Server Version#: 1.42.2.10156
Player Version#: Web player and android 10.26.0.2578
Plex Pass user.
Remote access says it’s “Fully accessible outside your network”.
Let me start by saying that absolutely nothing changed on my side, same WAN provider, no change in public IP (dynamic) but in the same range) and to best of my abilities no change to GNAT. Same server version, same client version. No change to routing config on my router, still using and forwarding the same port.
I tried rebooting the QNAP NAS, disabling and enabling remote access. I also tried switching the secure connections setting from preferred to required. That didn’t help, only bricked it further when connecting locally through web player.
I also tried connecting remotely directly to my wan IP/web but that didn’t work. I saw somewhere this as a troubleshooting step to verify the port forwarding is working.
edit. I also tried renaming the certificate file to force a new download to no avail. I also checked if the port is open and accessible from outside and all good there as well.
Does anyone have any experience if there was any change made by Plex please? I’m at my wits end.
@Vojto the detail that stands out is “I also tried renaming the certificate file to force a new download to no avail” — that is expected right now, and it is worth checking whether you are hitting the certificate problem going around this week rather than anything to do with your port forwarding.
Plex is currently issuing RSA *.plex.direct certificates whose chain ends at ISRG Root YR, a new Let’s Encrypt root, with no cross-signed path. Clients that validate strictly (anything using OpenSSL/GnuTLS, including Plex’s own reachability checker) abort the handshake with tlsv1 alert unknown ca. Clients that chase the certificate’s CA Issuers URI — Apple, and Windows via Schannel — fetch the missing link and work fine. That asymmetry is why this shows up as “some things connect, some don’t” and why forcing a new certificate on its own changes nothing: you get another RSA cert with the same chain.
Check what your server is serving (from any machine that can reach the NAS):
The workaround that fixed it for me (1.43.4.10903) is to force an ECDSA certificate instead:
Settings → Network → tick Strict TLS configuration (“switches to ECDSA certificates when renewing”), Save.
Stop Plex, rename Cache/certificate.p12 in your Plex data folder, start Plex. On QNAP that is usually under /share/CACHEDEV1_DATA/.qpkg/PlexMediaServer/Library/Plex Media Server/Cache/ — adjust for your volume name.
Re-run the openssl command. A good chain looks like YE2 -> Root YE -> ISRG Root X2 -> ISRG Root X1, and Verify return code: 0 (ok) against a normal CA bundle.
Caveat: Strict TLS also disables legacy ciphers, so genuinely old client devices may stop connecting. Untick it and repeat step 2 to go back.
Also worth undoing your “Secure connections: Required” experiment if you have not already — with the certificate in this state it makes things worse, as you saw locally. Preferred is the right setting.
