Headless Plexamp using wrong url to connect to PMS

[jogolama]

Hi, I’m having trouble connecting from headless Plexamp to my PMS. My PMS Preferences.xml says that CertificateUUID=“3c03c2bbda3c42b080d8934dab6e6610”. In Plexamp logs I can see errors like:

WARNING - DEVICE: Server connection https://192-168-1-2.6b457c35a226490ead5df71e52754d01.plex.direct:32400 didn't work for plex: HTTP status -60

I have configured DNS so that *.plex.direct is going to my PMS on IP 192.168.1.2.
So I tried with curl to connect from Plexamp to PMS:

curl -v https://192-168-1-2.6b457c35a226490ead5df71e52754d01.plex.direct:32400
*   Trying 192.168.1.2:32400...
* Connected to 192-168-1-2.6b457c35a226490ead5df71e52754d01.plex.direct (192.168.1.2) port 32400 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=*.3c03c2bbda3c42b080d8934dab6e6610.plex.direct
*  start date: May 15 12:40:44 2023 GMT
*  expire date: Aug 13 12:40:43 2023 GMT
*  subjectAltName does not match 192-168-1-2.6b457c35a226490ead5df71e52754d01.plex.direct
* SSL: no alternative certificate subject name matches target host name '192-168-1-2.6b457c35a226490ead5df71e52754d01.plex.direct'
* Closing connection 0
* TLSv1.3 (OUT), TLS alert, close notify (256):
curl: (60) SSL: no alternative certificate subject name matches target host name '192-168-1-2.6b457c35a226490ead5df71e52754d01.plex.direct'
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

So obviously PMS certificate subject name contains 3c03c2bbda3c42b080d8934dab6e6610, but my Plexamp is using wrong url (with 6b457c35a226490ead5df71e52754d01). I tied to reinstall the Plexamp but the result is the same.

[ChuckPa]

@jogolama

WARNING - DEVICE: Server connection https://192-168-1-2.6b457c35a226490ead5df71e52754d01.plex.direct:32400 didn't work for plex: HTTP status -60

Do you have your own certificate involved?

Error 60 implies MITM (names are complete mismatch)

Your certificate log shows you got a new certificate yesterday followed by a new certificate today.

Did you restart the apps today so they could get the new certificate ?

Info:

Linux Tips

OpenSSL v3.0.0 and PMS. For those using their own domains and certificates with PMS , PMS 1.32.0.6865 and above updates OpenSSL from v1.1.1 to v3.0.0 . (changed the numbering scheme in the process) The consequence of this is OpenSSL v3 removed several “less secure” encryption methods. The impact on you, if you’re using an older distributions where openssl v3 is not the default, if not already doing so, you will need pay special attention to how your certificates are generated As example…

[jogolama]

I don’t have my own certificate.
I did restart both the applications and also the whole servers they are running on.
I can see the mismatch too.
Just don’t know why is plexamp using url *.6b457c35a226490ead5df71e52754d01.plex.direct to access PMS and not *. 3c03c2bbda3c42b080d8934dab6e6610.plex.direct.

[ChuckPa]

I don’t know or use plexamp. (I’m linux server-side).

I will move this thread to the plexamp side and ask some of that team to help.

[pshanew]

If you visit this URL you can see what your server is publishing as its contact URLs to Plex’s servers:
https://plex.tv/api/resources?includeIPv6=1&includeHttps=1&X-Plex-Token=your_plex_online_token

You can find your Plex token using the information in this article:
https://support.plex.tv/articles/204059436-finding-an-authentication-token-x-plex-token/

Plexamp will use the connection information published by your server. The information reported by the resources URL above will show which it should be using (it will likely match what’s shown in your Preferences.xml, but it won’t hurt to check).

And if you haven’t yet, you may want to try signing out of Plexamp and signing back in.

[jogolama]

Hi,
I checked the URL and I can see two entries there:

1. PMS which should be accessible by the *.3c03c2bbda3c42b080d8934dab6e6610.plex.direct
2. Plexamp running on my macos

What is missing is my headles plexamp running on raspbery pi. I tried to reinstall it, restart it, restart the raspberry, logout/login. But still can see in the plexamp logs that it’s using wrong URL to connect to PMS (*.6b457c35a226490ead5df71e52754d01.plex.direct).

So to sum up:

• why there is no entry for the headless plexamp in the xml
• why is plexamp using wrong address for PMS (*.6b457… instead of *.3c03).

Seems like it is using some kind of old configuration for old PMS which was removed. I tried to remove the entire plexamp directory. Is there some special file where it stores configuration. Or how does it get he url *.6b457…plex.direct ?

[pshanew]

Try this:

• Sign out of Plexamp and stop the service.
• Find ~/.local/share/Plexamp and rename it (don’t delete it).
• Find ~/.cache/Plexamp and rename it (don’t delete it).
• Run node ~/plexamp/js/index.js and claim your Plexamp. Replace the path to index.js if necessary. Also assumes you’re using the system node.js installation. Adjust as necessary.
• Start Plexamp.
• Log into Plexamp.

This should be equivalent to a fresh installation.

Edited to add the manual run to claim the Plexamp installation.

[elan]

@jogolama

I have configured DNS so that *.plex.direct is going to my PMS on IP 192.168.1.2

That seems like the root of all evil, why are you customizing DNS when the Plex DNS works?

[jogolama]

Renaming the settings directory helped. After that plexamp asked for new token at start. Now I don’t see any connection error in logs.

But still cannot play the audio. I guess it’s an issue with the usb dac. Unfortunately there is nothing in the logs. When selecting the audio device I can see that it persist ‘hw:1,0’ in the setting. But when testing with speaker-test I have to set the device to ‘plughw:1,0’. Any idea?

[pshanew]

I’m just a headphone jack scrub, so I likely can’t help much with the DAC. I have seen in the past where I had to disconnect from the Plexamp instance and reconnect, and/or stop and restart the service to get audio working.

Others may be of more help here, but it’s good that it’s at least connecting to your server now.

Edit: Perhaps test with something (speakers, headphones) connected to the headphone jack on the Pi, selecting the ‘bcm2835…’ audio device just to make sure everything is working at a basic level?