/8129709843744685.pem | grep -A2 Validity Validity Not Before: Feb 3 05:00:00 2011 GMT Not After : Aug 3 03:59:59 2011 GMT [root@jsefler-betaqa-1 ~]# openssl x509 -text -in /etc/pki/entitlement/8129709843744685.pem | grep -A3 1.3.6.1.4.1.2312.9.4.6 1.3.6.1.4.1.2312.9.4.6: ..2011-02-03T05:00:00Z 1.3.6.1.4.1.2312.9.4.7: ..2011-08-03T03:59:59Z [root@jsefler-betaqa-1 ~]# [root@jsefler-betaqa-1 ~]# curl -u jsefler-qabetauser-12:redhat -k --request GET https://subscriptions.rhn.webqa.redhat.com:443/subscription/pools/8a9b90882df297d5012df34b6b13010a | json_reformat | grep Date "startDate": "2011-02-03T05:00:00.000+0000", "endDate": "2011-08-03T03:59:59.000+0000", VERIFIED.... The startDate in the certificate Validity date, entitlement oid, and the pool all match (2011-02-03T05:00:00.000+0000) and are not the same as the current time (Mon Feb 7 12:02:51 EST 2011) at which the certificate was created/subscribed. The endDate in the certificate Validity date, entitlement oid, and the pool all match (2011-08-03T03:59:59.000+0000).