CLI script to programmatically replace SSL certs on Synology NAS

replace_synology_ssl_certs.sh

# MOVED to public repo: https://github.com/catchdave/ssl-certs/blob/main/replace_synology_ssl_certs.sh

[EDIT] I was using the wrong chain file.

[EDIT] Deleting stuff under /usr/syno/etc/www/certificate/[...] messed up my DSM installation.
So my recommendation is don't do it.

If I remove everything inside /usr/syno/etc/www/certificate/system_default/, then synow3tool --gen-all will generate the necessary certificates in those folders.
Also, the SurveillanceStation folder that was missing from my configuration was also located there /usr/syno/etc/www/certificate/
However, I still get this error Generated nginx tmp config is not valid, which only happens if I change the certificates in the other folders.
I still don't know what am I missing here.

@footswitch The error message hints at the key you are copying doesn't match the underlying CSR of the certificate. It's not a matter of the script.

@fhemberger THANK YOU for making me recheck everything. It was painful but I got it now.
DSM was misleading me to use the wrong "chain" file all along.
My certificate files are generated with win-acme, which outputs four files:
...-key.pem --> privkey.pem
...-crt.pem --> cert.pem
...-chain-only.pem --> fullchain.pem (wrong)
...-chain.pem -- NOT USED

When I replace the certificate in the UI (Control Panel --> Security --> Certificates), I select these files above, with ...-chain-only.pem being the intermediate certificate, and the certificate was getting replaced with no errors.

But in order for the script to work, the files must be:
...-key.pem --> privkey.pem
...-crt.pem --> cert.pem
...-chain-only.pem -- NOT USED
...-chain.pem --> fullchain.pem (right)

@footswitch

After reading your last comment, specifically the part of Win-Acme...

you (and others) may benefit of using docker-certbot direct in your synology.

I use the certificates only for the Reverse Proxy (in conjunction to Pomerium) to access my docker containers and the DSM interface

I created the certificates with:

docker run -it --rm --name certbot -v "/volume1/Primero/Certs/certbot/etc/letsencrypt:/etc/letsencrypt" -v "/volume1/Primero/Certs/certbot/var/lib/letsencrypt:/var/lib/letsencrypt" -v "/volume1/Primero/Certs/certbot/log/:/var/log" -v "/volume1/Primero/Certs/certbot/certs_to_syno:/certs" certbot/certbot certonly --agree-tos --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d *.carXXXXXX.xyz -d carXXXXXX.xyz

And then I have a scheduled task in Synology's task scheduler that runs every X days to renovate them with:

docker run --rm --name certbot -v "/volume1/Primero/Certs/certbot/etc/letsencrypt:/etc/letsencrypt" -v "/volume1/Primero/Certs/certbot/var/lib/letsencrypt:/var/lib/letsencrypt" -v "/volume1/Primero/Certs/certbot/log/:/var/log/letsencrypt/" -v "/volume1/Primero/Certs/certbot/certs_to_syno:/certs" certbot/certbot renew --no-random-sleep-on-renew --deploy-hook "cp /etc/letsencrypt/live/caXXXXXX.xyz/*.pem /certs"

With the last part of the renovation command (--deploy-hook "cp...."), if the certificates were renovated (meaning the time to do so has arrived, the standard is 30 days before expiration) , the certificates are copied to a specific directory and then (not included above) copied to the correspondent directory inside the synology directory (in my case: /usr/syno/etc/certificate/_archive/u0rjgL) . I could copy them directly to the final the synology directory but I use this bridge to detect any error in the process.

Then, for me it is enough to have in the script:

synow3tool --gen-all && systemctl reload nginx

to have the new certifcates "activated" for the reverse proxy

With this script I have the full end-to-end process automated: from renovation to activation.

The script has to be run with root privileges.

The complete script does a lot of validations that may be redundant, I am not sharing it here because it does not have a good "coding standard" (i.e. I use hard values instead of variables) and comments are in spanish but happy to share more info if required.

