Technical Deep-Dive: Why Plex Android App forces "Indirect/Relay" in Docker/HA setups

Plex Media Server Remote Access
1

Server Version#: 10.30.8.4222 Player Version#:

The Issue

I am hosting Plex as an add-on within Home Assistant OS (Docker). Despite having full local connectivity and a correctly configured network, the official Plex Android app consistently forces an “Indirect/Relay” connection, ignoring the local server. My network is stable, reachable, and latency is minimal, yet the app refuses to connect directly.

The Technical Analysis

After deep-packet analysis and logs, I have pinpointed two fundamental issues:

1. GDM Discovery Failure Plex relies on GDM for local discovery. In a Docker environment, the container typically operates on a bridge network (e.g., 172.30.x.x). Even with “Local Network Discovery” enabled, the GDM broadcast packets advertise the internal Docker IP as the origin. The Android app performs a subnet sanity check: it detects the mismatch between its own IP (192.168.x.x) and the advertised Docker IP (172.30.x.x), classifies this as an “invalid/spook signal,” and discards it.

2. The SSL/Authentication “Identity Crisis” (Logs) My logs explicitly confirm an identity crisis. The Plex Media Server inside the container fails its own SSL handshakes because it cannot reconcile its multiple identities (LAN, Docker Bridge, WAN) with its single plex.direct SSL certificate.

Here are the relevant snippets from my logs:

Logger: plexapi
HTTPSConnectionPool(host=‘[LAN-IP].[HASH].plex.direct’, port=32400): Max retries exceeded:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch,
certificate is not valid for ‘[LAN-IP].[HASH].plex.direct’.

HTTPSConnectionPool(host=‘[DOCKER-IP].[HASH].plex.direct’, port=32400): Max retries exceeded:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch,
certificate is not valid for ‘[DOCKER-IP].[HASH].plex.direct’.

HTTPSConnectionPool(host=‘[WAN-IP].[HASH].plex.direct’, port=32400): Max retries exceeded:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch,
certificate is not valid for ‘[WAN-IP].[HASH].plex.direct’.

Is this a Plex Bug?

Absolutely. Competent software in a containerized environment should be intelligent enough to identify the mismatch between its internal bridge IP and the accessible LAN IP. It should explicitly broadcast the LAN IP via GDM to ensure clients can find the server.

Instead, the Plex server tries to authenticate against its own wildcard certificate using three conflicting identities. Because these IP addresses do not align with the strict plex.direct SSL definition, the server rejects the incoming connections from its own API client. This proves that the Docker network isolation is not just breaking “discovery,” but is fundamentally breaking the SSL/Authentication handshake for the server itself. Plex relies on “Custom server access URLs” to bridge this gap, yet the Android mobile app completely ignores these custom configurations when interpreting GDM broadcasts, choosing to trust the erroneous internal IP instead.

Why Android TV works vs. Mobile The Android TV app uses the “Leanback” framework, which employs much more lenient discovery logic, bypassing the strict subnet-validation that the mobile app enforces.

Conclusion

This is not a misconfiguration of my home network. The issue is that the Plex mobile app’s security logic is incompatible with the virtualized networking nature of Docker, and the Plex server fails to broadcast or bind to the correct LAN IP despite being aware of its own configuration.

Recommended Workaround Currently, the only stable solution is to bypass the native mobile app entirely. Using a PWA (Chrome “Add to Home Screen”) allows the browser engine to respect local routing and custom server access URLs, granting the expected direct, local quality.

2

Use “host network”, not the Docker bridge.

And please next time you use AI to write your post for you, tell it to make it short and succinct.

The difficulty with the certificate is usually rooted in a misconfigured Plex data folder mount. Plex server needs full read/write permissions in there. And it must be a local storage medium, not a network file share.

3

Thank you for the suggestions. However, these standard troubleshooting steps do not align with the behavior and the logs:

  1. Regarding ‘host network’: Since this is running as a Home Assistant OS add-on, the network configuration is entirely managed by the Supervisor. Unlike a standalone Docker install, users cannot manually toggle the container network mode to ‘host’.

  2. Regarding SSL/Permissions: If this were a filesystem permission issue or an incorrectly mounted data folder, the server would fail globally. However, the server works perfectly fine via Plex Web and the Android TV app. A folder permission issue would not selectively break only the mobile Android app.

The SSLError logs clearly show a Hostname mismatch during the handshake, because the Plex binary inside the container is simultaneously using three conflicting identities (LAN, Docker Bridge, and WAN IP) against its single plex.direct certificate.

This is a network interface binding/validation issue between the Plex server and the mobile client’s strict security checks, not a folder permission issue. Could you please take a look at the actual log output?