Custom domain with reverse proxy working, baseline domain doesn't

Plex Media Server Remote Access
1

Server Version#: 1.18.6.2348
Player Version#:

I enabled a p12 certificate for my baseline domain.net and for the reverse proxy plex.domain.net. In the plex server under network I configured the certificate path, the baseline domain, the password, and under customer server URLs all the possible URLs including the IP based.

The plex.domain.,net is accepted certificate wise by the browsers, the domain.net is not recognized with valid certificate (but was when the reverse proxy was not enabled). Obviously all URLs work aside of the certificate issue.

I wonder why the https://domain.net:32400 doesn’t work.

Thanks for inputs, Horia

2

to which domain does the proxy belong / forward as?

PMS does not tolerate MITM (man in the middle) cert hijacking.

3

The reverse proxy runs on the same synology server. Is actually enabled as part of their web applications.

The p12 certificate is proper for the main domain.net and also many subdomains including plex.domain.net (is generated from the main domain Let’s Encrypt certificate enabled on the server).

I don’t understand the MITM issue…Other services on domain.net work well this way (for example the SYNO DSM on both https://dsm.domain.net and https://domain.net:5001) so this behavior is surely from Plex.

Shall I understand it only accepts one domain, but then how does plex.domain.net (note, the reverse proxy is between 443 and 32400, hence URL is https://plex.domain.net work with network configured for domain.net and https://domain.net:32400 doesn’t?

Thanks, Horia

4

Just to be clear plex.domain.net:443 is fowarded to domain.net:32400 HTTPS. P12 is enabled for both names.

5

I am not the best person to be answering.
Certificates are not my strong suit but changing certs midstream, which it is what you appear to be doing (?) will be very problematic.

I assert this (please help me understand) because the originator domain & cert will expect PMS to understand it for the passthrough. The proxy nullifies this, doesn’t it?

AFAIK, the proxy will have a cert for external and then the singular cert which it uses for PMS. Having two certs in the proxy isn’t possible, is it?

I think we’re saying the same?

6

I don’t see a certificate challenge here… domain.net:32400 is reached directly, plex.domain.net:443 via proxy. The same certificate (the P12 for plex is generated from the synology) covers both DNS names, actually more like I said (and dsm.domain…net:443 via proxy works as well domain.net:5001 for the DSM management service in Synology).

To test: I removed the p12 certificate from plex’ network configuration, but left the certificate in synology system to cover the proxy name (plex.domain.net) and the proxy URL is functioning without problems. Still the baseline URL doesn’t work. In this case the browser sees the certificate from the proxy . The baseline URL https://domain.net:32400 hits directly plex and doesn’t work while there is no p12 certificate in plex for domain.net.

My network configuration in plex includes the path to p12, the key and domain.net as custom certificate domain. I re-enabled this config, but the direct access to plex still doesn’t work.

7

I see CERT: incomplete TLS handshake: short read in the logs when I try to access domain.net:32400.

What does this mean?

8

It means it wasn’t able to establish the socket because the two sides disagreed.
There was no data received.

9

I checked the certificate received in the browser. When accessing domain.net:32400 it was the certificate from PLEX: *.ab194b1a751a49e99c367f4cdc0390ca.plex.direct

It seems, the p12 config I added in plex network page is ignored? I am sure the p12 certificate is correct, the path to file, the file access rights, the key and the domain in plex matches the domain in cert.