Remote Access "Not reachable": TLS "unknown ca" error with plex.direct certificate

Plex Media Server
1

I’ve been trying to get Remote Access working on a new server for a couple of days. I’ve followed the troubleshooting article, but I’m stuck. I’ve set up literally a dozen Plex servers this year alone and never faced this problem, from Windows 11 to multiple flavors of Linux.

I even set Plex up on this exact machine with this exact OS (Debian 13) just last week with no problems. I wiped it and started over, and now there’s a problem.

  • Plex Media Server 1.43.4.10903, installed from the official apt repo.
  • Debian 13 on an Intel NUC, wired connection.
  • Router forwards an external port (TCP/UDP) to 32400 on the server’s local IP (tested working before).

Remote Access flashes green for a moment, then goes red (“Not reachable”). It’s done that on every attempt so far.

  • Checked the port forward (external port 32400, correct local IP).
  • Tried two different external ports.
  • Checked for double NAT: the router’s WAN IP matches my public IP, and it’s not a CGNAT address.
  • No firewall on the server, and MTU is the standard 1500.
  • Disabled and re-enabled Remote Access, signed out and re-claimed the server.
  • Rebooted the router and the server.
  • Fully uninstalled PMS (including its data folder) and reinstalled it as a fresh server. Same result.

I watched network traffic on the server while clicking Retry, and it looks like the connection from Plex’s side does reach the server. Right after that, the log shows…

CERT: incomplete TLS handshake from [::ffff:34.239.73.157]:1932: tlsv1 alert unknown ca (SSL routines)
MyPlex: mapping state set to 'Mapped - Not Published (Not Reachable)'.

I looked at the certificate the server hands out with openssl s_client, and this is what I got (I x’d out my server’s ID):

0 s:CN=*.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.plex.direct
  i:C=US, O=Let's Encrypt, CN=YR1
1 s:C=US, O=Let's Encrypt, CN=YR1
  i:C=US, O=ISRG, CN=Root YR
Verify return code: 20 (unable to get local issuer certificate)

The certificate was freshly issued after the reinstall, and it shows the same thing. From some searching, “Root YR” seems to be one of Let’s Encrypt’s newer roots. I also noticed my Debian machine’s certificate bundle (ca-certificates 20250419) has ISRG Root X1 and X2 but not YR. I have no idea whether that matters.

  • Is the “unknown ca” message something to worry about, or is it normal noise?
  • Is there something on my end that could make the connection fail at that step, even though it seems to reach the server?
  • Is anyone else seeing this with a recently issued certificate, or is it just me?
  • Are there other logs or checks I should look at?

Again, this same machine and same OS worked last week, and now after a format, nada. Happy to share full logs if that helps. Thank you!

2

Start by updating Debian’s Cert Store for root certs:

sudo apt update
sudo apt install --only-upgrade ca-certificates   
sudo update-ca-certificates

Next, notice [::ffff:34.239.73.157]. This says you have ipv6 enabled but it isn’t getting a Global IPV6 address. Your choices are to disable ipv6 or get ipv6 working, if you have it.

3

I know it’s a fresh install, but I’ve seen where some have been issued a cached/incorrect certificate and need to force plex to re-issue.

Stop plex, go to the Cache directory in the Plex Media Server folder, remove (don’t delete) the *.p12 file, and start plex back up. It should download a new cert.

4

@veeejay, that was it. Moved the .p12 file out of the cache folder and Plex downloaded a new certificate and Remote Access went green. New certificate’s chain now includes the link from ISRG Root YR back to ISRG Root X1, which I think was missing earlier.

@pl_5309 appreciate you jumping in as well, THANK YOU BOTH! This community is fast as hell…