@carmatana thank you for your input.
In my case we have the certs in Windows because we need them there to begin with.
In this discussion we all have the same starting point: our certificates aren't managed by DSM.
The only thing I didn't test, is if it's enough to copy just to a single default folder, and run:
synow3tool --gen-all && systemctl reload nginx
Or if we do need to copy to every folder and restart every service.

@footswitch dropping the certs, named appropriately, in the …/_archive/{randomletters referred to in DEFAULT} and then running the three commands:

/usr/syno/bin/synow3tool --gen-all
/usr/syno/bin/synow3tool --nginx=reload
/usr/syno/bin/synow3tool --restart-dsm-service

should take care of most needs. But as the script above shows, there are some additional folders where certificates are also stored that the above three commands won’t sync to. My latest thoughts are that it might be a good idea to just replace these folders with symlinks to the default folder so it’s easier to keep everything synced, versus copying the certs into more locations. But I haven’t tried that, nor am I sure that those other locations are actually needed or referenced anywhere.

I’ve been keeping my own tweaked version of this awesome script Here which, similar to @carmatana - I generate certs with certbot in docker on the synology on a schedule. I don’t use the scp portion to copy, and I just schedule this script to run every week so I added logic to check to see whether the latest certs differ from those already installed for DSM and only do the updates and sync if they are different.

@telnetdoogie essentially, your "external" source of certs is the docker.

It's still external; the difference is you have kinda direct access to the Synology filesystem.
Some people have SMB access to the filesystem.
Some have scp access to the filesystem.
It's all good. :-D

The big picture for this:

• We all generate the certs somewhere, potentially for use in a number of places on our network.
• We need to get the certs regularly and automagically installed and running in a Synology

So we

1. copy updated certs into the Syno
2. run this script which puts them in all the necessary places
3. AND it restarts necessary packages/services

Sorry, but I think acmesh perfectly fits this use case. That said, of course, this is not the same case where your Synology device has Internet access and you can use Let's Encrypt directly from DSM web interface.

Sorry, but I think acmesh perfectly fits this use case. That said, of course, this is not the same case where your Synology device has Internet access and you can use Let's Encrypt directly from DSM web interface.

Many of us use exactly that somewhere else. The whole purpose of this script is properly injecting the resulting certs into DSM :)

Sorry, but I think acmesh perfectly fits this use case. That said, of course, this is not the same case where your Synology device has Internet access and you can use Let's Encrypt directly from DSM web interface.

Many of us use exactly that somewhere else. The whole purpose of this script is properly injecting the resulting certs into DSM :)

What I meant was that acmesh has a deploy hook for Synology DSM. Read some info here.

Highly suggest checking out https://github.com/reddec/syno-cli/tree/master

It uses the same API as acmesh but it's in an easy to consume cli for folks to leverage.

@edvalley and @ridv

What I meant was that acmesh has a deploy hook for Synology DSM. Read some info here.

According to those documents, this deploy hook does install the cert into DSM, but does NOT install it into the various packages and services ("Certificate should now show up in "Control Panel" -> "Security" -> "Certificates" and can be assigned to Services..."). This script does it all rather nicely.

I love the exploring being done by everyone! It's true:

• Those who can use acme.sh deploy hooks can take care of the transfer to DSM more easily that way
• If synow3tool --gen-all takes care of deploying into all packages and services, then the rest of the work can be avoided

I'll do some exploring on both for my use case, when I get a few more round 'tuits. ;)
(My use case: certs generated in pfSense on another host+VM.)

• If synow3tool --gen-all takes care of deploying into all packages and services, then the rest of the work can be avoided

it doesn’t do ALL of them, but does seem to take care of the majority. I added a check script that shows all the locations that still have differing certs and eventually incorporated that into my modified version.

I had a hard time understanding if the ones it “leaves out” are even really used / needed but my use cases aren’t that complex (I don’t use ftp etc)

BTW @catchdave thank you SO much for this script! It’s made ssl renewals and applications incredibly simple and reliable. I’m all about “no human interaction” automation and this and the derivatives have been key to that for me!

