Server Version#: 1.43.3.10896-cb3ebc72d
Player Version#: N/A — server-side certificate issue, affects all clients.
Could someone from Plex staff please reset the stuck plex.direct certificate on my server?
@OttoKerner
Plex account: Will DM
Server name: Will DM if required.
Machine identifier: 2c82aef34aef4baefe99c0c85b6532dfe51a467e
Platform: Plex Media Server 1.43.3.10896 on macOS (Intel)
Symptom: Remote Access is stuck on “Not Reachable”. The reachability prober’s TLS handshake is rejected — PMS logs show:
CERT: incomplete TLS handshake from 34.202.97.122: tlsv1 alert unknown ca
The served certificate chains to Let’s Encrypt CN=YR2 → ISRG Root YR, not cross-signed to X1. Every plex.direct HTTPS connection fails the same way, including the server’s own loopback self-check:
SSL certificate problem: unable to get local issuer certificate
Already verified: real public IPv4 on the router’s WAN interface, no CGNAT. Port 32400 forwarded, and tcpdump on the server confirms external SYNs arriving and completing the TCP handshake normally before the TLS failure. An external port checker reports 32400 open. Plain HTTP works on the LAN. System clock correct. Secure Connections = Preferred. macOS firewall disabled during testing with no change. Multiple restarts. Certificate re-provisioned — comes back on the same chain with a new UUID.
The ca.crt Plex provisions contains a single intermediate — subject=C=US, O=Let's Encrypt, CN=YR2 / issuer=C=US, O=ISRG, CN=Root YR — with no cross-signed YR2 chaining to ISRG Root X1, so clients without the new Generation Y roots can’t build a path.
This server was recently migrated from a Docker install on a Synology to a clean macOS install; the machine identifier changed during that move.
Happy to post CERT-filtered logs if needed. Thanks!
