Error "CDN loading error: access forbidden" while trying to enable Red Hat Satellite or Capsule specific repositories in Red Hat Satellite WebUI

Solution Verified - Updated 21 Aug 2026

Environment

Red Hat Satellite 6.16 or later

Issue

Why does enabling Red Hat Satellite Capsule 6.17 for RHEL 9 x86_64 (RPMs) or Red Hat Satellite Maintenance 6.17 for RHEL 9 x86_64 (RPMs) repositories fails with the following error:

    CDN loading error: access forbidden to https://cdn.redhat.com:443/content/dist/layered/rhel9/x86_64/sat-capsule/6.17/os/repodata/repomd.xml

   CDN loading error: access forbidden to https://cdn.redhat.com:443/content/dist/layered/rhel9/x86_64/sat-maintenance/6.17/os/repodata/repomd.xml

Unable to enable Red Hat Satellite Maintenance 6.19 for RHEL 9 x86_64 (RPMs) repository on the Red Hat Satellite 6. A similar error is observed in Satellite WEBUI:
```
CDN loading error: access forbidden to https://cdn.redhat.com/content/dist/layered/rhel9/x86_64/sat-maintenance/6.19/os/repodata/repomd.xml
```

Resolution

This issue was reported to the Red Hat Engineering team via Public Red Hat JIRA/Bugzilla This content is not included.SAT-34066, and was fixed in November/December 2025.
A similar issue was reported for 6.19 specific repositories as well and is currently being investigated by the Red Hat Engineering team via Public JIRA Content from redhat.atlassian.net is not included.SAT-48307.
In case of a recurrence, open a This content is not included.support case with the Red Hat Technical Support Team and attach the zip of the manifest file used by the affected Satellite Server after exporting it from This content is not included.Hybrid Cloud Console.

Workaround

Proceed further only after providing the manifest zip file to the This content is not included.Red Hat Technical support team, either via a new support case or on the JIRAContent from redhat.atlassian.net is not included.SAT-48307. Until the JIRAContent from redhat.atlassian.net is not included.SAT-48307 is fixed, the following steps can be performed as a workaround:
- Remove the Red Hat Satellite Infrastructuresubscriptions attached to the manifest file and add them back:
```
  1. Navigate to ** Red Hat Satellite Web UI -> Content -> Subscriptions

  2. Select the `Red Hat Satellite Infrastructure Subscription` and delete it.

  3. Click the `Add Subscriptions` button to re-add the `Red Hat Satellite Infrastructure Subscription`.
```
- If the issue persists, check whether the manifest contains any additional Red Hat Satellite subscriptions besides the Red Hat Satellite Infrastructure Subscription, regardless of the subscription type (for example, Red Hat Enterprise Linux for Virtual Datacenters with Satellite, Premium). If found, remove all such subscriptions from the manifest and add them again.
- If the issue persists, please create a new manifest, import it into the Satellite, and then try enabling the repository. For guidance on creating a manifest, you can refer to the following blog:This content is not included.How to create and use a Red Hat Satellite manifest

For more KB articles/solutions related to Red Hat Satellite 6.x Repository Issues, please refer to the Red Hat Satellite Consolidated Troubleshooting Article for Red Hat Satellite 6.x Repository Issues.

Diagnostic Steps

In the /var/log/foreman/production.log file on Red Hat Satellite 6, the following error is observed:

     Katello::Errors::SecurityViolation: CDN loading error: access forbidden to   https://cdn.redhat.com:443/content/dist/layered/rhel9/x86_64/sat-maintenance/6.17/os/repodata/repomd.xml

 Katello::Errors::SecurityViolation: CDN loading error: access forbidden to https://cdn.redhat.com:443/content/dist/layered/rhel9/x86_64/satellite/6.17/os/repodata/repomd.xml
                      
 Katello::Errors::SecurityViolation: CDN loading error: access forbidden<https://cdn.redhat.com:443/content/dist/layered/rhel9/x86_64/sat-maintenance/6.19/os/repodata/repomd.xml>

Extract the manifest and check whether the certificates in the manifest provide access to the required repository or not.

   # unzip manifest-xxx.zip
   # cd manifest-xxx
   # unzip consumer_export.zip
   # cd consumer_export/export/entitlement_certificates

   # wget --certificate 3972309415411480338.pem    https://cdn.redhat.com:443/content/dist/layered/rhel9/x86_64/satellite/6.17/os/repodata/repomd.xml --no-check-certificate
   HTTP ERROR response 403 Forbidden [https://cdn.redhat.com:443/content/dist/layered/rhel9/x86_64/satellite/6.17/os/repodata/repomd.xml]  <=== Error for Red Hat Satellite /Capsule repos

   # wget --certificate 2120119609365383010.pem https://cdn.redhat.com:443/content/dist/rhel8/8/x86_64/appstream/os/repodata/repomd.xml --no-check-certificate
   HTTP response 200 OK [https://cdn.redhat.com:443/content/dist/rhel8/8/x86_64/appstream/os/repodata/repomd.xml] <=== No errors for RHEL repos

SBR

SysMgmt

Product(s)

Red Hat Satellite

Category

Troubleshoot

Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.