This way when a server first starts it asks for its wildcard certificate to be issued (which happened almost instantly for me) and then the client, instead of connecting to, connects to which resolves to the same IP, but with a domain name that matches the certificate that the server (and only that server, because of the hash) holds. Also note that they claim the number of servers is in the millions. It's interesting to see how Digicert minted a new Intermediate certificate for this deployment. Then they partnered with Digicert to issue a wildcard certificate for *. to each user, where HASH is - I guess - a hash of the user or server name/id.įor example see how my server presents a *. certificate now. $ dig +shortīasically any IP.*.plex.direct domain resolves to IP.

First they solved the problem of servers not having a domain name or a stable IP (they are mostly reached via bare dynamic IPs or even local IPs) by setting up a dynamic DNS space under plex.direct: $ dig +short We can't ask them to get a domain name and a certificate just to watch their movies over TLS. And they need a valid public certificate: there is no UI to skip warnings generated by XHR and a self-signed certificate would be a quite poor security guarantee anyway.īut as we said above, the servers are run by the users on their own machines and IPs. active mixed content.Īlso the server connections need to be over HTTPS. The problem is that now the browser will block our XHR connections to the servers because they are HTTP connections initiated from a HTTPS page a.k.a. Let's say Plex sets up HTTPS for and we load instead. The clients connect to to discover the servers linked to your account, and then connect directly to the server.įor example, if you use the web app, you load, the app asks the list of your servers and then connect to each of them with a XHR like. The server is a piece of software that runs on your own machine, where you have all your movies and TV series. BackgroundĪ quick overview of the Plex architecture to understand why this is different from the average HTTPS deployment.

This week Plex, a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user's servers. How Plex is doing HTTPS for all its users

Link tv plex