# Plex certificate error

**URL:** <https://forums.plex.tv/t/plex-certificate-error/837599>\
**Category:** Plex Media Server\
**Tags:** server-linux\
**Created:** [April 12, 2023, 7:39am UTC](https://forums.plex.tv/t/plex-certificate-error/837599 "2023-04-12T07:39:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![GritsanY](https://avatars.discourse-cdn.com/v4/letter/g/7cd45c/32.png) [@GritsanY](https://forums.plex.tv/u/GritsanY)\
**Post date:** [April 12, 2023, 7:39am UTC](https://forums.plex.tv/t/plex-certificate-error/837599/1 "2023-04-12T07:39:18Z")

</div>

Server Version#: 1.32.0.6918  
Player Version#:Not relevant

After routine replacement of Plex certificate, now I cannot go to Plex Web without security warning:

> Firefox detected a potential security threat and did not continue to [mydomain.hopto.org](http://mydomain.hopto.org) because this website requires a secure connection.

> Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for [mydomain.hopto.org:32400](http://mydomain.hopto.org:32400). The certificate is only valid for \*.ce33de5ba6144b9fa245aadff9cadfaa.plex.direct.

I have a script that was working for years, that updates LetsEncrypt cert for my Nginx proxy and then puts it in PKCS12 archive for Plex:

```auto
systemctl stop plexmediaserver.service
rm archive.pfx.old
mv archive.pfx archive.pfx.old
cp /etc/letsencrypt/live/mydomain.hopto.org/fullchain.pem /var/lib/plexmediaserver/
cp /etc/letsencrypt/live/mydomain.hopto.org/privkey.pem /var/lib/plexmediaserver/
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out archive.pfx -name "mydomain.hopto.org"
# since I run this script manually, here I input the PKCS12 file password, which is the same as configured in Plex->Server->Network tab
chown plex:plex archive.pfx
systemctl start plexmediaserver.service
rm /var/lib/plexmediaserver/fullchain.pem
rm /var/lib/plexmediaserver/privkey.pem

```

Now I see these relevant lines in ‘Plex Media Server.log’:

> DEBUG - [CERT] Subject name is /CN=\*.ce33de5ba6144b9fa245aadff9cadfaa.plex.direct  
> DEBUG - [CERT] Installed certificate with fingerprint e1:24:4a:cd:d5:bf:c8:91:b9:bb:2d:33:a6:54:c6:20:83:86:32:27.  
> DEBUG - [CERT/OCSP] Stapling requests will be made to ‘[http://r3.o.lencr.org/](http://r3.o.lencr.org/)’.  
> INFO - [CERT/OCSP] Successfully retrieved response from cache.  
> ERROR - [CERT] PKCS12\_parse failed: error:11800071:PKCS12 routines::mac verify failure  
> ERROR - [CERT] Found a user-provided certificate, but couldn’t install it.

> DEBUG - [CERT] Subject name is /CN=\*.ce33de5ba6144b9fa245aadff9cadfaa.plex.direct  
> DEBUG - [CERT] Installed certificate with fingerprint e1:24:4a:cd:d5:bf:c8:91:b9:bb:2d:33:a6:54:c6:20:83:86:32:27.  
> DEBUG - [CERT/OCSP] Stapling requests will be made to ‘[http://r3.o.lencr.org/](http://r3.o.lencr.org/)’.  
> INFO - [CERT/OCSP] Successfully retrieved response from cache.  
> ERROR - [CERT] PKCS12\_parse failed: error:11800071:PKCS12 routines::mac verify failure  
> ERROR - [CERT] Found a user-provided certificate, but couldn’t install it.  
> WARN - [CERT] MyPlex: Invalid connection URL ‘[mydomain.hopto.org](http://mydomain.hopto.org)’.

---

<div class="post-metadata">

**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\
**Post date:** [April 12, 2023, 8:27am UTC](https://forums.plex.tv/t/plex-certificate-error/837599/2 "2023-04-12T08:27:15Z")

</div>

> [@Linux Tips](https://forums.plex.tv/t/linux-tips/276247/25):
>
> OpenSSL v3.0.0 and PMS. For those using their own domains and certificates with PMS , PMS 1.32.0.6865 and above updates OpenSSL from v1.1.1 to v3.0.0 . (changed the numbering scheme in the process) The consequence of this is OpenSSL v3 removed several “less secure” encryption methods. The impact on you, if you’re using an older distributions where openssl v3 is not the default, if not already doing so, you will need pay special attention to how your certificates are generated As example,…

In the future, please search the forum first as this is widely discussed in several areas.

There are multiple existing threads

---

<div class="post-metadata">

**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\
**Post date:** [April 12, 2023, 8:27am UTC](https://forums.plex.tv/t/plex-certificate-error/837599/3 "2023-04-12T08:27:19Z")

</div>