error 4294967283 on the macOS desktop client

Plex Players
1

Root cause found: bundled CA store predates Let’s Encrypt Generation Y roots

I’ve traced error 4294967283 on the macOS desktop client to a certificate validation failure, not a codec or player problem. Posting the full diagnosis since I think it explains the whole cluster of these reports since mid-May.

Setup

  • Server: Mac Studio (M1), PMS 1.43.x
  • Failing client: Mac mini (M4), macOS 26.5, Plex for Mac 1.112.0.359-0d79a49f
  • Working clients: Apple TV, iOS, Plex Web in Safari/Chrome on the same failing Mac

Symptom
Every item fails instantly with “An unknown error occurred (4294967283)”. Survives full uninstall, cache purge, and rollback to a five-month-old client build.

What the client log actually shows

ERROR - [MPVEngine/mpv] ffmpeg: tls: error:0A000086:SSL routines::certificate verify failed
ERROR - [MPVEngine/mpv] stream: Failed to open https://<ip-dashed>.<hash>.plex.direct:32400/video/:/transcode/universal/start...
ERROR - [MPVEngine] loading failed.
ERROR - [Web] [QTMedia] A critical error occurred: 4294967283

The 4294967283 is downstream noise. mpv/ffmpeg never opens the stream because TLS verification fails.

Why

My server’s plex.direct cert renewed on 21 July and came from Let’s Encrypt’s Generation Y hierarchy, which became the default issuance chain on 13 May 2026:

Verify return code: 20 (unable to get local issuer certificate)
 0 s:CN=*.<hash>.plex.direct
   i:C=US, O=Let's Encrypt, CN=YR2
 1 s:C=US, O=Let's Encrypt, CN=YR2
   i:C=US, O=ISRG, CN=Root YR

The server serves leaf + YR2 and stops. Let’s Encrypt’s documented default chain for YR2 is EE → YR2 → Root YR → ISRG Root X1, so the cross-signed Root YR certificate is missing from what PMS presents.

Meanwhile the client app ships its own CA store at:
/Applications/Plex.app/Contents/Frameworks/PlexMediaServer.framework/Versions/A/Resources/cacert.pem

which contains ISRG Root X1 and nothing from Generation Y:

subject=C=US, O=Internet Security Research Group, CN=ISRG Root X1

So ffmpeg has no path from YR2 to any trusted root. Browsers and Apple TV are unaffected because they fetch the missing intermediate over AIA; ffmpeg does not. The desktop app on the server machine also appears unaffected because it connects over loopback HTTP and never performs TLS validation at all — which is why this looks machine-specific and misleads diagnosis.

Confirmed workaround (client side)

curl -O https://letsencrypt.org/certs/gen-y/root-yr-by-x1.pem
CACERT="/Applications/Plex.app/Contents/Frameworks/PlexMediaServer.framework/Versions/A/Resources/cacert.pem"
sudo cp "$CACERT" "$CACERT.bak"
sudo tee -a "$CACERT" < root-yr-by-x1.pem > /dev/null

Quit Plex fully and relaunch. Playback works immediately. Note this uses the cross-signed Root YR rather than the self-signed root, so no new trust anchor is introduced — it terminates at ISRG Root X1, which the bundle already trusts. It will be wiped by the next app update.

Suggested fixes for Plex

  1. Refresh the bundled cacert.pem to include the Generation Y cross-signs, or better, have the desktop client use the platform trust store instead of a baked-in bundle.
  2. Have PMS serve the full default chain including the cross-signed Root YR, rather than stopping at YR2.

Either one alone resolves it. Happy to provide full logs.