# Remote access plex server mac mini **URL:** \ **Category:** Remote Access\ **Tags:** server-mac\ **Created:** [September 20, 2026, 8:30am UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103 "2026-09-20T08:30:15Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![stefftomone](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@stefftomone](https://forums.plex.tv/u/stefftomone)\ **Post date:** [September 20, 2026, 8:30am UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103/1 "2026-09-20T08:30:15Z")
Server Version#: Player Version#: \[Plex says no remote access, but remote access IS working - what’s going on?](https://forums.plex.tv/t/plex-says-no-remote-access-but-remote-access-is-working-whats-going-on/472369) ---
**Author:** ![tom80H](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/tom80h/32/19753_2.png) [@tom80H](https://forums.plex.tv/u/tom80H)\ **Post date:** [September 20, 2026, 8:46am UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103/2 "2026-09-20T08:46:04Z")
Tons of possibilities, hard to tell without some more details… could be… - your remote access setup isn’t working and Plex falling back to an indirect / [relay connection](https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/) (working but limited to 2 Mbps for Plex Pass users) - you’ve configured some custom URL for remote access (configuring a custom certificate pointing to that URL) - something in your setup blocking the connectivity check but not the actual remote connection ---
**Author:** ![stefftomone](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@stefftomone](https://forums.plex.tv/u/stefftomone)\ **Post date:** [September 20, 2026, 10:05am UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103/3 "2026-09-20T10:05:33Z")
Server Version#: 1.43.4.10903-e5521bd8c (macOS 26.6.2, Mac mini) Player Version#: Plex Web / Plex for iOS Title: Stuck plex.direct certificate - tlsv1 alert unknown ca (macOS) - please reset Remote access toggles between connected and disconnected. Port forwarding is confirmed working - [canyouseeme.org](http://canyouseeme.org) reports TCP 32400 open at the public IP, and the router log confirms the virtual server rule (32400 → 192.168.0.115:32400 TCP). Remote playback currently works, but only via Relay - direct connections fail. Every HTTPS connection from outside fails the TLS handshake: CERT: incomplete TLS handshake from [::ffff:44.207.218.81]:17014: tlsv1 alert unknown ca (SSL routines) CERT: incomplete TLS handshake from [::ffff:34.202.97.122]:57568: tlsv1 alert unknown ca (SSL routines) The server also cannot validate its own certificate: HTTP error requesting GET [https://109-255-66-57](https://109-255-66-57)..plex.direct:32400/identity (60, SSL certificate problem: unable to get local issuer certificate) A full stop and restart re-installs a certificate (“Installed certificate with fingerprint 49:51:d9:b7:…” / “Certificate will not expire soon”) but the unknown ca errors resume immediately. Machine identifier: d546397d1a9ab81a4f52345c71062953a67cfa8c Could you please reset the certificate for this server? ---
**Author:** ![stefftomone](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@stefftomone](https://forums.plex.tv/u/stefftomone)\ **Post date:** [September 20, 2026, 10:08am UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103/4 "2026-09-20T10:08:44Z")
> [@tom80H](#): > > could be… > > - your remote access setup isn’t working and Plex falling back to an indirect / [relay connection](https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/) (working but limited to 2 Mbps for Plex Pass users) > - you’ve configured some custom URL for remote access (configuring a custom certificate pointing to that URL) > - something in your setup blocking the connectivity check but not the actual remote connection Thanks - taking those in turn: 1. Relay fallback: yes, that’s what’s happening, but it’s the symptom. The server authenticated to relay at 09:30:49 and remote playback is going through it. Direct connections are what’s failing. 2. Custom URL / custom certificate: not configured. customConnections is empty and no custom certificate path, key or domain is set on this server. It’s using the standard plex.direct certificate. 3. Something blocking the connectivity check but not the remote connection: nothing is blocking it. [canyouseeme.org](http://canyouseeme.org) reports TCP 32400 open at the public IP, and Plex’s checkers do reach the server - they appear in the log and then abort at the TLS handshake: So direct remote access isn’t working either - relay is masking it. A full stop and restart installs a fresh certificate and the unknown ca errors resume immediately, which is why I’m asking for a certificate reset. Machine identifier: d546397d1a9ab81a4f52345c71062953a67cfa8c ---