Thanks you very much for this scripts which is a great help!!
I managed to make it work on my NAS from an NGINX linux server that is used as reverse proxy for all my services. The wildcard let's encrypt certificate for my domain is generated from that server too which explain why this script is perfect for me.

I have a question (hope not too stupid); how did you managed to avoid having to write the password of the user created on synology each time the commands are sent?

When using this command from my nginx server, the password for the synology user is requested twice (for the 2 actions it does)

sudo bash -c scp ${CERT_DIRECTORY}/{privkey,fullchain,cert}.pem $USER@$SYNOLOGY_SERVER:/tmp/ \
     && ssh $USER@$SYNOLOGY_SERVER 'sudo ./replace_synology_ssl_certs.sh'

I would like to find a way to do it passwordless so that I can put it into a crontab on the nginx server.
How did you guys managed to fully automate it (if some of you did)?

I also noticed on the command that the single quote is missing before scp and after /tmp/ like this. Before finding this, the command was not working for me.

sudo bash -c 'scp ${CERT_DIRECTORY}/{privkey,fullchain,cert}.pem $USER@$SYNOLOGY_SERVER:/tmp/' \
     && ssh $USER@$SYNOLOGY_SERVER 'sudo ./replace_synology_ssl_certs.sh'

It was too beautiful to be real... When I execute the script, it reset (hard reboot) all my VMs running on VMM which is a big problem for me :(
I see that footswitch is mentioning using "reload" for nginx but this is already implemented on the script provided by catchdave.
I any case, I tried commenting this on the script but it still resetting all VMs.
I found out that this is the restart of the package ScsiTarget that do it...
Do you think this is important restart that package once the certificate is changed?

If you have any idea , I would be very grateful since this issue is blocking me to use this amazing script.

Do you think this is important restart that package once the certificate is changed?

I'm not convinced that those apps need to be restarted; As a check, I'd recommend you try the scripts with service_to_restart and packages_to_restart empty, as well as emptying target_cert_dirs and then run this script once everything is done. It will identify the folders you need to add back to target_cert_dirs that weren't handled by the synology OS and then you'll be able to populate the target folders and the packages / services to restart based only on those that it finds. Then you can test those apps you depend on to ensure they're working properly.

regarding your SSH login, you should be able to use import your public SSH key from the host you're copying FROM into the ~/.ssh/authorized_keys file on your synology (whichever user you're logging in as) and use key authentication which won't require a password prompt.

For example, if you're copying the files from linuxhost as user bob:
login to linuxhost as bob and copy the contents of the file ~/.ssh/id_rsa.pub
If you're logging INTO the admin user of the synology:
login to synology as admin and edit the file ~/.ssh/authorized_keys
paste the contents from bob's public key into the bottom of the authorized_keys file (should be a single line, don't add any additional line breaks etc)

then when you attempt to ssh into the synology from linuxhost it should use the key instead of a password prompt. Do it manually the first time for a prompt to add the machine to known_hosts and then once it's done, you won't have to use a password any more.

I added the script I use to renew my ssl and copy the cert everywhere here: https://gist.github.com/catchdave/3f6f412bbf0f0cec32469fb0c9747295

Could be a useful starting place for folks to create their own (won't be usable out of the box, since you will have different combinations services & servers). This specific one is controlled by a cronjob on the server that plex runs on.

Do you think this is important restart that package once the certificate is changed?

I'm not convinced that those apps need to be restarted; As a check, I'd recommend you try the scripts with service_to_restart and packages_to_restart empty, as well as emptying target_cert_dirs and then run this script once everything is done. It will identify the folders you need to add back to target_cert_dirs that weren't handled by the synology OS and then you'll be able to populate the target folders and the packages / services to restart based only on those that it finds. Then you can test those apps you depend on to ensure they're working properly.

regarding your SSH login, you should be able to use import your public SSH key from the host you're copying FROM into the ~/.ssh/authorized_keys file on your synology (whichever user you're logging in as) and use key authentication which won't require a password prompt.

