Remote access plex server mac mini

Plex Media Server Remote Access
1

Server Version#:
Player Version#:
<If providing server logs please do NOT turn on verbose logging, only debug logging should be enabled>Plex says no remote access, but remote access IS working - what’s going on?

2

Tons of possibilities, hard to tell without some more details…

could be…

  • your remote access setup isn’t working and Plex falling back to an indirect / relay connection (working but limited to 2 Mbps for Plex Pass users)
  • you’ve configured some custom URL for remote access (configuring a custom certificate pointing to that URL)
  • something in your setup blocking the connectivity check but not the actual remote connection
3

Server Version#: 1.43.4.10903-e5521bd8c (macOS 26.6.2, Mac mini)
Player Version#: Plex Web / Plex for iOS

Title: Stuck plex.direct certificate - tlsv1 alert unknown ca (macOS) - please reset

Remote access toggles between connected and disconnected. Port forwarding is
confirmed working - canyouseeme.org reports TCP 32400 open at the public IP,
and the router log confirms the virtual server rule (32400 → 192.168.0.115:32400 TCP).
Remote playback currently works, but only via Relay - direct connections fail.

Every HTTPS connection from outside fails the TLS handshake:

CERT: incomplete TLS handshake from [::ffff:44.207.218.81]:17014: tlsv1 alert unknown ca (SSL routines)
CERT: incomplete TLS handshake from [::ffff:34.202.97.122]:57568: tlsv1 alert unknown ca (SSL routines)

The server also cannot validate its own certificate:

HTTP error requesting GET https://109-255-66-57..plex.direct:32400/identity
(60, SSL certificate problem: unable to get local issuer certificate)

A full stop and restart re-installs a certificate (“Installed certificate with
fingerprint 49:51:d9:b7:…” / “Certificate will not expire soon”) but the
unknown ca errors resume immediately.

Machine identifier: d546397d1a9ab81a4f52345c71062953a67cfa8c

Could you please reset the certificate for this server?

4

Thanks - taking those in turn:

  1. Relay fallback: yes, that’s what’s happening, but it’s the symptom.
    The server authenticated to relay at 09:30:49 and remote playback is
    going through it. Direct connections are what’s failing.

  2. Custom URL / custom certificate: not configured. customConnections is
    empty and no custom certificate path, key or domain is set on this
    server. It’s using the standard plex.direct certificate.

  3. Something blocking the connectivity check but not the remote connection:
    nothing is blocking it. canyouseeme.org reports TCP 32400 open at the
    public IP, and Plex’s checkers do reach the server - they appear in the
    log and then abort at the TLS handshake:

    CERT: incomplete TLS handshake from [::ffff:44.207.218.81]:17014: tlsv1 alert unknown ca
    CERT: incomplete TLS handshake from [::ffff:34.202.97.122]:57568: tlsv1 alert unknown ca

    The connection arrives; the certificate is rejected. The server also
    can’t validate its own certificate when it tests its public URL:

    HTTP error requesting GET https://109-255-66-57..plex.direct:32400/identity
    (60, SSL certificate problem: unable to get local issuer certificate)

So direct remote access isn’t working either - relay is masking it. A full
stop and restart installs a fresh certificate and the unknown ca errors
resume immediately, which is why I’m asking for a certificate reset.

Machine identifier: d546397d1a9ab81a4f52345c71062953a67cfa8c

5

Try to reset the certificate yourself…

Stop plex, go to the folder in the path below and remove the certificate from the folder, *.p12, and restart plex so that it pulls down a new certificate.

/Users/<username>/Library/Caches/PlexMediaServer

6

Solved - and it was the certificate, as suspected.

Following the suggestion to reset it myself: I stopped Plex Media Server,
moved the .p12 file out of ~/Library/Caches/PlexMediaServer (moved rather
than deleted, so it was reversible), and restarted the server.

It pulled down a genuinely new certificate - the fingerprint changed from
49:51:d9:b7:29:f0:28:92… to 57:0a:a5:54:8a:bb:73:4f… Since the restart
there hasn’t been a single “tlsv1 alert unknown ca” or “unable to get local
issuer certificate” in the log, where before there were 18 in one log file.

Remote access went to Mapped and has stayed there. I’ve confirmed from
outside my network that the server now answers correctly over HTTPS on
its public address, so it’s direct connections again rather than relay.

Worth noting for anyone finding this later: an ordinary stop/start of the
server did NOT fix it - the stuck certificate survived restarts and was
re-installed unchanged. Removing the .p12 first is what forced a new one.
Also worth knowing that port checkers like canyouseeme.org will report
port 32400 open even while this is happening, because the fault is in the
TLS handshake, not the port. That sent me chasing my router for a good while.

Thanks very much for the pointer - much appreciated.