SSL Certificate Errors

[ogret]

I have the same issue with Samsung and LG Web OS, Server are not available but on Apple TV and Mobile works without any issue.
Error:
CERT: incomplete TLS handshake from IP:41266: sslv3 alert certificate expired

[BigWheel]

If you are only having issues with your Smart TV’s then it is likely this. Important information about Plex for smart TVs after September 30, 2021

[ChuckPa]

@redford_crawford_gmail_com

1. Cert reset
2. You may restart the server

[blueRazz]

Could you please check and see if mine needs to be reset?

Logs attached, seeing the same errors others are seeing - "Oct 20, 2021 18:12:04.919 [0x7f51d7ac5b38] DEBUG - CERT: incomplete TLS handshake from 71.12.40.94:51979: tlsv1 alert unknown ca"Plex Media Server Logs_2021-10-20_18-22-44.zip (5.3 MB)

The odd thing is the user has Allowed insecure connections, and the server is set to Prefer them. Two users, both on Samsung TVs using the built in app(I can also grab the logs from when the other user tested it if that’d help), both getting similiar playback errors with that same log entry referencing the TLS handshake failing.

[ChuckPa]

@blueRazz

1. I have reset your certificate for the current server.
2. While there, I took the liberty of cleaning up all the old duplicates; some 5+ years since last contact.

Please restart the server.

[enshittification]

Hi @ChuckPa ,
I am having the same issue as this

Important information about Plex for smart TVs after September 30, 2021

UPDATE: It appears that all Tizen-based Samsung sets are likely affected by the cert change and will thus need the app and server configured to allow insecure connections. On September 30, 2021, some older smart TVs (some Samsung, LG, Vizio, Hisense, and other unsupported TV platforms) will no longer be able to use secure connections to communicate with Plex Media Servers. These devices are no longer supported by their manufacturers, and won’t be receiving an update needed to continue making se…

and also

TLS connection from [::ffff:192.168.0.4]:58146 came in with unrecognized plex.direct SNI name ‘192-168-0-4.684b129a5f6f4c519b7e9f7282e16ed8.plex.direct’; using installed plex.direct cert

Should I also go for a cert refresh? How to do that.
I did a new install from scratch, nothing helps.
Thanks

Edit: Forgot to mention - users have Allowed insecure connections, and the server is set to Prefer them. both for local and remote streams.

[ChuckPa]

@enshittification

Your certificate is not impacted by the Sept 30 crossing.

Valid	Wed, 20 Oct 2021 22:01:23 +0000	Wed, 20 Oct 2021 22:01:34 +0000

The issue being experiened is possibly DNS rebinding protection interfering (a common cause). Have you the ability to add an exception?

(This is becoming common again as ISP’s update device firmwares)

[enshittification]

I did see that issue with Unraid server cert provisioning.
Unfortunately as I am using ISP Router, I don’t believe there is a setting to change.

But surprisingly never happened before. Is there a guide I can follow to check this or any alternates like via my own domain.

How long does a cert live? How can I refresh it in future?

Thanks for your help.

[ChuckPa]

when’s the last time you rebooted the whole “stack” (from modem/router → server’s computer – in sequence) ?

I had to do that here last week.

I would restart everything and then let’s re-evaluate.

[enshittification]

Router was rebooted about 3 days back and server just today, twice actually. as I redid the whole Unraid/Plex thing today.

My plex media is being imported now about 150Tb. Is it ok to restart in the middle?

Thanks

[ChuckPa]

I just kicked Zeus again,

Give him a restart.

[enshittification]

Thanks, on it.

[enshittification]

So, it is still there. This is the log generated. There are soo many other issues I have been fighting with and this is a brand new fresh install. Please help.