For example, if you're copying the files from linuxhost as user bob: login to linuxhost as bob and copy the contents of the file ~/.ssh/id_rsa.pub If you're logging INTO the admin user of the synology: login to synology as admin and edit the file ~/.ssh/authorized_keys paste the contents from bob's public key into the bottom of the authorized_keys file (should be a single line, don't add any additional line breaks etc)

then when you attempt to ssh into the synology from linuxhost it should use the key instead of a password prompt. Do it manually the first time for a prompt to add the machine to known_hosts and then once it's done, you won't have to use a password any more.

Thank you very much for the quality of your answer telnetdoogie!

I managed to make passwordless work very well and I finally did my own script to replace the certificate on the synology because my need was not to replace the default certificate for everything, but just to replace the one I use only for synology drive because the port 6690 used by drive cannot be proxied by nginx since it is not a https protocol. So for this port, I do a port forwarding while all the rest is going through my nginx server which has the certbot certificate automatically renewed. This explain why I needed a script to send the certificate to the NAS each time it is renewed on the nginx.
So my need was just to use this certificate for drive and let the default one for all the rest.
I do the same with my firewall which is also used for the SSL vpn. I used a script that use the API of the firewall to send and update the certificate to it each time it is renewed on the nginx.

Thank you for the great job that has been made here. It helped me a lot!

Here is my script if it can help anyone.

So first I have manually uploaded a certificate in to the synology so that it creates the cert folder name which is using random characters. I also configure "Synology Drive Server" to use this certificate so that the link is made on the system.
Then, I just update the script to use that folder name and the script just update the cert and restart the "Synology Drive" service.

I made another script on the nginx that do the action of copying and executing that script into the synology NAS.

In my case too it was enough to run the synow3tool and do an nginx restart, thanks for the hints.
My script to find the correct folder and an opportunity to check nginx config before restarting the server:

cp ~/certs/* /usr/syno/etc/certificate/_archive/$(cat /usr/syno/etc/certificate/_archive/DEFAULT)

/usr/syno/bin/synow3tool --gen-all
nginx -t

read -p "nginx config ok?"

systemctl restart nginx

Hi Catchdave,

I'm looking for a solution for my DS1010+ with DSM 5.2-5967 Update 9.
I found many article on the net but nothing help me until yet.

Maybe you have already an idee.

Best Regards
DJG.

Hi Catchdave,

I'm looking for a solution for my DS1010+ with DSM 5.2-5967 Update 9. I found many article on the net but nothing help me until yet.

@DJGauthier : I have never had a system with 5.x OS so I simply don't know what it looks like. Fundamentally, you simply need to find where the SSL certs are stored and then find out the right way to restart associated services to use the new certs when you upload them. Perhaps the locations are similar to the 6.x version of this (look at the gist's history). You can probably easily find certs using a find command once you SSH in.

Hi CatchDave, Thanks very much for your answer. I know where the location of the ssl certificates are. The Internet box configuration and the zyxel router are ok as well firewalls. I use acme as LetsEncrypt described but l’m faced with an error ‘malformed error {‘. Best Regards

…

Le 19 juin 2023 à 18:07, catchdave ***@***.***> a écrit : ***@***.*** commented on this gist. Hi Catchdave, I'm looking for a solution for my DS1010+ with DSM 5.2-5967 Update 9. I found many article on the net but nothing help me until yet. @DJGauthier : I have never had a system with 5.x OS so I simply don't know what it looks like. Fundamentally, you simply need to find where the SSL certs are stored and then find out the right way to restart associated services to use the new certs when you upload them. Perhaps the locations are similar to the 6.x version of this (look at the gist's history). You can probably easily find certs using a find command once you SSH in. — Reply to this email directly, view it on GitHub or unsubscribe. You are receiving this email because you were mentioned. Triage notifications on the go with GitHub Mobile for iOS or Android.

I don't know where you are getting that error from, or what the context is. So I can't really work off just that error (is it on the browser, on the synology box, elsewhere). You could also consider upgrading your OS. version 5.x is a 8 years old.

