HTTPS certs are missing trust roots

Plex Media Server Remote Access
,
1

Server Version#: 11.43.4.10903-e5521bd8c
Player Version#: 4.16.

PMS serves an incomplete plex.direct certificate chain under Let’s Encrypt “Generation Y” (ISRG Root YR) — Remote Access permanently “Not Reachable”

Since my plex.direct wildcard certificate was renewed on 2026-09-20, it is issued under Let’s Encrypt’s new “Generation Y” hierarchy (Let's Encrypt YR2 → ISRG Root YR).

PMS serves only the leaf + the YR2 intermediate. It does not serve the cross-signed ISRG Root YR certificate (the one signed by the universally-trusted ISRG Root X1) that Let’s Encrypt publishes specifically for this transition.

ISRG Root YR is not yet in any shipping trust store — Let’s Encrypt lists it as “pending inclusion”. The result is that any client validating strictly (OpenSSL/GnuTLS, i.e. no AIA chasing) cannot build a path to a trusted root and aborts the handshake with unknown ca.

This includes Plex’s own reachability checker, so Remote Access is permanently stuck at Mapped - Not Published (Not Reachable) even though the port forward is open and verified reachable from the internet.
PMS version 1.43.4.10903-e5521bd8c
Platform Linux x86_64, plexinc/pms-docker:latest
Cert validity notBefore=Sep 20 10:01:11 2026 GMT / notAfter=Dec 19 10:01:10 2026 GMT
Remote Access manual port map, TCP/UDP 32400 → 32400, verified open externally

1. The served chain stops at an untrusted root

$ openssl s_client -connect 174-21-45-20.31564bb9326f4034a92f04c7a0f0016e.plex.direct:32400 \
    -servername 174-21-45-20.31564bb9326f4034a92f04c7a0f0016e.plex.direct -showcerts

 0 s:CN=*.31564bb9326f4034a92f04c7a0f0016e.plex.direct
   i:C=US, O=Let's Encrypt, CN=YR2
 1 s:C=US, O=Let's Encrypt, CN=YR2
   i:C=US, O=ISRG, CN=Root YR          <-- chain ends here; Root YR is not in trust stores
Verify return code: 20 (unable to get local issuer certificate)

Identical chain is served on the LAN path (192-168-1-3.<uuid>.plex.direct), so this is not a network/interception artifact.

2. Adding the published cross-sign resolves it — against the existing ISRG Root X1

Using the system trust store (which contains ISRG Root X1 and X2, but not Root YR):

# as served today
$ openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt -untrusted int-yr2.pem leaf.pem
error 20 at 1 depth lookup: unable to get local issuer certificate     FAIL

# with the cross-signed Root YR added to the chain (letsencrypt.org/certs/gen-y/root-yr-by-x1.pem)
$ openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt \
      -untrusted int-yr2.pem -untrusted root-yr-by-x1.pem leaf.pem
leaf.pem: OK                                                           PASS

# or by trusting the new root directly (letsencrypt.org/certs/gen-y/root-yr.pem)
$ openssl verify -CAfile root-yr.pem -untrusted int-yr2.pem leaf.pem
leaf.pem: OK                                                           PASS

So shipping the cross-signed Root YR in the served chain is sufficient and requires no trust-store changes anywhere.

3. Plex’s own infrastructure rejects the certificate

From Plex Media Server.log — note 34.202.97.122, which is Plex’s reachability checker:

CERT: incomplete TLS handshake from [::ffff:34.202.97.122]:31278: tlsv1 alert unknown ca (SSL routines)
[EventSourceClient/pubsub/pubsub04.pop.fmt.plex.bz:443] MyPlex: mapping state set to 'Mapped - Not Published (Not Reachable)'.

Many other clients on the network do the same:

CERT: incomplete TLS handshake from [::ffff:192.168.1.1]:48696:  tlsv1 alert unknown ca (SSL routines)
CERT: incomplete TLS handshake from [::ffff:192.168.1.240]:60744: tlsv1 alert unknown ca (SSL routines)
CERT: incomplete TLS handshake from 127.0.0.1:51768:              tlsv1 alert unknown ca (SSL routines)

4. Secondary issue: PMS’s bundled CA store also lacks Root YR

/usr/lib/plexmediaserver/Resources/cacert.pem (dated Aug 16 2026, 138 certificates) contains ISRG Root X1 but not ISRG Root YR. Because of this, PMS cannot validate its own certificate during the self-reachability check:

WARN - [HttpClient] HTTP error requesting GET https://174-21-45-20.<uuid>.plex.direct:32400/identity
       (60, SSL peer certificate or SSH remote key was not OK)
       (SSL certificate problem: unable to get local issuer certificate)
DEBUG - MyPlex: mapping state set to 'Mapped - Not Published'.

I confirmed this by appending root-yr.pem + root-yr-by-x1.pem to that bundle (140 certs) and restarting: the outbound self-check now returns http=200 ssl_verify=0 and the log error is gone. The inbound unknown ca rejections continue, because those depend on the chain PMS serves.

Impact

  • Remote Access is permanently unavailable; the UI reports the server as offline/indirect.
  • Strict-validating clients cannot connect over plex.direct at all.
  • LAN playback still works only because local clients fall back to plain HTTP (httpsRequired=0), which masks the problem for the owner while remote users are locked out.
  • Clients that perform AIA chasing (Apple, Windows/Schannel) can recover via the leaf’s CA Issuers - URI:``http://yr2.i.lencr.org/, which is likely why this is reported as intermittent/inconsistent across client platforms rather than a clean total failure.

Expected behaviour

PMS should serve the full chain for Gen-Y certificates:

leaf  *.<uuid>.plex.direct
  └─ Let's Encrypt YR2
       └─ ISRG Root YR  (cross-signed by ISRG Root X1)   <-- currently missing

References

2

Stop plex, remove the certificate.p12 file from the Cache directory in the Plex Media Server folder and start plex back up. It will download a new certificate, cert-v2.p12.

3

y’all that fixed it.

but man, what a stupid problem!