Trouble establishing external access - certificate issue?

Plex Media Server Remote Access
1

Server Version#: 1.22.0.4163

I’m proxying Plex behind HAProxy providing SSL termination. I can reach the web player fine, but cannot get external access to validate. This error shows up in logs:

ERROR - Error issuing curl_easy_perform(handle): 60
WARN - HTTP error requesting GET https://<redacted>.55bc1c7c70ff466fa610b9809d0932bd.plex.direct:443/identity (60, SSL peer certificate or SSH remote key was not OK) (SSL: no alternative certificate subject name matches target host name '<redacted>.55bc1c7c70ff466fa610b9809d0932bd.plex.direct')

Please help.

2

Anyone?

3

is the proxy communicating with http or https?

Did you also import the certificate into PMS ?

Error 60 is often returned when HTTP is presented by HTTPS is required or certs don’t
match

4

Thanks ChuckPa,

Firewall to proxy is https. Proxy to Plex backend is http. I didn’t bother importing the cert to PMS as I intend to terminate SSL further upstream. It’s a valid configuration, I can hit it externally just fine, Plex just doesn’t validate it for remote access.

What am I not understanding about Plex’s requirements?

5

You’re not understanding / overlooking (simply) is that Plex wants HTTPS.

When you give it your cert info (import into Settings - Server - Network - Show Advanced),

It can accept from your domain as well as respond to it – knowing it’s OK. Just about anything else is going to get error 60 (no data sent)

6

Plex service wants HTTPS, plex gets HTTPS. It should be getting valid SSL from the upstream proxy when it comes to check externally. Not sure why I have to do anything additional on the PMS side.

7

I continue to have the same issue and also do not understand why Plex (supposedly) needs the full certificate being used on the proxy imported into Plex itself.

Not sure about you or if this is normal, but Plex shows my public IP on the Remote Access page in the Public to Private mapping area. I don’t know why it’s not showing my “Custom server access URL” there instead of the IP, but I suspect this is part of the issue.

Anyway… I have tried importing my certificate despite the lack of documentation for how to use the “Custom certificate encryption key” field… but so far no luck. I wonder if it’s due to my cert being a wildcard. I plan to try a non-wildcard cert soon.

It’s a very irritating problem I have been trying to solve for weeks with no luck.

8

If I may add ?

  1. You may give it a server cert *.domain.tld
  2. You must include the intermediate CAs involved so PMS can verify the chain.