Server Version#: 11.43.4.10903-e5521bd8c
Player Version#: 4.16.
PMS serves an incomplete plex.direct certificate chain under Let’s Encrypt “Generation Y” (ISRG Root YR) — Remote Access permanently “Not Reachable”
Since my plex.direct wildcard certificate was renewed on 2026-09-20, it is issued under Let’s Encrypt’s new “Generation Y” hierarchy (Let's Encrypt YR2 → ISRG Root YR).
PMS serves only the leaf + the YR2 intermediate. It does not serve the cross-signed ISRG Root YR certificate (the one signed by the universally-trusted ISRG Root X1) that Let’s Encrypt publishes specifically for this transition.
ISRG Root YR is not yet in any shipping trust store — Let’s Encrypt lists it as “pending inclusion”. The result is that any client validating strictly (OpenSSL/GnuTLS, i.e. no AIA chasing) cannot build a path to a trusted root and aborts the handshake with unknown ca.
This includes Plex’s own reachability checker, so Remote Access is permanently stuck at Mapped - Not Published (Not Reachable) even though the port forward is open and verified reachable from the internet.
| PMS version | 1.43.4.10903-e5521bd8c |
|||
| Platform | Linux x86_64, plexinc/pms-docker:latest |
|||
| Cert validity | notBefore=Sep 20 10:01:11 2026 GMT / notAfter=Dec 19 10:01:10 2026 GMT |
|||
| Remote Access | manual port map, TCP/UDP 32400 → 32400, verified open externally |
1. The served chain stops at an untrusted root
$ openssl s_client -connect 174-21-45-20.31564bb9326f4034a92f04c7a0f0016e.plex.direct:32400 \
-servername 174-21-45-20.31564bb9326f4034a92f04c7a0f0016e.plex.direct -showcerts
0 s:CN=*.31564bb9326f4034a92f04c7a0f0016e.plex.direct
i:C=US, O=Let's Encrypt, CN=YR2
1 s:C=US, O=Let's Encrypt, CN=YR2
i:C=US, O=ISRG, CN=Root YR <-- chain ends here; Root YR is not in trust stores
Verify return code: 20 (unable to get local issuer certificate)
Identical chain is served on the LAN path (192-168-1-3.<uuid>.plex.direct), so this is not a network/interception artifact.
2. Adding the published cross-sign resolves it — against the existing ISRG Root X1
Using the system trust store (which contains ISRG Root X1 and X2, but not Root YR):
# as served today
$ openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt -untrusted int-yr2.pem leaf.pem
error 20 at 1 depth lookup: unable to get local issuer certificate FAIL
# with the cross-signed Root YR added to the chain (letsencrypt.org/certs/gen-y/root-yr-by-x1.pem)
$ openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt \
-untrusted int-yr2.pem -untrusted root-yr-by-x1.pem leaf.pem
leaf.pem: OK PASS
# or by trusting the new root directly (letsencrypt.org/certs/gen-y/root-yr.pem)
$ openssl verify -CAfile root-yr.pem -untrusted int-yr2.pem leaf.pem
leaf.pem: OK PASS
So shipping the cross-signed Root YR in the served chain is sufficient and requires no trust-store changes anywhere.
3. Plex’s own infrastructure rejects the certificate
From Plex Media Server.log — note 34.202.97.122, which is Plex’s reachability checker:
CERT: incomplete TLS handshake from [::ffff:34.202.97.122]:31278: tlsv1 alert unknown ca (SSL routines)
[EventSourceClient/pubsub/pubsub04.pop.fmt.plex.bz:443] MyPlex: mapping state set to 'Mapped - Not Published (Not Reachable)'.
Many other clients on the network do the same:
CERT: incomplete TLS handshake from [::ffff:192.168.1.1]:48696: tlsv1 alert unknown ca (SSL routines)
CERT: incomplete TLS handshake from [::ffff:192.168.1.240]:60744: tlsv1 alert unknown ca (SSL routines)
CERT: incomplete TLS handshake from 127.0.0.1:51768: tlsv1 alert unknown ca (SSL routines)
4. Secondary issue: PMS’s bundled CA store also lacks Root YR
/usr/lib/plexmediaserver/Resources/cacert.pem (dated Aug 16 2026, 138 certificates) contains ISRG Root X1 but not ISRG Root YR. Because of this, PMS cannot validate its own certificate during the self-reachability check:
WARN - [HttpClient] HTTP error requesting GET https://174-21-45-20.<uuid>.plex.direct:32400/identity
(60, SSL peer certificate or SSH remote key was not OK)
(SSL certificate problem: unable to get local issuer certificate)
DEBUG - MyPlex: mapping state set to 'Mapped - Not Published'.
I confirmed this by appending root-yr.pem + root-yr-by-x1.pem to that bundle (140 certs) and restarting: the outbound self-check now returns http=200 ssl_verify=0 and the log error is gone. The inbound unknown ca rejections continue, because those depend on the chain PMS serves.
Impact
- Remote Access is permanently unavailable; the UI reports the server as offline/indirect.
- Strict-validating clients cannot connect over
plex.directat all. - LAN playback still works only because local clients fall back to plain HTTP (
httpsRequired=0), which masks the problem for the owner while remote users are locked out. - Clients that perform AIA chasing (Apple, Windows/Schannel) can recover via the leaf’s
CA Issuers - URI:``http://yr2.i.lencr.org/, which is likely why this is reported as intermittent/inconsistent across client platforms rather than a clean total failure.
Expected behaviour
PMS should serve the full chain for Gen-Y certificates:
leaf *.<uuid>.plex.direct
└─ Let's Encrypt YR2
└─ ISRG Root YR (cross-signed by ISRG Root X1) <-- currently missing
References
- Let’s Encrypt, “New Generation Y Hierarchy of Root and Intermediate Certificates” — https://letsencrypt.org/2025/11/24/gen-y-hierarchy
- Let’s Encrypt, Chains of Trust — https://letsencrypt.org/certificates/
- Cross-signed root PEM — https://letsencrypt.org/certs/gen-y/root-yr-by-x1.pem
<If providing server logs please do NOT turn on verbose logging, only debug logging should be enabled>