Oct 20, 2021 20:43:40.222 [0x1532213dcb38] INFO - Plex Media Server v1.24.4.5081-e362dc1ee - Docker Docker Container (LinuxServer.io) x86_64 - build: linux-x86_64 debian - GMT -04:00
Oct 20, 2021 20:43:40.222 [0x1532213dcb38] INFO - Linux version: 5.10.28-Unraid, language: en-US
Oct 20, 2021 20:43:40.222 [0x1532213dcb38] INFO - Processor Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz
Oct 20, 2021 20:43:40.222 [0x1532213dcb38] INFO - Compiler is - Clang 11.0.1 (https://plex.tv e0c29d5827bc4eaaa2ceb882cbeed224b0960173)
Oct 20, 2021 20:43:40.222 [0x1532213dcb38] INFO - /usr/lib/plexmediaserver/Plex Media Server
Oct 20, 2021 20:43:42.096 [0x153224a156e8] INFO - [CERT/OCSP] Successfully retrieved response from cache.
Oct 20, 2021 20:43:42.138 [0x15321f828b38] WARN - Couldn’t determine bundle identifier for plug-in at: “/usr/lib/plexmediaserver/Resources/Plug-ins-e362dc1ee/WebClient.bundle”
Oct 20, 2021 20:43:42.218 [0x15321fa30b38] WARN - Crash: Crash reporting disabled
Oct 20, 2021 20:43:42.888 [0x15321f9c7b38] WARN - [MediaProviderManager] Unrecognized MediaProvider feature: availability
Oct 20, 2021 20:43:42.888 [0x15321f9c7b38] WARN - [MediaProviderManager] Unrecognized MediaProvider feature: availability-platforms
Oct 20, 2021 20:43:42.891 [0x15321fbb3b38] WARN - [MediaProviderManager] Unrecognized MediaProvider feature: availability
Oct 20, 2021 20:43:42.891 [0x15321fbb3b38] WARN - [MediaProviderManager] Unrecognized MediaProvider feature: availability-platforms
Oct 20, 2021 20:43:44.538 [0x15321f828b38] INFO - Refreshing paths watched by LibraryUpdateManager
Oct 20, 2021 20:43:45.199 [0x15321fdf2b38] WARN - [EventSourceClient/pubsub] MyPlex: attempted a reachability check but we’re not yet mapped.
Oct 20, 2021 20:43:45.445 [0x15321f515b38] INFO - Sync: downloaded 0 sync list(s) with 0 sync items(s): 0 new, 0 updated, 0 deleted
Oct 20, 2021 20:43:45.445 [0x15321f584b38] WARN - Sync: local sync directory “/config/Library/Application Support/Plex Media Server/Cache/Transcode/Sync+” does not exist
Oct 20, 2021 20:52:45.974 [0x15321fe15b38] WARN - [CERT] TLS connection from 192.168.0.60:54551 came in with unrecognized plex.direct SNI name ‘192-168-0-4.6e31612c15ae4083ae4cf043b05c92ea.plex.direct’; using installed plex.direct cert
Oct 20, 2021 20:52:45.979 [0x15321fe15b38] WARN - [CERT] TLS connection from 192.168.0.1:56923 came in with unrecognized plex.direct SNI name ‘76-64-161-146.6e31612c15ae4083ae4cf043b05c92ea.plex.direct’; using installed plex.direct cert
Oct 20, 2021 20:52:48.166 [0x15321f06db38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.166 [0x15321f06db38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.218 [0x15321f06db38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.218 [0x15321f06db38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.442 [0x15321f9acb38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.442 [0x15321f9acb38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.442 [0x15321f9acb38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.478 [0x15321f9acb38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.479 [0x15321f9acb38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.479 [0x15321f9acb38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.659 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.659 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.660 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.699 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.699 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.699 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:48.822 [0x15321f04ab38] INFO - AutoUpdate: no updates available
Oct 20, 2021 20:52:49.307 [0x15321f04ab38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:49.307 [0x15321f04ab38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:49.307 [0x15321f04ab38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:49.345 [0x15321f04ab38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:49.345 [0x15321f04ab38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:49.345 [0x15321f04ab38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:59.988 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:52:59.988 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘libraryHubsOnly’ found, ignoring.
Oct 20, 2021 20:52:59.988 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:53:00.022 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:53:00.022 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘libraryHubsOnly’ found, ignoring.
Oct 20, 2021 20:53:00.022 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:53:00.315 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘libraryHubsOnly’ found, ignoring.
Oct 20, 2021 20:53:00.315 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:53:00.315 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:53:00.352 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘libraryHubsOnly’ found, ignoring.
Oct 20, 2021 20:53:00.352 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:53:00.352 [0x15321f0b0b38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:53:09.559 [0x15321f9acb38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:09.969 [0x15321f0b0b38] INFO - [Transcode/b9df58bfdc68639b-com-plexapp-android] CodecManager: starting EAE at “/tmp/pms-3a701433-61b7-4257-b9ef-34d7ccce6223/EasyAudioEncoder”
Oct 20, 2021 20:53:18.769 [0x15321f0b0b38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:28.765 [0x15321f9acb38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:28.842 [0x15321f0b0b38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:30.846 [0x15321f9acb38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:33.844 [0x15321f3adb38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:34.419 [0x153220b93b38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:53.504 [0x15321f9acb38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:53.530 [0x15321f0b0b38] WARN - [Transcode/b9df58bfdc68639b-com-plexapp-android] Transcode runner appears to have died.
Oct 20, 2021 20:53:56.256 [0x15321f3adb38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:56.904 [0x15321f0b0b38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:58.716 [0x153220b93b38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:58.863 [0x15321f3adb38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:53:58.891 [0x15321f9acb38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:54:07.832 [0x15321f0b0b38] WARN - Caught exception trying to convert extra data attribute ‘originallyAvailableAt’ with type 1 and value ‘2021-07-23’ ~ bad lexical cast: source type value could not be interpreted as target
Oct 20, 2021 20:54:07.910 [0x15321f9acb38] WARN - [Transcode/b9df58bfdc68639b-com-plexapp-android] Transcode runner appears to have died.
Oct 20, 2021 20:54:10.188 [0x153220b93b38] WARN - QueryParser: Invalid field ‘libraryHubsOnly’ found, ignoring.
Oct 20, 2021 20:54:10.188 [0x153220b93b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:54:10.188 [0x153220b93b38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.
Oct 20, 2021 20:54:10.229 [0x153220b93b38] WARN - QueryParser: Invalid field ‘libraryHubsOnly’ found, ignoring.
Oct 20, 2021 20:54:10.230 [0x153220b93b38] WARN - QueryParser: Invalid field ‘pinnedContentDirectoryID’ found, ignoring.
Oct 20, 2021 20:54:10.230 [0x153220b93b38] WARN - QueryParser: Invalid field ‘contentDirectoryID’ found, ignoring.

