Hi Adrian,
Apologies for the delay in response; I was only just made aware of this post.
In RHEL9, the SHA-1 digest algorithm is deprecated. Under the default policy, use of SHA-1 in certificate signatures or package signature verification is disabled (or disallowed). If a remote repository or certificate chain uses SHA-1 signatures (e.g. older or third-party content), RHEL 9 will reject it unless you relax the cryptographic policy.
RHEL provides a mechanism to “enable SHA-1 support” (as a subpolicy) under the default policy. Specifically the DEFAULT:SHA1 configuration that you discovered allows SHA-1 usage for backward compatibility. However, this isn’t really recommended since it weakens your system’s cryptographic posture. Instead, we’d recommend contacting Red Hat for updated root certificates. The ideal solution is to obtain and install a new version of the Entitlement Master CA root certificate that is signed with a strong, enabled algorithm. This would typically involve updating your system’s trust store.
If Red Hat does not yet provide stronger certificates, you may need to discuss with your IT or security team about the risks and possible alternatives, but the official guidance is to avoid enabling SHA-1 unless absolutely necessary and only as a temporary measure while working toward a more secure solution
I’m hoping you did see our Support article about this. That said, you are correct that we should pull this info into our help docs, and I will raise a Jira issue for my team to do this! Thanks for pointing this out!
As an aside - if you ever find yourself with a similar challenge and are not getting responses here, make sure to use the “Ask Kapa” function here in the Community or in our Help site. That is our RAG AI tool and it ONLY uses our documentation (Support, Community, Help) when it generates answers. It can be really useful!