Sharing Invitations regarding HTTPS and user experience: Are They Secure?

Plex Media Server Remote Access
1

Server Version#: 3.95.2
Player Version#: Uhhhh?

QUESTION: If I add a share user and I invite them to the system, will they have the same experience where their browser reports Not Secure? If so, how do we share with someone and give them the confidence that it’s okay to proceed?

CONTEXT:

Okay, so I’m running Webmin and Virtualmin on Ubuntu 16.04. Plex is installed.

I created a virtual server at media.mydomain.com and setup SSL through Let’s Encrypt. If I create content in the public_html folder for the site, I get a secured connection as expected. Now, if I want Apache to be a proxy for plex…

…I need to be able to use https://media.mydomain.com to fire up the plex web interface.

If I setup a re-direct to https://media.mydomain.com, naturally I get the SSL handshake error.

However, if I add the port 32400 to the end https://media.mydomain.com:32400 the Plex select user screen pops up and I can choose my user and login BUT in the browser it shows “Not Secure”.

Again, understandable because the certificate is issued by Plex Devices High Assurance CA2.

I just want to make sure I don’t have a high maintenance system here and that sharing a library of photos on my server is an easy process. I’m also not sure if using Plex is even a viable solution for sharing to a large number of people, but I don’t want to be duplicating photos, and I’d prefer to keep my media on my server, not Google’s, etc.

2

How about leaving the encryption to Plex?
There is already a system in place which generates a fully trusted, ‘pinned’ certificate, individual for your server. And since it’s a trusted cert, it is valid in all the different client devices.

You don’t need an own cert, you don’t need an own domain.
Just point your users to app.plex.tv and be done with it.

https://support.plex.tv/articles/206225077-how-to-use-secure-server-connections/

3

Makes sense. However, when I go to https://app.plex.tv and login, the URL shows Not Secure. Is that a product of my server’s setup?

Untitled

4

The lock in the browser only informs you how the web app was loaded. It has nothing to do with how the web app later communicates with the various Plex servers.

That it is shown as insecure in your browser is very curious. Because, we would hear about it, if this happened to more users. But I haven’t seen any reports about this so far. So I tend to blaming your setup.

Maybe you are using a security gateway which decrypts TLS traffic? This ususally makes all packets invalid, which are signed with a ‘pinned’ certificate.
Or maybe the root certificates of your browser are not up-to-date?