# Remote access plex server mac mini **URL:** \ **Category:** Remote Access\ **Tags:** server-mac\ **Created:** [September 20, 2026, 8:30am UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103 "2026-09-20T08:30:15Z")\ **Posts on this page:** 1\ **Showing post:** 7
**Author:** ![BeerMan81](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/beerman81/32/9435_2.png) [@BeerMan81](https://forums.plex.tv/u/BeerMan81)\ **Post date:** [September 26, 2026, 10:20pm UTC](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103/7 "2026-09-26T22:20:49Z")
@stefftomone your diagnosis is right and you don’t need Plex to reset anything — there is a workaround you can apply yourself today. The problem is the _type_ of certificate, not that particular certificate, which is why a full stop/restart re-installs one and the `unknown ca` errors resume immediately. Plex is currently issuing RSA `*.plex.direct` certs that chain `YR1 -> ISRG Root YR` with no cross-signed path, so anything validating strictly (OpenSSL/GnuTLS, [plex.tv](http://plex.tv)’s checker, and the server’s own self-check — exactly the “cannot validate its own certificate” line you posted) fails. Clients that chase the `CA Issuers` URI, like Apple’s stack, fetch the missing link and work, which is why relay/direct behaviour looks inconsistent across your devices. Forcing an **ECDSA** certificate changes the chain to one that is cross-signed all the way to ISRG Root X1: 1. Settings → Network → tick **Strict TLS configuration** (its description: “switches to ECDSA certificates when renewing”), Save. 2. Quit Plex Media Server completely, then move the cached certificate aside: ```auto mv ~/Library/Application\ Support/Plex\ Media\ Server/Cache/certificate.p12 \ ~/Library/Application\ Support/Plex\ Media\ Server/Cache/certificate.p12.bak ``` (if PMS runs as a different user, use that account’s home directory) 1. Start Plex again. The log should show `CERT: Certificate did not exist, fetching a new one.` 2. Confirm you got the good chain: ```auto openssl s_client -connect :32400 -servername .plex.direct -showcerts /dev/null | grep -E '^ *[0-9] s:|^ *i:' ``` Good result — note ECDSA and the cross-signs: ```auto 0 s:CN=*..plex.direct (ECDSA, NIST P-256) i:C=US, O=Let's Encrypt, CN=YE2 1 s:C=US, O=Let's Encrypt, CN=YE2 i:C=US, O=ISRG, CN=Root YE 2 s:C=US, O=ISRG, CN=Root YE i:C=US, O=Internet Security Research Group, CN=ISRG Root X2 3 s:C=US, O=Internet Security Research Group, CN=ISRG Root X2 i:C=US, O=Internet Security Research Group, CN=ISRG Root X1 ``` Mine went from `Mapped - Not Published (Not Reachable)` to green on the next probe, and the self-check error disappeared too. Caveat: Strict TLS also disables legacy ciphers, so genuinely old clients may stop connecting — untick and repeat step 2 to revert. Write-ups: [Remote Access not reachable: plex.tv checker rejects our plex.direct cert (unknown ca)](https://forums.plex.tv/t/remote-access-not-reachable-plex-tv-checker-rejects-our-plex-direct-cert-unknown-ca/943493) and @toddself’s deeper analysis of the missing trust roots (including that PMS’s own bundled `cacert.pem` lacks Root YR): [https://forums.plex.tv/t/https-certs-are-missing-trust-roots/943238](https://forums.plex.tv/t/https-certs-are-missing-trust-roots/943238) --- _[View the full topic](https://forums.plex.tv/t/remote-access-plex-server-mac-mini/943103)._