Hi catchdave, It’s difficult for me too with the error: I configure the internet box to allow traffic for port 80 and 443 as well firewall. (tcp/udp) My Syno is behind a second router I allow traffic for port 80 and 443 as well firewall too. (tcp/udp) I open the firewall on Syno for the two ports (tcp/udp) Trying to get the certificate: acme.sh --issue -d [mysyno].synology.me --webroot /var/lib/letsencrypt --certpath /usr/syno/etc/ssl/ssl.crt/server.crt --keypath /usr/syno/etc/ssl/ssl.key/server.key --capath /usr/syno/etc /ssl/ssl.crt/ca.crt --debug 3 --log acme.log [Wed Jun 21 09:18:49 CEST 2023] status='invalid' [Wed Jun 21 09:18:49 CEST 2023] error='"error":{' [Wed Jun 21 09:18:49 CEST 2023] errordetail [Wed Jun 21 09:18:49 CEST 2023] [mysyno].synology.me:Verify error:"error":{ … [Wed Jun 21 09:18:49 CEST 2023] url='http:// [mysyno].synology.me/.well-known/acme-challenge/Y5KNRP___BK6pNS0HouHkgcKVdM8N7vcT2N1N-dtIn4' … [Wed Jun 21 09:42:45 CEST 2023] _t_url='https://acme.zerossl.com/v2/DV90/chall/ukpO0DZWxLCMZFVen7gc8Q' …. [Wed Jun 21 09:18:49 CEST 2023] Please check log file for more details: acme.log Trying to the url in local: http:// [mysyno].synology.me/.well-known/acme-challenge/Y5KNRP___BK6pNS0HouHkgcKVdM8N7vcT2N1N-dtIn4 Sorry, unable to access this page Looking at: https://acme.zerossl.com/v2/DV90/chall/ukpO0DZWxLCMZFVen7gc8Q {"type":"urn:ietf:params:acme:error:malformed","status":405,"detail":"The request message was malformed"} Test with curl ( <https://community.letsencrypt.org/t/synology-dsm-5-renew-certificate-failed/124501/26> Synology DSM 5 - Renew Certificate failed - Help - Let's Encrypt Community Support (letsencrypt.org)) [mysyno]> curl -Iki http:// [mysyno].synology.me HTTP/1.1 403 Forbidden Date: Wed, 21 Jun 2023 07:35:08 GMT Server: Apache Last-Modified: Tue, 26 Apr 2016 09:36:45 GMT ETag: "1e5-5316008094540" Accept-Ranges: bytes Content-Length: 485 Vary: Accept-Encoding Content-Type: text/html [mysyno]> curl -Iki https:// [mysyno].synology.me HTTP/1.1 403 Forbidden Date: Wed, 21 Jun 2023 07:35:08 GMT Server: Apache Last-Modified: Tue, 26 Apr 2016 09:36:45 GMT ETag: "1e5-5316008094540" Accept-Ranges: bytes Content-Length: 485 Vary: Accept-Encoding Content-Type: text/html I don’t know how to resolve this error 403 I try to deactivate https connection for DSM without result Sorry but I cannot update to New OS version because DS1010+ is not supported De : catchdave ***@***.***> Envoyé : mardi, 20 juin 2023 17:40 À : catchdave ***@***.***> Cc : Comment ***@***.***> Objet : Re: catchdave/replace_synology_ssl_certs.sh @catchdave commented on this gist.

…

_____ I don't know where you are getting that error from, or what the context is. So I can't really work off just that error (is it on the browser, on the synology box, elsewhere). You could also consider upgrading your OS. version 5.x is a 8 years old. — Reply to this email directly, view it on GitHub <https://gist.github.com/catchdave/69854624a21ac75194706ec20ca61327#gistcomment-4605109> or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABECB6PV2MKHW5PH3YRW64TXMG73NBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVEYTAMJQHE2TEMZVU52HE2LHM5SXFJTDOJSWC5DF> . You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

