TerraMaster Forum

Hello,

I am experiencing an issue on my TerraMaster NAS when running Plex Media Server.

Problem description:
Plex is unable to load posters and cannot match media files properly. Metadata agents are not working.

Plex logs show errors such as:

Unable to find or create media provider for agent 'tv.plex.agents.movie'
we had 0 cloud providers online
HTTP simulating 408 after curl timeout

It appears Plex cannot retrieve data from:
https://vod.provider.plex.tv

I performed diagnostics directly on the NAS via SSH:

Command:
curl -v https://vod.provider.plex.tv

Result:

TLS handshake starts correctly
certificate is received
then it fails with:
TLS alert, decode error
unexpected eof while reading

At the same time, other HTTPS websites (e.g. https://google.com) work fine.

Additional checks:

DNS is working correctly
internet connectivity is OK
Plex server is properly claimed (claimed="1")
issue persists even when forcing TLS 1.2 and HTTP/1.1

Conclusion:
This seems to be related to the system TLS/SSL stack (OpenSSL) on the NAS, which fails to properly establish HTTPS connections to Plex (Cloudflare-backed endpoints).

Questions:

Is this a known issue on TerraMaster systems?
Is it possible to update OpenSSL or system SSL libraries?
Is there a TOS update that fixes this?
Is there any way to manually upgrade the TLS/SSL stack?

This issue prevents Plex Media Server from functioning correctly.

Thank you in advance for your support.

Hi dear customer.

No other similar feedback has been received so far.

Could you please provide the version of TOS and the version of the Plex Media Server app you are currently using? Is this your first time using it, or was it working normally until the issue occurred? These may help us pinpoint the issue.

Additionally, you might also consider seeking solutions in the Plex community.

Hi, thank you for your response.

Here are the details you requested:

TOS version: 6.0.794
Plex Media Server version: 1.43.0.10492

This setup was working normally before, and the issue appeared later without any major configuration changes.

I did some deeper troubleshooting and found the following:

Plex server is successfully claimed and has internet access
DNS resolution works correctly
plex.tv and vod.provider.plex.tv are reachable from a browser

However, when testing directly from the NAS via SSH:

curl -v https://vod.provider.plex.tv

the TLS handshake starts but then fails with:

TLS alert, decode error
unexpected eof while reading

This seems to indicate a TLS/SSL compatibility issue on the NAS side (possibly OpenSSL / libcurl), especially when connecting to Cloudflare (used by Plex providers).

Because of this, Plex reports:

0 cloud providers online
metadata agents not working

So at this point it looks like the issue is not specific to Plex configuration, but rather related to the TLS stack in TOS.

Please let me know if there are any updates or patches related to TLS/OpenSSL in TOS that could address this.

Thank you.

There have never been any specific settings related to this in TOS. We haven’t found any connection to what you mentioned at this time. We’ll continue to look into it.
I noticed that you’re using a version of PMS that’s newer than the one available in the App Center.
You might try renaming the shared folder named “Plex,” then restarting PMS to generate a new Plex shared folder (which will include Plex’s configuration settings, etc.).
You could also try reinstalling the version provided by the App Center.

Summary
Problem
ISP blocks Plex via DPI (Deep Packet Inspection). Plex servers are unreachable — the ISP analyzes SNI (Server Name Indication) in the TLS handshake and terminates connections to Plex domains:

downloads.plex.tv — downloading codecs, Intel drivers for hardware transcoding, Plex updates
meta.plex.tv — movie and TV show trailers
vod.provider.plex.tv — online metadata agents (posters, descriptions, ratings, cast)
scrobbles.plex.tv — watch status synchronization between devices
Meanwhile, plex.tv (authentication, remote access) worked fine. The same Cloudflare IP with a different SNI also worked. The blocking is targeted, by domain name.

The problem was not with Plex itself — Plex was never updated or reinstalled. The cause was entirely on the ISP side.

What we tried and didn't work
IPIP tunnel (already configured) — does not encrypt traffic. The ISP sees SNI inside IPIP and blocks it.

IPSec transport mode over IPIP — Phase 1 (IKE) was negotiated successfully, but Phase 2 (Child SA) failed. The router and StrongSwan could not agree on Traffic Selectors (TS_UNACCEPTABLE).

IPSec tunnel mode (standalone) — IKE also did not fully establish.

HTTP proxy (tinyproxy) over IPIP — did not work because IPIP is unencrypted — the ISP blocks even HTTP CONNECT inside the tunnel.

What worked
SSH SOCKS5 proxy. SSH is an encrypted protocol, so the ISP cannot see the contents. No changes to Plex itself (no updates, no reinstallation) were needed — only the network environment was configured.

A systemd service ssh-socks-proxy was created on the NAS, maintaining an SSH tunnel to the VPN server with a SOCKS5 proxy on port 1080
Environment variables ALL_PROXY=socks5://127.0.0.1:1080 and NO_PROXY for local addresses were added to the Plex startup script
Plex sends external requests through the encrypted SSH tunnel → the VPN server makes requests to Plex on its behalf → the ISP cannot see the SNI
After restarting Plex — codecs were downloaded, metadata loaded, everything started working