Tag: emby

Emby – Convert SSL Certificate for Use in Emby (OpenSSL Guide)

February 25, 2026 / bytesmith17

This guide explains how to convert a certificate from a provider (such as OVH or Namecheap) into a .pfx file for use in Emby, and how to verify that your private key, CSR, and certificate all match correctly.

This is useful when:

You purchased an SSL certificate from a provider
You generated your own CSR
Emby requires a .pfx certificate file
You want to verify everything matches before importing

1. Convert Certificate to PFX Format

Emby requires a .pfx (PKCS#12) certificate file.

Run the following command:

openssl pkcs12 -export -out mgn.pfx \
  -inkey mgn_ovh.key \
  -in mgn_ovh.crt \
  -certfile mgn_ovh.ca-bundle

File Explanation

mgn_ovh.key → Your private key
mgn_ovh.crt → Certificate issued by provider
mgn_ovh.ca-bundle → Intermediate certificate bundle
mgn.pfx → Output file used in Emby

You will be prompted to create a password.
This password will be required when importing into Emby.

2. Troubleshooting: Verify the Key, CSR, and Certificate Match

If Emby refuses the certificate, or conversion fails, ensure that:

The private key matches the CSR
The certificate was issued for the correct key
The CA bundle matches the certificate

All modulus hashes must match.

Confirm the Private Key

openssl rsa -noout -modulus -in mgn_ovh.key | openssl md5

Example output:

MD5(stdin)= xxxxxxxxxxxxxxxxx

Check the Original CSR

openssl req -noout -modulus -in request.csr | openssl md5

The MD5 hash must match the private key output above.

Check the Provider Certificate

openssl x509 -noout -modulus -in mgn_ovh.crt | openssl md5

This must also match the previous two outputs.

If all three hashes match → your key, CSR, and certificate are correctly paired.

3. Verify the Certificate Chain

Ensure the certificate is properly signed by the CA:

openssl verify -CAfile mgn_ovh.ca-bundle mgn_ovh.crt

Expected output:

mgn_ovh.crt: OK

If it returns OK, the certificate chain is valid.

4. Import Into Emby

In Emby:

Dashboard → Network → HTTPS → Certificate Path

Upload the .pfx file and enter the password created during export.

Restart Emby after importing.

Common Issues

Key does not match certificate → wrong private key used
CSR regenerated after certificate purchase
Incorrect CA bundle file
Missing intermediate certificates

Always confirm modulus values match before attempting conversion.

Tested On

Debian-based systems
OpenSSL 1.1 / 3.x
Emby Server (Linux)
Certificates from OVH / Namecheap

Emby – Running Emby service as different user

October 1, 2024 / bytesmith17

Step 1 – Stop The Emby-Server Service

systemctl stop emby-server

Step 2 – Check The Emby-Server Service have safely stopped

systemctl status emby-server

important – ensure the emby server has stopped and shows inactive (dead)

Step 3 – Amend the emby server service filesnano /usr/lib/systemd/system/emby-server.service

important – Replace “newuser” with the user you would like to use.

Change ‘User=emby’ to ‘User=newuser’

Save emby-server.service CTRL + O then Enter

Step 4 – change emby folder’s permission
chown -R newuser:newuser /var/lib/emby/

Step 5 – reload and check the emby server service

sudo systemctl daemon-reload

systemctl start emby-server
systemctl status emby-server

Checking the status of emby you should see active (Running) shown in green below.

Proxmox – Emby Intel GPU passthrough

October 1, 2024 / bytesmith17

October 1, 2024

Important: This is for use with Debian 12 (BookWorm) / Proxmox (8.2.7).

This guide is for the setup of an Intel iGPU or dedicated GPU passthrough on Proxmox between an LXC / CT linux system.

Run these commands on both the proxmox host and Emby CT. I have this method working on successfully on both a N100 iGPU and Sparkle Intel Arc A310 ECO

Step 1 – Adding driver download sources
nano /etc/apt/sources.list

add the following

non-free firmwares deb http://deb.debian.org/debian bookworm non-free-firmware

non-free drivers and components deb http://deb.debian.org/debian bookworm non-free

Step 2 – Installing the GPU Driver

Install the following
apt update && apt install intel-media-va-driver-non-free intel-gpu-tools

Step 3 – Confirm GPU’s major number’s for fb0 and renderD128

Important: Note down your major numbers from your output my example numbers may not be the same as yours and if this are incorrect the gpu will not work.

cd /dev

Use the following command to list all files and folders in the current directory

ls -lah

Make a note of the numbers in bold for fb0 (If it exists)

crw-rw---- 1 root video 29, 0 Aug 30 21:19 fb0

Navigate to the dri folder using the following command

cd /dev/dri

ls -lah

Make a note of the the number in bold for renderD128

crwxrwxrwx 1 root render 226, 128 Aug 30 21:19 renderD128

Step 4 – Amend Proxmox CT/LXC config to allow access to the GPU

Now we will add the numbers that were noted down to our CT config on proxmox for Emby – Important amend the command below with your CT’s ID number shown the proxmox webgui (Example Below) Mine is 3006

Now open your CT’s config files on your Proxmox host.

nano /etc/pve/lxc/3006.conf

Add the following lines to the file and save using CTRL + O and then enter.
lxc.cgroup2.devices.allow: c 29:* rwm lxc.cgroup2.devices.allow: c 226:* rwm lxc.mount.entry: /dev/fb0 dev/fb0 none bind,optional,create=file lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir lxc.apparmor.profile: unconfined

Step 5 – Adding Persistent GPU Permissions

Important: Giving 777 permissions to your GPU is not considered best practice from a security standpoint. While this approach works, there are more secure methods you can follow. However, I understand the risks and accept them on my system. do this at your own risk…

Adding Persistent GPU Permissions on proxmox host so the GPU is accessible to the CT after reboot.

nano /etc/udev/rules.d/99-renderD128-permissions.rules KERNEL=="renderD128", MODE="0777"

udevadm control --reload-rules

udevadm trigger

How to Test?

Run the following command on your proxmox shell (This is basically task manager for your GPU)

intel_gpu_top

Step 6 – LXC/CT GPU Driver installation

Repeat Steps 1 and 2 inside your LXC/CT/Emby Shell

How to Test GPU in Emby?

Login to Emby and navigate on the admin webpage to Server > Transcoding. If you see your GPU and a list of Hardware Decoders its likely working. Test forcing something to Trancode by changing the bitrate and monitor the CPU usage and using intel_gpu_top to see if there is any ffmpeg processes running on the GPU

If your not seeing anything on this page I suggest giving your server a little nap (aka, a reboot) see if that makes the GPU driver jumps into life.

Proxmox – Persistent GPU Permission

October 1, 2024 / bytesmith17

If you are having issues with GPU transcoding in emby and your GPU permission keep changing after reboot use the following commands to fix the permission.

Run the following command inside your proxmox shell.

nano /etc/udev/rules.d/99-renderD128-permissions.rules

Add the following to the file

KERNEL=="renderD128", MODE="0777"

CTRL + O then Enter to save the changes to the file.

Now run the following command

udevadm control --reload-rules

Run the following command

udevadm trigger