How do I obtain a certificate from Let's Encrypt on my Synology NAS?
Last updated:Apr 11, 2024
How do I obtain a certificate from Let's Encrypt on my Synology NAS?
Purpose
This article explains how to obtain a certificate from Let's Encrypt on your Synology NAS. You can also follow the instructions in this video tutorial.
Environment
The Let's Encrypt DST Root CA X3 certificate is expired as of September 30, 2021. For DSM 6.2.3 and below, you must update to DSM 6.2.4 Update 2 or above to obtain a Let's Encrypt certificate.
Resolution
Preparation
You should have already registered a domain, such as example.com. If not, you can obtain one via either of the following methods:
- Synology DDNS: Go to DSM Control Panel > External Access > DDNS to set up a DDNS hostname. Refer to the respective help articles for DSM 7.0 and DSM 6.2 for more information.
- Customized domain: Apply for a domain from a third-party domain provider.
Add a certificate from Let's Encrypt
- Go to DSM Control Panel > Security > Certificate.
- Click Add.
- Select Add a new certificate and click Next.
- Select Get a certificate from Let's Encrypt and click Next.
- Enter the following information:
- Domain name: Enter the Synology DDNS hostname or your customized domain, such as
example.com. - Email: Enter the email address used for certificate registration. This is where a notification will be sent when the certificate is about to expire.
- Subject Alternative Name:1 You can enter other domain names here to allow one certificate to cover multiple domains. For instance, if you have entered
example.comin Domain name and wish to share the same certificate with your device's other domainmail.example.com, enter the latter in this field. - Click Apply to save the settings. Once confirmed, the certificate will be instantly imported.
Notes:
- The domains entered in the Domain name and Subject Alternative Name fields should have the same external IP address. You can also apply for a wildcard certificate by entering the domain names of Synology DDNS in the following format:
*.SYNOLOGY_DDNS_HOSTNAME. Please note that only Synology DDNS supports wildcard certificate. - You can only use a limited number of email accounts to register for certificates from Let's Encrypt. If the number is exceeded, use an email account previously registered to get more certificates.
- You can only register for a limited number of certificates per domain from Let's Encrypt. If the number is exceeded, enter the current domain name as the Subject Alternative Name and use another domain name for the certificate request.
- Let's Encrypt performs domain validation before issuing certificates for your domains.
- Let's Encrypt certificates are valid for 90 days. If the domain authenticates successfully, DSM automatically renews the certificate before the expiration.
- To obtain or renew the certificate of your customized domain, make sure port 80 has been forwarded to your NAS. This limitation does not apply to Synology DDNS.
- Synology DDNS supports DNS-01 (starting with DSM 6.0) and HTTP-01 validation with Let's Encrypt. Customized domain only supports HTTP-01 validation with Let's Encrypt. Refer to this article for more information about validation methods.