Well, it was hell.
I tried a myriad of things, unfortunately the easy option, piping everything through 80 wasn’t an option. The plex settings for setting up SSL were an absolute nightmare to get running, it was at this stage I contemplated just forwarding plex.domain.com straight to the plex.tv app and being done with it. I was even looking into moving completely away from plex and installing emby instead. It didn’t help that I was trying to setup everything alongside quickbox and didn’t want to break anything or get in the way of anything that might get wiped when it updates.
Here’s what I eventually settled on, snip. Editing this into /etc/apache2/sites-enabled/default-ssl.conf and modifying the parts I censored out, restarting apache got her done. Lets Encrypt for the subdomain was easy as usual, god I love Lets Encrypt.
Those ~15 lines took care of everything, the reverse proxy to the subdomain and critically, also the SSL. Happy days.