Alright everyone, here’s my first how-to guide!
To perform the SSL decryption for Plex, we need to extract the embedded certificate. This certificate expires every year, so the procedure will need to be repeated from time to time.
We will be using a small helper script called “plex2pem” that runs on nodejs and forge. Don’t do this on your production Plex server. In this example, we’re running Plex on Ubuntu 16.04 LTS and the helper script is being run on Ubuntu 18.04 LTS.
Preparation
Download nodejs, npm, and node-forge:
apt install nodejs npm
npm install node-forge
Create a script plex2pem:
#! /usr/bin/env node
var forge = require('node-forge'),
crypto = require('crypto'),
fs = require('fs');
var file = fs.readFileSync(process.argv[2], { encoding: 'base64' });
var hash = crypto.createHash('sha512');
hash.update('plex');
hash.update(process.argv[3])
var pass = hash.digest('hex');
var p12Der = forge.util.decode64(file);
var p12Asn1 = forge.asn1.fromDer(p12Der);
var p12 = forge.pkcs12.pkcs12FromAsn1(p12Asn1, pass);
process.stdout.write(forge.pki.privateKeyToPem(p12.safeContents[1].safeBags[0].key));
process.stdout.write(forge.pki.certificateToPem(p12.safeContents[0].safeBags[0].cert));
Get the Plex certificate and ProcessedMachineIdentifier
The machine certificate is located in Library/Application Support/Plex Media Server/Cache/certificate.p12
The ProcessedMachineIdentifier is one of the values in the Preferences.xml file (Library/Application Support/Plex Media Server/Preferences.xml)
Transfer the certificate to the server on which you will be running the helper script. We use the ProcessedMachineIdentifier value to compute the private key.
Export the certificate
Example with node.js version:
node plex2pem certificate.p12 your_processed_machine_identifier
Spit the output into a .key file and a .crt file using your favourite text editor.
Create a new .pfx file using openssl:
openssl pkcs12 -export -out newcert.p12 -inkey key.key -in cert.crt
Enter Export Password: iloveplex
Verifying - Enter Export Password: iloveplex
