I simply switched to using a “hybrid” approach:
- local clients access the server directly via the [local_ip].[pms_id].plex.direct-domain
- remote clients access the server via an NGINX reverse proxy that handles the SSL cert
Remote access on the server is turned off completely. I just have the NGINX domain configured as a custom server access URL in PMS.
Works like a charm and actually keeps some (the local) traffic off my reverse proxy.