Server Version#: 1.32.0.6918
Player Version#:Not relevant
After routine replacement of Plex certificate, now I cannot go to Plex Web without security warning:
Firefox detected a potential security threat and did not continue to mydomain.hopto.org because this website requires a secure connection.
Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for mydomain.hopto.org:32400. The certificate is only valid for *.ce33de5ba6144b9fa245aadff9cadfaa.plex.direct.
I have a script that was working for years, that updates LetsEncrypt cert for my Nginx proxy and then puts it in PKCS12 archive for Plex:
systemctl stop plexmediaserver.service
rm archive.pfx.old
mv archive.pfx archive.pfx.old
cp /etc/letsencrypt/live/mydomain.hopto.org/fullchain.pem /var/lib/plexmediaserver/
cp /etc/letsencrypt/live/mydomain.hopto.org/privkey.pem /var/lib/plexmediaserver/
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out archive.pfx -name "mydomain.hopto.org"
# since I run this script manually, here I input the PKCS12 file password, which is the same as configured in Plex->Server->Network tab
chown plex:plex archive.pfx
systemctl start plexmediaserver.service
rm /var/lib/plexmediaserver/fullchain.pem
rm /var/lib/plexmediaserver/privkey.pem
Now I see these relevant lines in ‘Plex Media Server.log’:
DEBUG - [CERT] Subject name is /CN=*.ce33de5ba6144b9fa245aadff9cadfaa.plex.direct
DEBUG - [CERT] Installed certificate with fingerprint e1:24:4a:cd:d5:bf:c8:91:b9:bb:2d:33:a6:54:c6:20:83:86:32:27.
DEBUG - [CERT/OCSP] Stapling requests will be made to ‘http://r3.o.lencr.org/’.
INFO - [CERT/OCSP] Successfully retrieved response from cache.
ERROR - [CERT] PKCS12_parse failed: error:11800071:PKCS12 routines::mac verify failure
ERROR - [CERT] Found a user-provided certificate, but couldn’t install it.
DEBUG - [CERT] Subject name is /CN=*.ce33de5ba6144b9fa245aadff9cadfaa.plex.direct
DEBUG - [CERT] Installed certificate with fingerprint e1:24:4a:cd:d5:bf:c8:91:b9:bb:2d:33:a6:54:c6:20:83:86:32:27.
DEBUG - [CERT/OCSP] Stapling requests will be made to ‘http://r3.o.lencr.org/’.
INFO - [CERT/OCSP] Successfully retrieved response from cache.
ERROR - [CERT] PKCS12_parse failed: error:11800071:PKCS12 routines::mac verify failure
ERROR - [CERT] Found a user-provided certificate, but couldn’t install it.
WARN - [CERT] MyPlex: Invalid connection URL ‘mydomain.hopto.org’.