[ChuckPa]

May I have the ZIP please rather than posting that snippet?

I hope DEBUG logging is enabled ? I can’t discern anything if it’s not.

[enshittification]

let me know what to do, i will provide the logs. I am not sure what all you need. Sorry.

Plex used to be effortless and smooth for over past 3 years and today with new install it is going crazy. I dont know what I did wrong.

Thanks for helping me.

[ChuckPa]

1. Settings - Server - General - Show Advanced

• DEBUG logging should be checked
• VERBOSE logging shoud be UNchecked
• SAVE if you make changes
• Restart the server if you make changes.

2. If no changes made above, or after a restart of PMS,

• Settings - Server - Troubleshooting - Download Logs
• It will give you a ZIP file
• Attach that here for me to look at please.

Query: Do you have your own certificate in use anywhere in the chain? (on the host?)

[ChuckPa]

Thank you for the logs. Now I can see what’s happening.

1. Your certificate is fine.

Oct 20, 2021 21:05:16.622 [0x154d8c2916e8] DEBUG - [CERT] Subject name is /CN=*.9259b38ba53b472ca819940893bbcfd7.plex.direct
Oct 20, 2021 21:05:16.622 [0x154d8c2916e8] DEBUG - [CERT] Installed certificate with fingerprint 69:41:f7:0a:98:65:50:02:9b:fe:64:05:39:90:9d:80:a6:4c:5c:f8.
Oct 20, 2021 21:05:16.622 [0x154d8c2916e8] DEBUG - [CERT/OCSP] Stapling requests will be made to 'http://r3.o.lencr.org/'.
Oct 20, 2021 21:05:16.622 [0x154d8c2916e8] INFO - [CERT/OCSP] Successfully retrieved response from cache.

2. The other devices are coming in with certificate compatibility problems

Oct 20, 2021 21:15:13.603 [0x154d8766eb38] WARN - [CERT] TLS connection from 192.168.0.23:41804 came in with unrecognized plex.direct SNI name '192-168-0-4.684b129a5f6f4c519b7e9f7282e16ed8.plex.direct'; using installed plex.direct cert
Oct 20, 2021 21:15:13.620 [0x154d87691b38] WARN - [CERT] TLS connection from 192.168.0.1:35084 came in with unrecognized plex.direct SNI name '76-64-161-146.684b129a5f6f4c519b7e9f7282e16ed8.plex.direct'; using installed plex.direct cert

• Local player at 192.168.0.23 has a problem
• Remote player at 76-64-161.192 also has a problem.

If you’ve set to preferred or allow them unauth, they will be ok.
PMS will always attempt secure

[enshittification]

But this was not the case before I installed from scratch.
Is there any solution to mitigate this. I do not want to keep unsecure connections on.

Also, I updated and reset the apps on both the clients before testing.
Local is LG WebOS TV and remote is android phone.

Also, earlier I saw errors for similar to this “Unable to find client profile for device; platform=webOS”

Cheers!

[ChuckPa]

Settings - Server - Network.

You can enter 192.168.0.23 on that line (allowed without auth) and this will go away.

Be very careful you do have any leading or trailing spaces (PMS is fussy).

PMS will talk to the player app (independent of whether a preset profile exists) and find out what it is capable of.

[enshittification]

I already have the whole network on that 192.168.0.0/24
Also, I can not do this for other remote clients for my family members. I just dont understand why these started coming.