I’ve just setup a Let’s encrypt certificate for my OpenWRT router. I would like to do the same for my Synology NAS. However, this one is a bit more complex, since I’m running a lot of docker container on that machine and also use the reverse proxy feature. So I’ll need a wildcard certificate. Unfortunately, DSM doesn’t support Let’s encrypt certificates using DNS validation, so I’ll have to do things manually. Luckily some people already experimented with this problem and documented them.
Create Ionos API credentials
See this documentation on how to create a new API key. I’ve created additonally a subdomain
local which I’ll be using for all my local network stuff. I assume you’ll need to have the subdomain already configured in Ionos before you’ll request any certificates for subdomains.
The suggestion is to run the ACME script inside a docker container. Additionally a separate DSM admin user should be used for managing the certificate renewal process. The user must be an admin, but can be denied access to all DSM Applications. You’ll have to login once for this user, to complete the 2FA setup.
We’ll run the ACME script inside a docker container. So assuming you’ve already got docker installed on your DSM and setup.
Create a new folder and put the following content into the file
account.conf. I’ve put mine under
export IONOS_PREFIX="yourusername" export IONOS_SECRET="yourpassword" export SYNO_Username="yoursynologyadminuser" export SYNO_Password="yoursynologyadminuserpassword" export SYNO_Certificate="" export SYNO_Scheme="https" export SYNO_Port="5001" export SYNO_Hostname="yoursynologyFQDN" export SYNO_Create=1
Change the values to your needs. The
SYNO_Username and password are of the account you’ve created earlier. The
IONOS_ parameters are from the API credential creation of Ionos.
I’m using Portainer for most of my docker stuff. But since I’m following these instructions I’ll be configuring this container via the DSM console.
Enabe automatic restarts and give it a simple name like acme.
Connect to the Terminal like it is described. Change the default CA to letsencrypt:
acme.sh --set-default-ca --server letsencrypt
Now comes the interesting part, issueing a new certificate:
acme.sh --issue --dns dns_ionos -d yourdomain -d *.yourdomain
Note the double
-d parameters. We want a wildcard certificate for any subdomains and also an ASN for the domain of the DSM as a host. If the execution is successful, you’ll have new signed certificates in
Now we’ll deploy them to the Synology:
acme.sh --deploy -d yourdomain -d *.yourdomain --deploy-hook synology_dsm --insecure
I had problems with my existing certs which weren’t trusted by the docker container, so I had to disable verification with –insecure. After execution I’ve got an error that the restart of the HTTP services failed:
[Fri Oct 13 00:12:28 UTC 2023] Getting certificates in Synology DSM [Fri Oct 13 00:12:28 UTC 2023] Generate form POST request [Fri Oct 13 00:12:28 UTC 2023] Upload certificate to the Synology DSM [Fri Oct 13 00:12:29 UTC 2023] Restarting HTTP services failed [Fri Oct 13 00:12:29 UTC 2023] Success
The list of certificates now show the uploaded certificate from lets encrypt, but its not in use anywhere inside the DSM. According to this wiki, it must be assigned manually:
Afterwards, the certificate should show up inside Control Panel -> Security -> Certificates & can be assigned to specific services or set as the default certificate.
When I assign it manually, it will trigger a restart of the webserver automatically. The new certificate is now in use
After some minor problems with the
synology_dsm deploy hook, I’ve got it all running. It will be interesting to see how things will end up in 90 days, when the certificate expire. Ideally the docker container will handle the renewal process automatically. In combination with the deploy hook, the DSM should pretty much maintenance free.