Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Red Hat Vulnerability Management Certification Workflow Guide

Red Hat Software Certification 2025

For Use with Red Hat Software Certification

Red Hat Customer Content Services

Abstract

The Red Hat Vulnerability Management Workflow Guide provides an overview of the certification process for security partners who want to validate their vulnerability scanning solutions for compatibility with Red Hat container images and packages, ensuring accurate and consistent vulnerability assessment in a jointly supported customer environment.
Version 9.28 updated December 10, 2025.

Making open source more inclusive
Copy link

Red Hat is committed to replacing problematic language in our code and documentation. We are beginning with these four terms: master, slave, blacklist, and whitelist. Due to the enormity of this endeavor, these changes will be gradually implemented over upcoming releases. For more details on making our language more inclusive, see our CTO Chris Wright’s message.

Use this guide to certify and distribute your vulnerability scanning solution for compatibility with Red Hat published container images and packages, as part of the Red Hat Vulnerability Management Certification program.

Red Hat Vulnerability Management Certification is a collaboration with security partners to deliver more accurate and reliable vulnerability scanning results for Red Hat products and packages, particularly container images, including those built from Red Hat Universal Base Images (UBI).

By leveraging Red Hat’s comprehensive and evolving security data, certified partner solutions can reduce false positives and other discrepancies, providing customers with clearer insights into vulnerability risks and a more reliable security assessment process.

Certified products are listed in the Red Hat Ecosystem Catalog and promoted as Red Hat Certified Technologies.

1.2. Certification workflow
Copy link

Note

Red Hat recommends that you are a Red Hat Certified Engineer or hold equivalent experience before starting the certification process.

The following diagram gives an overview of the Vulnerability Management certification process.

Figure 1.1. The Vulnerability Management Certification workflow

This diagram gives an overview of the vulnerability management certification process

1.3. Getting help and giving feedback
Copy link

For any questions related to the Red Hat certification toolset, certification process, or procedure described in this documentation, refer to the KB Articles, Red Hat Customer Portal, and Red Hat Partner Connect.

Note

To receive Red Hat product assistance, it is necessary to have the required product entitlements or subscriptions, which may be separate from the partner program and certification program memberships.

Opening a support case

To open a support case, see How do I open and manage a support case?

To open a support case for any certification issue, complete the Support Case Form for Partner Acceleration Desk with special attention to the following fields:

  • From the Issue Category, select Product Certification.
  • From the Product field, select the required product.
  • From the Product Version field, select the version on which your product or application is being certified.
  • In the Problem Statement field, type a problem statement or issue or feedback using the following format:

{Partner Certification} (The Issue/Problem or Feedback)

  • Replace (The Issue/Problem or Feedback) with either the issue or problem faced in the certification process or Red Hat product or feedback on the certification toolset or documentation. 

    For example: {Partner Certification} Error occurred while submitting certification test results using the Red Hat Certification application.
Note

Red Hat recommends that you are a Red Hat Certified Engineer or hold equivalent experience before starting the certification process.

Chapter 2. Onboarding certification partners
Copy link

Use the Red Hat Partner Connect Portal to create a new account if you are a new partner, or use your existing Red Hat account if you are a current partner, to onboard with Red Hat for certifying your products.

2.1. Onboarding existing certification partners
Copy link

Prerequisites

You have an existing Red Hat account.

Procedure

  1. Log in to Red Hat Partner Connect.

  2. Enter your Red Hat login or email address and click Next.

    Then, use either of the following options:

    1. Log in with company single sign-on
    2. Log in with Red Hat account

  3. From the menu bar on the header, click your avatar to view the account details.

    1. If an account number is associated with your account, then log in to the Red Hat Partner Connect, to proceed with the certification process.

    2. If an account number is not associated with your account, then first contact the Red Hat global customer service team to raise a request for creating a new account number.

      After that, log in to the Red Hat Partner Connect to proceed with the certification process.

2.2. Onboarding new certification partners
Copy link

Creating a new Red Hat account is the first step in onboarding new certification partners.

  1. Access Red Hat Partner Connect and click Log in.
  2. Click Register for a Red Hat account.

  3. Enter the following details to create a new Red Hat account:

    1. Choose a Red Hat login and password.
Important

If your login ID is associated with multiple accounts, then do not use your contact email as the login ID as this can cause issues during login. Also, you cannot change your login ID once created.

  1. Enter your Personal information and Company information.

  2. Select Corporate for the Account Type field.

    If you have created a Corporate type account and require an account number, contact the Red Hat global customer service team.

Note

Ensure that you create a company account and not a personal account. The account created during this step is also used to sign in to the Red Hat Ecosystem Catalog when working with certification requests.