Hi catchdave, I tried to do the job using the hook synology_dsm <https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS-Guide> Synology NAS Guide · acmesh-official/acme.sh Wiki · GitHub I specified the variables : export SYNO_Username='Admin User' export SYNO_Password='password' export SYNO_Hostname='[mysyno].synology.me' export SYNO_Scheme="https" export SYNO_Port="5001" export SYNO_Certificate="My description" acme.sh -d "[mysyno].synology.me" --deploy --deploy-hook synology_dsm --webroot /var/lib/letsencrypt --staging --debug 2 --log acme_hook.log # staging for test ! now I get these errors: … == Info: SSLv3, TLS alert, Server hello (2): => Send SSL data, 2 bytes (0x2) 0000: .0 == Info: SSL certificate problem: self signed certificate in certificate chain == Info: SSLv3, TLS alert, Client hello (1): => Send SSL data, 2 bytes (0x2) 0000: .. [Wed Jun 21 15:31:59 CEST 2023] Unable to authenticate to [mysyno].synology.me:5001 using https. [Wed Jun 21 15:31:59 CEST 2023] Check your username and password. [Wed Jun 21 15:31:59 CEST 2023] Error deploy for domain: [mysyno].synology.me [Wed Jun 21 15:31:59 CEST 2023] Deploy error. This admin can login in from my handy without problem. Did you know if we have somewhere an option to specify for using login in from https from command line? Hi tried the command I see in log on my browser , but no chance: https:// <https://[mysyno]..synology.me:5001/webman/login.cgi?username='MyAdmin'&passwd='Mypass'&enable_syno_token=yes> [mysyno]..synology.me:5001/webman/login.cgi?username='MyAdmin'&passwd='Mypass'&enable_syno_token=yes result: { "reason" : "error_cantlogin", "result" : "error", "success" : false } Best regards De : Denis Gauthier ***@***.***> Envoyé : mercredi, 21 juin 2023 09:48 À : ***@***.***' ***@***.***> Objet : RE: catchdave/replace_synology_ssl_certs.sh Hi catchdave, It’s difficult for me too with the error: I configure the internet box to allow traffic for port 80 and 443 as well firewall. (tcp/udp) My Syno is behind a second router I allow traffic for port 80 and 443 as well firewall too. (tcp/udp) I open the firewall on Syno for the two ports (tcp/udp) Trying to get the certificate: acme.sh --issue -d [mysyno].synology.me --webroot /var/lib/letsencrypt --certpath /usr/syno/etc/ssl/ssl.crt/server.crt --keypath /usr/syno/etc/ssl/ssl.key/server.key --capath /usr/syno/etc /ssl/ssl.crt/ca.crt --debug 3 --log acme.log [Wed Jun 21 09:18:49 CEST 2023] status='invalid' [Wed Jun 21 09:18:49 CEST 2023] error='"error":{' [Wed Jun 21 09:18:49 CEST 2023] errordetail [Wed Jun 21 09:18:49 CEST 2023] [mysyno].synology.me:Verify error:"error":{ … [Wed Jun 21 09:18:49 CEST 2023] url='http:// [mysyno].synology.me/.well-known/acme-challenge/Y5KNRP___BK6pNS0HouHkgcKVdM8N7vcT2N1N-dtIn4' … [Wed Jun 21 09:42:45 CEST 2023] _t_url='https://acme.zerossl.com/v2/DV90/chall/ukpO0DZWxLCMZFVen7gc8Q' …. [Wed Jun 21 09:18:49 CEST 2023] Please check log file for more details: acme.log Trying to the url in local: http:// [mysyno].synology.me/.well-known/acme-challenge/Y5KNRP___BK6pNS0HouHkgcKVdM8N7vcT2N1N-dtIn4 Sorry, unable to access this page Looking at: https://acme.zerossl.com/v2/DV90/chall/ukpO0DZWxLCMZFVen7gc8Q {"type":"urn:ietf:params:acme:error:malformed","status":405,"detail":"The request message was malformed"} Test with curl ( <https://community.letsencrypt.org/t/synology-dsm-5-renew-certificate-failed/124501/26> Synology DSM 5 - Renew Certificate failed - Help - Let's Encrypt Community Support (letsencrypt.org)) [mysyno]> curl -Iki http:// [mysyno].synology.me HTTP/1.1 403 Forbidden Date: Wed, 21 Jun 2023 07:35:08 GMT Server: Apache Last-Modified: Tue, 26 Apr 2016 09:36:45 GMT ETag: "1e5-5316008094540" Accept-Ranges: bytes Content-Length: 485 Vary: Accept-Encoding Content-Type: text/html [mysyno]> curl -Iki https:// [mysyno].synology.me HTTP/1.1 403 Forbidden Date: Wed, 21 Jun 2023 07:35:08 GMT Server: Apache Last-Modified: Tue, 26 Apr 2016 09:36:45 GMT ETag: "1e5-5316008094540" Accept-Ranges: bytes Content-Length: 485 Vary: Accept-Encoding Content-Type: text/html I don’t know how to resolve this error 403 I try to deactivate https connection for DSM without result Sorry but I cannot update to New OS version because DS1010+ is not supported De : catchdave ***@***.***> Envoyé : mardi, 20 juin 2023 17:40 À : catchdave ***@***.***> Cc : Comment ***@***.***> Objet : Re: catchdave/replace_synology_ssl_certs.sh @catchdave commented on this gist.

