CLI script to programmatically replace SSL certs on Synology NAS

replace_synology_ssl_certs.sh

#!/bin/sh
# How to use this script:
#  1. Get your 3 PEM files ready to copy over from your local machine/update server (privkey.pem, fullchain.pem, cert.pem)
#     and put into a directory (this will be $CERT_DIRECTORY).
#  2. Ensure you have a user setup on synology that has ssh access (and ssh access is setup).
#     This user will need to be able to sudo as root (i.e. add this line to sudoers, <USER> is the user you create):
#       <USER> ALL=(ALL) NOPASSWD: /var/services/homes/<USER>/replace_certs.sh
#  3. Call this script as follows:
#     sudo scp ${CERT_DIRECTORY}/{privkey,fullchain,cert}.pem $USER@$SYNOLOGY_SERVER:/tmp/ \
#     && sudo scp replace_synology_ssl_certs.sh $USER@$SYNOLOGY_SERVER:~/ \
#     && ssh $USER@$SYNOLOGY_SERVER 'sudo ./replace_synology_ssl_certs.sh'

# Script start.

# Move certs from /tmp to install directory
mv /tmp/{privkey,fullchain,cert}.pem /usr/syno/etc/certificate/system/default/
if [ "$?" != 0 ]; then
	echo "Halting because of error moving files"
	exit 1
fi

# Ensure correct permissions
chown root:root /usr/syno/etc/certificate/system/default/{privkey,fullchain,cert}.pem
if [ "$?" != 0 ]; then
	echo "Halting because of error chowning files"
	exit 1
fi
echo "Certs moved from /tmp & chowned."

# If you're using a custom domain name, replace the FQDN certs too
if [ -d "/usr/syno/etc/certificate/system/FQDN/" ]; then
    echo "Found FQDN directory, copying certificates to 'certificate/system/FQDN' as well..."
    cp /usr/syno/etc/certificate/system/default/{privkey,fullchain,cert}.pem /usr/syno/etc/certificate/system/FQDN/
    chown root:root /usr/syno/etc/certificate/system/FQDN/{privkey,fullchain,cert}.pem
fi

# Reboot synology services
echo -n "Rebooting all the things..."
/usr/syno/sbin/synoservice --restart nginx
/usr/syno/sbin/synoservice --restart nmbd
/usr/syno/sbin/synoservice --restart avahi
/usr/syno/sbin/synoservice --reload ldap-server
echo " done"