Plex not using my SSL Certificate after v1.31.3.6868 (tried 1.32.1.6918 & 1.32.1.6999) on Server22

[SrRobot]

Server Version#: Version 1.32.1.6918 & 1.32.1.6999
Player Version#: Web clients (Firefox and Safari), iOS devices, Apple TV

I’ve been using plex the past few years (2018 or so) and it’s been a fantastic server to my media addiction/collection. This might be one of the first real issues i’ve found, hopefully someone can assist me with it.

So I’ve tried updating plex a few times in the past month (since v1.32.0.6918 became available in early april) on my Windows 2022 server, but every time it reboots/restarts the service Plex back up, i now get a plex.direct lets encrypt certificate, not mine. All of my settings are still there in the webui for my own pfx file, but the server is ignoring it.

I’ve tried removing the values in the webui, restarting the plex server service and rebooting the box entirely but any version over 1.31.3.6868 will present this letsencrypt certificate instead of mine. Any ideas? I’m going to downgrade again back to 1.31.3.6868. Hopefully this gets logged as a bug and fixed.

thx.

[SrRobot]

after rollback (nothing else modified) I get the correct cert

[FordGuy61]

@SrRobot

i now get a plex.direct lets encrypt certificate, not mine.

Maybe this? In Linux Tips but also applies to other platforms.

Linux Tips

OpenSSL v3.0.0 and PMS. For those using their own domains and certificates with PMS , PMS 1.32.0.6865 and above updates OpenSSL from v1.1.1 to v3.0.0 . (changed the numbering scheme in the process) The consequence of this is OpenSSL v3 removed several “less secure” encryption methods. The impact on you, if you’re using an older distributions where openssl v3 is not the default, if not already doing so, you will need pay special attention to how your certificates are generated As example…

[SrRobot]

@FordGuy61 thanks, I’ll try to regenerate the CSR and regenerate the cert to see if it helps. I appreciate the info.

[ndel88]

Hi

I had the same problem. I solved the problem by adding the parameters below when generating the pfx file with openssl:

-certpbe AES-256-CBC -keypbe AES-256-CBC -macalg SHA256

I find this solution on an internet forum

[SrRobot]

@FordGuy61 and @ndel88 thank you both! I just upgraded openssl and regenerated my csr, key etc and i’m good now on Version 1.32.1.6999. Much appreciated!