Hi,

We have non-production and production servers. When there are patches to apply, the non-production servers will apply the patches first. After the applications are tested OK, then the patches will apply to the production servers. Usually there are 2 to 3 weeks gap between the patches being applied to non-production servers and production servers.

The 2 to 3 weeks gap, there might be new development to the patches. If this situation arises, the patches applied to non-production and production might be different if the command "yum update".

In order to achieve consistency by applying the same patches and the dependencies in different time to the servers, is there a way or command to download the patches and dependencies, and then "yum update" from these downloaded patches and dependencies?

Have you thought about creating your own repo and then applying know good patches to it and let the production machine update itself from there?

Can be explore, is it difficuit to set up and how to go about it?

set up a local repo

cent even set up a wiki for people
( there is a link on the cent page
this IS in there
https://wiki.centos.org/HowTos/CreateLocalRepos

or
For RHEL

this is even IN the install guide in the docs that are available to everyone

With this setup, let's say I would like to have an update for openssl, do I have to find out all the dependencies for openssl and download the dependencies separately ? or Only download the openssl package and all dependencies are already included?

"yum" was invented to take care of dependencies

there has been no need to manually look for things for the last 8 years

This statement is both true and false at the same time.

True in the sense that as long as the dependencies are in a configured repo.
False in the sense that is the dependencies are not in the repo you need to find them.

So since the OP would be using his own repo he would need to ensure that all dependencies are within his repo.