Plex overwrites certificate.p12 on startup - unable to specify own SSL server certificate

Plex Media Server NAS & Devices
1

Dear,

I’m trying to replace the random generated certificate from Plex with my own certificate. I need this done because my Chrome browser returns an error :

_Your connection is not private

Attackers might be trying to steal your information from diskstation (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID_

I’m therefore unable to browse to my Plex server. Lowering the security of the browser (exception) is NOT an option.

I found the way to change the certificate by modifying the certificate present in the certificate.p12 like described in the following post:

However it seems that on startup, the Plex server regenerates a new certificate.p12 file.
How can we disable this and enable Plex to always use my own provided certificate?

Thibault

3

Thanks, finally it did work… However I had to specify the full chain of certs in the P12. Only the certificate was not enough and it did fallback to Plex provided cert.

1 Like
5

Apologies for bumping this old thread, but I had this exact issue today on Plex Server 1.13.2.5154 with a custom certificate from my LAN CA. Frustratingly, Plex provided extremely poor indication of what was wrong. Even with debug logging enabled, this is all it says:

Jun 24, 2018 10:45:33.138 [0x7f742a3ff700] DEBUG - CERT: Loaded a user-provided certificate.
Jun 24, 2018 10:45:33.138 [0x7f742a3ff700] WARN - CERT: Missing cert or issuer; skipping OCSP stapling

The “missing cert or issuer” is ambiguous and following it up with “Skipping OCSP stapling” is extremely misleading, since it implies that the certificate has been loaded successfully and will be used, albeit without OCSP stapling.

Worse, after properly constructing a chain certificate and configuring plex to use it, plex omits the “Loaded a user-provided certificate” notice and instead produces another similar ambiguous and useless error message, even though the certificate is now properly working (This was my fault, because apparently I changed my log level).

Annoyingly, after fixing the issue, plex still complains about the certificate and says it’s skipping OCSP. The “this worked” and “this failed” messages are rage-inducingly similar.

Jun 24, 2018 11:19:00.995 [0x7fd487fff700] WARN - CERT: getCertInfo failed; skipping OCSP stapling

I’m glad I found this post, because this has been an extraordinarily frustrating thing to troubleshoot. I realize that the majority of plex users likely won’t be installing custom certs and will instead be relying on the SSL shenanigans you guys have set up, but it would have been nice if the logs could have provided less-ambiguous error messages. Who the hell cares if plex isn’t checking the ocsp stapling of a cert if it’s not even successfully loading the cert in the first place? The latter is considerably more useful for troubleshooting.

In any case, issue was fixed by creating a chain cert with the entire trust chain in it and using that.