  1. Enter your Contact information.

  2. Click Create My Account.

    A new Red Hat account is created. Log in to the Red Hat Partner Connect, to proceed with the certification process.

Prerequisites

  • Join the Red Hat Partner Connect program.
  • Provide basic company information and details about the product you wish to certify, including product documentation, datasheets, and relevant resources.
  • Establish a support relationship with Red Hat. You can do this through the multi-vendor support network of TSANet or through a custom support agreement.
  • Ensure your product includes a valid software license that allows Red Hat to assess and certify it as part of the program.

Procedure

  1. Log in to the Red Hat Certification Portal.

  2. On the home page, click Open Certification.

    The system displays the Open a New Certification Case dialog.

  3. Click Next.

  4. Select an option from the Partner and Product list.

    If your product does not appear, create it by entering its name in the Product field. Then, select it.

  5. In the What kind of product is this? section, select Software.
  6. Click Next.
  7. Select Vulnerability Scanner under Which category best describes your product?
  8. In the Sub Category section, select Security.
  9. In the Product URL field, enter the partner product URL.
  10. Optional: Enter the Support URL and Specification URL.

  11. Click Next.

    Based on your inputs, the system creates a new product in the Partner Product list.

  12. Select Vulnerability Scanner from the Red Hat Certification list, and click Next.

  13. Review the certification case information and click Open.

    Note

    Fields marked with an asterisk (*) are mandatory.

After your certification case is created, you must complete the vulnerability scanning and verification phase.

Prerequisites

  • Establish a certification relationship with Red Hat.
  • Ensure your security product is ready to scan container images.
  • Confirm access to the Red Hat Container Registry.

Procedure

  1. Pull the required certification test-harness container images from the Red Hat Container Registry.

    Use the following certification test-harness images for vulnerability scanning. You are encouraged to use the latest supported versions of these images as listed in the Red Hat Container Catalog.

    Image 1:

    rhel9/python-312

    Image 2:

    openshift4/ose-console-rhel9

    Note

    Certification criteria are defined by Red Hat Product Security and Red Hat Partner Connect teams.

  2. Verify that the pulled images match the specified digests to ensure you are using the correct certified versions.
  3. Scan the test-harness images using the partner security product, without modifying or adjusting the scan output manually.
  4. Generate a vulnerability scan report in a machine-readable format, preferably CSV. The report must reflect actual product behavior and include all vulnerabilities and related component metadata.

  5. Ensure the report includes the following information for each identified vulnerability:

    • CVE identifier
    • Red Hat package name and version (with backport fix information, if applicable)
    • Red Hat security impact rating (Critical, Important, Moderate, Low)
    • Red Hat state (Fixed, Affected, or Not-Affected) and RHSA reference with URL if fixed
  6. Submit the complete vulnerability scan report to the Red Hat certification team through your Certification case.
  7. The Red Hat certification team will review the submitted results to ensure they meet baseline accuracy and formatting requirements. The review process may take between two to six weeks from the date of submission.
  8. After successful verification, Red Hat grants certification for your scanner product.

After Red Hat has verified and approved your submitted vulnerability scan results, the final steps of the certification process involve completing product-specific information and publishing the certified product.

5.1. Completing product information
Copy link

Procedure

  1. Log in to the Red Hat Certification portal.
  2. Click the existing certification.
  3. Click the product under the Partner Product section and navigate to the Properties tab.
  4. On the Properties tab, enter the required details, such as Detail Description, Short Description, Partner Product Logo, or Product Logo, and other details.

  5. Click Update.

    Note

    All the fields marked with an asterisk * are required and must be completed before you can proceed with the certification.

5.2. Certified product publication
Copy link

You are responsible for completing and submitting the product listing information. After review, Red Hat publishes the certified product in the Red Hat Ecosystem Catalog. Red Hat also issues the Red Hat Certified Technology logo, enabling you to promote your product as a Red Hat Certified Technology for Vulnerability Scanning.

Chapter 6. Certification status maintenance
Copy link

After you receive certification, you must maintain compliance with Red Hat’s certification requirements by re-certifying your product under the following conditions:

  • When a new major version of the certified product is released
  • When Red Hat updates the certification test-harness images (once per year)
Note

Red Hat provides appropriate partner communication when it makes updates to the certification test-harness images.

Providing feedback on Red Hat documentation
Copy link

We appreciate your feedback on our documentation. Let us know how we can improve it.

Submitting feedback through Jira (account required)

  1. Log in to the Jira website.
  2. Click Create in the top navigation bar.
  3. Enter a descriptive title in the Summary field.
  4. Enter your suggestion for improvement in the Description field. Include links to the relevant parts of the documentation.
  5. Click Create at the bottom of the dialogue.

Legal Notice
Copy link

Copyright © Red Hat.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
Node.js® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
The OpenStack® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top