**Author:** ![veeejay](https://avatars.discourse-cdn.com/v4/letter/v/9dc877/32.png) [@veeejay](https://forums.plex.tv/u/veeejay)\ **Post date:** [September 20, 2026, 11:10am UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103/5 "2026-09-20T11:10:37Z")
Try to reset the certificate yourself… Stop plex, go to the folder in the path below and remove the certificate from the folder, \*.p12, and restart plex so that it pulls down a new certificate. `/Users//Library/Caches/PlexMediaServer` ---
**Author:** ![stefftomone](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@stefftomone](https://forums.plex.tv/u/stefftomone)\ **Post date:** [September 20, 2026, 11:23am UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103/6 "2026-09-20T11:23:02Z")
Solved - and it was the certificate, as suspected. Following the suggestion to reset it myself: I stopped Plex Media Server, moved the .p12 file out of ~/Library/Caches/PlexMediaServer (moved rather than deleted, so it was reversible), and restarted the server. It pulled down a genuinely new certificate - the fingerprint changed from 49:51:d9:b7:29:f0:28:92… to 57:0a:a5:54:8a:bb:73:4f… Since the restart there hasn’t been a single “tlsv1 alert unknown ca” or “unable to get local issuer certificate” in the log, where before there were 18 in one log file. Remote access went to Mapped and has stayed there. I’ve confirmed from outside my network that the server now answers correctly over HTTPS on its public address, so it’s direct connections again rather than relay. Worth noting for anyone finding this later: an ordinary stop/start of the server did NOT fix it - the stuck certificate survived restarts and was re-installed unchanged. Removing the .p12 first is what forced a new one. Also worth knowing that port checkers like [canyouseeme.org](http://canyouseeme.org) will report port 32400 open even while this is happening, because the fault is in the TLS handshake, not the port. That sent me chasing my router for a good while. Thanks very much for the pointer - much appreciated. ---
**Author:** ![BeerMan81](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/beerman81/32/9435_2.png) [@BeerMan81](https://forums.plex.tv/u/BeerMan81)\ **Post date:** [September 26, 2026, 10:20pm UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103/7 "2026-09-26T22:20:49Z")
@stefftomone your diagnosis is right and you don’t need Plex to reset anything — there is a workaround you can apply yourself today. The problem is the _type_ of certificate, not that particular certificate, which is why a full stop/restart re-installs one and the `unknown ca` errors resume immediately. Plex is currently issuing RSA `*.plex.direct` certs that chain `YR1 -> ISRG Root YR` with no cross-signed path, so anything validating strictly (OpenSSL/GnuTLS, [plex.tv](http://plex.tv)’s checker, and the server’s own self-check — exactly the “cannot validate its own certificate” line you posted) fails. Clients that chase the `CA Issuers` URI, like Apple’s stack, fetch the missing link and work, which is why relay/direct behaviour looks inconsistent across your devices. Forcing an **ECDSA** certificate changes the chain to one that is cross-signed all the way to ISRG Root X1: 1. Settings → Network → tick **Strict TLS configuration** (its description: “switches to ECDSA certificates when renewing”), Save. 2. Quit Plex Media Server completely, then move the cached certificate aside: ```auto mv ~/Library/Application\ Support/Plex\ Media\ Server/Cache/certificate.p12 \ ~/Library/Application\ Support/Plex\ Media\ Server/Cache/certificate.p12.bak ``` (if PMS runs as a different user, use that account’s home directory) 1. Start Plex again. The log should show `CERT: Certificate did not exist, fetching a new one.` 2. Confirm you got the good chain: ```auto openssl s_client -connect :32400 -servername .plex.direct -showcerts /dev/null | grep -E '^ *[0-9] s:|^ *i:' ``` Good result — note ECDSA and the cross-signs: ```auto 0 s:CN=*..plex.direct (ECDSA, NIST P-256) i:C=US, O=Let's Encrypt, CN=YE2 1 s:C=US, O=Let's Encrypt, CN=YE2 i:C=US, O=ISRG, CN=Root YE 2 s:C=US, O=ISRG, CN=Root YE i:C=US, O=Internet Security Research Group, CN=ISRG Root X2 3 s:C=US, O=Internet Security Research Group, CN=ISRG Root X2 i:C=US, O=Internet Security Research Group, CN=ISRG Root X1 ``` Mine went from `Mapped - Not Published (Not Reachable)` to green on the next probe, and the self-check error disappeared too. Caveat: Strict TLS also disables legacy ciphers, so genuinely old clients may stop connecting — untick and repeat step 2 to revert. Write-ups: [Remote Access not reachable: plex.tv checker rejects our plex.direct cert (unknown ca)](https://forums.plex.tv/t/remote-access-not-reachable-plex-tv-checker-rejects-our-plex-direct-cert-unknown-ca/943493) and @toddself’s deeper analysis of the missing trust roots (including that PMS’s own bundled `cacert.pem` lacks Root YR): [https://forums.plex.tv/t/https-certs-are-missing-trust-roots/943238](https://forums.plex.tv/t/https-certs-are-missing-trust-roots/943238)