Description of problem:
The documentation around ISS says that the downstream satellite's credentials needs edit_organization permissions to download the certificate

Version-Release number of selected component (if applicable):
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/installing_satellite_server_in_a_disconnected_network_environment/index#configuring-server-to-synchronize-content-over-a-network_satellite

How reproducible:
Every time

Why is this OK and is there a workaround for customers that do not want to give downstream owners edit_organization permissions