Is it the same after running subscription-manager repos or dnf upload-profile on the host?
In /etc/pki/entitlement, if you run rct cat-cert on the .pem file for that product, is the content section missing? (see https://bugzilla.redhat.com/show_bug.cgi?id=1931027)