Let's Encrypt Certificates on Synology

2017-06-23 · synology, ssl, letsencrypt

I got tired of clicking through the browser warning every time I opened the NAS over HTTPS. Worse, it teaches everyone in the house to ignore certificate warnings, which defeats the point. Since DSM 6.0 Let's Encrypt is built into Control Panel, so a trusted certificate that renews itself is a few clicks away.

The catch is the requirements. You need a public DNS name pointing at your WAN IP (a Synology DDNS name like yourname.synology.me is the easy way), and port 80 has to reach the NAS. Let's Encrypt validates over HTTP, and DSM has no DNS-based validation. If you run the DSM firewall, allow port 80 from any source too.

DDNS hostname first

If you do not already have a domain, go to Control Panel → External Access → DDNS → Add. Choose Synology as the service provider, pick a hostname under one of the offered suffixes, and sign in with your Synology account. Tick "Get a certificate from Let's Encrypt and set it as default" if the option appears; that combines this step and the next one.

Confirm the name resolves to your public address:

nslookup yourname.synology.me
curl -s https://ifconfig.co

Both should return the same IP.

Forward port 80

On your router, forward TCP 80 to the NAS's LAN address. If you use Synology's router configuration feature, Control Panel → External Access → Router Configuration → Create → Built-in application → tick "Web Station" or add a custom rule for port 80.

On the DSM firewall, add an Allow rule for port 80, source All, above your final deny rule. You can remove or disable it after the certificate is issued, but renewals will need it again roughly every 60 days, so I leave it in place. Closing it after issuance was my mistake once, and the cert quietly expired two months later. DSM's own nginx answers on 80 with a redirect to 5001 and passes the /.well-known/acme-challenge/ path through, so nothing sensitive is exposed.

Ask for the certificate

Control Panel → Security → Certificate → Add → "Add a new certificate" → "Get a certificate from Let's Encrypt". Fill in:

Domain name:        yourname.synology.me
Email:              you@example.com
Subject Alternative Name: nas.example.com;files.example.com

The SAN field is optional and semicolon separated; each name listed there must also resolve to your NAS and be reachable on port 80. Tick "Set as default certificate" and click Apply. Issuance takes about ten seconds. DSM restarts its web server, so you will be logged out briefly.

Assign it to services

Back in the Certificate tab, click Configure. The dialog lists every service that speaks TLS: DSM, FTPS, Web Station virtual hosts, Mail Server, VPN Server, and so on. Set each one to the new certificate. The default certificate is only used by services that have not been given an explicit assignment.

The files live under /usr/syno/etc/certificate/, and the system default under /usr/syno/etc/certificate/system/default/. You can confirm what nginx is presenting with:

openssl s_client -connect nas.example.com:5001 -servername nas.example.com 2>/dev/null | openssl x509 -noout -issuer -dates

The issuer should read Let's Encrypt Authority X3 and notAfter should be about 90 days out.

Renewal

DSM renews Let's Encrypt certificates on its own about 30 days before expiry through a scheduled task in /usr/syno/etc/synocrond.config. There is nothing to set up, but the port 80 forward and firewall rule must still be in place when it fires. The Certificate tab shows the expiry date; if it stays unchanged after the expected renewal window, look at /var/log/messages for syno-letsencrypt lines.

Checking the result

Open https://yourname.synology.me:5001 in a fresh private browser window. There should be no warning, and the padlock details should show the Let's Encrypt chain. Also test any service you reassigned, for example FTPS:

openssl s_client -connect nas.example.com:21 -starttls ftp

Gotchas

"Failed to connect to Let's Encrypt. Please make sure the domain name is valid" almost always means port 80 is not reaching the NAS. Test from outside with curl -I http://yourname.synology.me/ and expect a 3xx redirect from nginx. A timeout means the router forward or ISP is blocking it; some ISPs block inbound 80 entirely, in which case Let's Encrypt via DSM is not possible.
"The maximum number of certificates for this domain has been reached" is the Let's Encrypt rate limit of 20 certificates per registered domain per week. On the shared synology.me suffix this is counted per full hostname, so it normally only happens if you have repeatedly deleted and recreated the certificate. Wait a week.
The certificate renewed but browsers still show the old one: the service is still assigned to the old certificate object. Recheck Configure in the Certificate tab; deleting and re-adding a certificate creates a new object and drops the assignments.
Docker containers or reverse proxied applications show the DSM certificate instead of their own: those go through DSM's nginx and inherit whatever is assigned to the Application Portal entries, which you set in the same Configure dialog.

If leaving port 80 open bothers you, the alternative is running certbot on another machine with DNS validation and importing the PEM files through the same Certificate tab. I'd rather not, so I live with the redirect.