…

_____ I don't know where you are getting that error from, or what the context is. So I can't really work off just that error (is it on the browser, on the synology box, elsewhere). You could also consider upgrading your OS. version 5.x is a 8 years old. — Reply to this email directly, view it on GitHub <https://gist.github.com/catchdave/69854624a21ac75194706ec20ca61327#gistcomment-4605109> or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABECB6PV2MKHW5PH3YRW64TXMG73NBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVEYTAMJQHE2TEMZVU52HE2LHM5SXFJTDOJSWC5DF> . You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

@DJGauthier It appears you're running into a port forwarding issue. Have you been able to renew certs successfully using the Synology UI? The address you're using - [mysyno].synology.me will point to your public WAN IP, so you're unlikely to be able to test that locally unless you're doing some hairpin NAT rules on your router. I'd start with validating that LetsEncrypt certificates can be generated via the UI on the Synology NAS before you try to use scripts to do the same.

Alternatively you could switch to certbot using DNS-01 challenge instead of HTTP-01 to avoid the need to have ports open and forwarded. More info here:

https://letsencrypt.org/docs/challenge-types/

Hi Jason, I do not have the option to renew or create letsEncrypt Certificate on the DSM 5.2 UI. My hardware is not compatible with new DSM Version. I use DDNS name from sinology and I don’t know how to use DNS-01 challenge in this situation. I already read the article you mentioned before asking here. De : Jason Hobbs ***@***.***> Envoyé : mercredi, 21 juin 2023 17:55 À : telnetdoogie ***@***.***> Cc : Mention ***@***.***> Objet : Re: catchdave/replace_synology_ssl_certs.sh @telnetdoogie commented on this gist.

…

_____ @DJGauthier <https://github.com/DJGauthier> It appears you're running into a port forwarding issue. Have you been able to renew certs successfully using the Synology UI? The address you're using - [mysyno].synology.me will point to your public WAN IP, so you're unlikely to be able to test that locally unless you're doing some hairpin NAT rules on your router. I'd start with validating that LetsEncrypt certificates can be generated via the UI on the Synology NAS before you try to use scripts to do the same. Alternatively you could switch to certbot using DNS-01 challenge instead of HTTP-01 to avoid the need to have ports open and forwarded. More info here: https://letsencrypt.org/docs/challenge-types/ — Reply to this email directly, view it on GitHub <https://gist.github.com/catchdave/69854624a21ac75194706ec20ca61327#gistcomment-4606250> or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABECB6MSWMTRRDQ2PI62C6LXMMKMVBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVEYTAMJQHE2TEMZVU52HE2LHM5SXFJTDOJSWC5DF> . You are receiving this email because you were mentioned. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .