Setting up a Let's Encrypt certificate for your Synology

DSM ships out of the box with a self-signed certificate — which makes the browser warn you every time and occasionally confuses apps like the Drive client. With a certificate from Let’s Encrypt, the warning disappears and all apps work without workarounds.

Requirement: your own domain pointing at your Synology. If you don’t have one yet, see Point your own domain at your Synology.

How Let’s Encrypt works

Let’s Encrypt is a free certificate authority. It issues SSL certificates for domains once you can prove that you control the domain. The proof runs via the HTTP-01 challenge: Let’s Encrypt sends a request to http://deine-domain/.well-known/acme-challenge/<token>, and your Synology has to respond with the right token.

DSM does all of that automatically — you only have to enter the domain.

Important: ports 80 and 443 must be reachable from outside on your Synology. With us that’s the default, because your NAS has its own public IPv4.

Requesting the certificate in DSM

1. Control Panel → Security → Certificate.
2. Add → Add a new certificate → Get a certificate from Let’s Encrypt.
3. Domain name: your domain (e.g. nas.deinname.de).
4. Email: your mail address — you’ll get reminders if renewal fails.
5. Subject alternative names: optionally more subdomains (say drive.deinname.de, photos.deinname.de), separated by commas.
6. Apply.

DSM contacts Let’s Encrypt, the HTTP-01 challenge runs, and the certificate is fetched and installed. Typically takes 30–60 seconds.

Setting the default certificate

After fetching, you now have two certificates: the old self-signed one and the new Let’s Encrypt one. You have to tell DSM which one to use for which service.

Control Panel → Security → Certificate:

• Click the Let’s Encrypt certificate → Configure.
• In the dialog, select the Let’s Encrypt certificate for each service (DSM, Drive, Photos, WebDAV).
• Save.

You can also mark the Let’s Encrypt certificate as the default — then all new services use it automatically.

Auto-renewal

Let’s Encrypt certificates are valid for 90 days. DSM renews them automatically from day 60 — you don’t have to do anything.

If renewal fails, you get a mail (as long as email notifications are enabled). Common causes:

• The domain no longer points to the right IP: you moved the NAS or changed DNS. Solution: check DNS.
• Port 80 isn’t reachable from outside: rare, because with us it’s open by default. But if you’ve built your own firewall rules, check them.
• Let’s Encrypt rate limit: after multiple failures within a short time, LE blocks you. Wait and try again the next day.

Multi-domain certificate (SAN)

If you have multiple subdomains — nas.deinname.de, drive.deinname.de, photos.deinname.de — you can issue one certificate for all of them, which is more efficient than three separate ones.

When requesting, enter the additional domains comma-separated in the Subject alternative names field. Important: each of these domains must currently point at your Synology, otherwise the challenge fails for the affected subdomain.

Wildcard certificates

Let’s Encrypt supports wildcard certificates (e.g. *.deinname.de). DSM can do this from version 7 on — but the setup path is different, because wildcard only works via the DNS-01 challenge (not HTTP-01).

DNS-01 challenge means: DSM has to be able to set a TXT record in your DNS. That only works if your DNS provider has an API that DSM supports — Cloudflare, for example, works.

From our experience: if you only have 2–3 subdomains, multi-domain SAN is simpler than wildcard. Wildcard only pays off with many unknown subdomains.

Custom certificates (your own / paid)

If you have a paid certificate from Sectigo, DigiCert or others: in Add a new certificate → Import certificate you can upload PEM files.

From our experience: for private customers this isn’t worth it. Let’s Encrypt has technically the same strength. Paid certificates only make sense for corporate compliance requirements or extended validation.

Frequently asked questions

I use the xaweho.de subdomain — can I run Let’s Encrypt on it? No, because you don’t control the DNS record yourself. On request, we set up a certificate on the 12345.nas.xaweho.de subdomain — just ask us. For your own certificate management, you need your own domain.

My renewal has been failing for two weeks, what now? Open a ticket. We’ll check whether port 80 is really reachable, whether DNS points correctly, and whether LE has you in a rate limit. In an emergency we can reissue the certificate on our side.

Does HTTP-01 work for DSM on a custom port? No. HTTP-01 requires port 80. DSM on a custom port (e.g. 5001) is fine, but port 80 must at least be open for the renewal challenge.

What if I have Cloudflare as a proxy in front? Cloudflare in “proxy” mode (orange cloud) routes the traffic through Cloudflare. The HTTP-01 challenge is blocked by that, because it goes to the Cloudflare IP instead of your Synology. Solution: set the cloud to grey (“DNS only”) during renewal, or use the DNS-01 challenge with the Cloudflare API.

Can I also use the certificate for my own web server on the Synology? Yes. If you run Web Station or another service on the NAS: in Control Panel → Login Portal, assign the certificate to the reverse proxy.

How do I see when the certificate expires? Control Panel → Security → Certificate — the “Expiration date” column. DSM warns you 30 days before expiry if renewal isn’t working.

Can I have multiple Let’s Encrypt certificates on the same NAS? Yes, as many as you like. One per domain, or multi-domain SAN. In practice, though, a single multi-domain certificate for all subdomains is enough.

What’s next

• Point your own domain at your Synology
• Securing the admin account on your Synology
• Enable and use WebDAV