The plex user (plex - or - whichever UID it runs as) needs to have READ permission to it. That’s all.
plex
Remember:
Cert, Key, and CA in the P12 file