Plex Media Server has built-in secure-connection handling that covers the vast majority of installs without any manual certificate work at all. Understanding what Plex already does for you is worth knowing before reaching for a manual setup.
What Plex handles automatically
When Remote Access / secure connections are enabled (Settings → Network), Plex automatically provisions and rotates a certificate for a unique plex.direct subdomain tied to your Plex account and server, entirely behind the scenes. This is how most Plex servers already serve HTTPS today, including remote streaming, without the server owner ever touching a certificate file.
When you'd want a manual, custom-domain certificate instead
The main reason to go further is wanting your own domain in the address bar (plex.yourdomain.com) instead of a plex.direct subdomain — for a custom-branded internal tool, a URL that's easier to remember, or a setup where Plex sits behind your own reverse proxy alongside other self-hosted services already on your own domain.
- Obtain a certificate for your custom hostname however you normally would (Let's Encrypt via Certbot or acme.sh, or a certificate from any CA).
- Combine the certificate and private key into a single PKCS#12 (
.pfx/.p12) bundle — Plex's custom certificate setting expects this combined format, not separate cert and key files. - In Plex's Network settings, find "Custom certificate location" and point it at the
.pfxfile, along with the matching "Custom certificate domain" field set to your hostname.
Renewal is manual for a custom certificate
Unlike the automatic plex.direct certificate Plex manages for you, a custom certificate you supply is not renewed by Plex automatically. If you're using a short-lived certificate authority like Let's Encrypt, you'll need your own renewal process to regenerate the PKCS#12 bundle and update Plex's setting before the certificate expires — a recurring calendar reminder, or a small script that rebuilds the bundle after each renewal, is worth setting up rather than relying on remembering.
Reverse proxy as an alternative to Plex's own certificate setting
If you're already running a reverse proxy in front of other self-hosted services, you can instead terminate TLS at the proxy and forward plain HTTP to Plex's internal port, skipping Plex's own custom-certificate setting entirely — the same pattern commonly used for Home Assistant and similar self-hosted apps. Either approach is legitimate; which one fits depends on whether you're managing Plex's certificate in isolation or as part of a broader self-hosted setup with a shared proxy already in place.
Loading comments…