Remote access plex server mac mini

Plex Media Server Remote Access
7

@stefftomone your diagnosis is right and you don’t need Plex to reset anything — there is a workaround you can apply yourself today.

The problem is the type of certificate, not that particular certificate, which is why a full stop/restart re-installs one and the unknown ca errors resume immediately. Plex is currently issuing RSA *.plex.direct certs that chain YR1 -> ISRG Root YR with no cross-signed path, so anything validating strictly (OpenSSL/GnuTLS, plex.tv’s checker, and the server’s own self-check — exactly the “cannot validate its own certificate” line you posted) fails. Clients that chase the CA Issuers URI, like Apple’s stack, fetch the missing link and work, which is why relay/direct behaviour looks inconsistent across your devices.

Forcing an ECDSA certificate changes the chain to one that is cross-signed all the way to ISRG Root X1:

  1. Settings → Network → tick Strict TLS configuration (its description: “switches to ECDSA certificates when renewing”), Save.
  2. Quit Plex Media Server completely, then move the cached certificate aside:
mv ~/Library/Application\ Support/Plex\ Media\ Server/Cache/certificate.p12 \
   ~/Library/Application\ Support/Plex\ Media\ Server/Cache/certificate.p12.bak

(if PMS runs as a different user, use that account’s home directory)

  1. Start Plex again. The log should show CERT: Certificate did not exist, fetching a new one.
  2. Confirm you got the good chain:
openssl s_client -connect <server-ip>:32400 -servername <your>.plex.direct -showcerts </dev/null 2>/dev/null | grep -E '^ *[0-9] s:|^ *i:'

Good result — note ECDSA and the cross-signs:

 0 s:CN=*.<hash>.plex.direct            (ECDSA, NIST P-256)
   i:C=US, O=Let's Encrypt, CN=YE2
 1 s:C=US, O=Let's Encrypt, CN=YE2
   i:C=US, O=ISRG, CN=Root YE
 2 s:C=US, O=ISRG, CN=Root YE
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X2
 3 s:C=US, O=Internet Security Research Group, CN=ISRG Root X2
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X1

Mine went from Mapped - Not Published (Not Reachable) to green on the next probe, and the self-check error disappeared too.

Caveat: Strict TLS also disables legacy ciphers, so genuinely old clients may stop connecting — untick and repeat step 2 to revert.

Write-ups: Remote Access not reachable: plex.tv checker rejects our plex.direct cert (unknown ca) and @toddself’s deeper analysis of the missing trust roots (including that PMS’s own bundled cacert.pem lacks Root YR): https://forums.plex.tv/t/https-certs-are-missing-trust-roots/943238