How to install an SSL certificate on a QNAP NAS

Updated October 2026 · about 3 min read

In short

In QTS, open “Control Panel” → “System” → “Security” → “SSL Certificate & Private Key”, click “Replace Certificate” and import cert.pem, privkey.pem and chain.pem. QNAP requires an RSA 2048 key.

For a QNAP NAS running QTS 5 or QuTS hero. The certificate works when you open the NAS at an address on your own domain (for example nas.yourdomain.com).

Files you need

cert.pem, privkey.pem and chain.pem, uploaded from your computer. The QNAP panel does not accept ECDSA keys, so choose “RSA 2048” in step 1 of the generator.

Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.

Before you start

QTS can get a Let's Encrypt certificate by itself (“Get from Let's Encrypt”), but it needs port 80 open and forwarded to the NAS. Our generator is useful when you do not want to open port 80 (you then confirm your domain with a DNS record) or when you need a wildcard certificate.
QNAP warns that an invalid certificate can stop you from signing in to the NAS over HTTPS until you restore the default certificate. So take care to select the right files (see below).
If you have a Let's Encrypt certificate with automatic renewal in myQNAPcloud (“SSL Certificate”), QTS may install it in place of yours when it renews (about 30 days before it expires). In that case, turn off automatic renewal there.

Step by step

Sign in to QTS and open “Control Panel” → “System” → “Security” → “SSL Certificate & Private Key” (in older versions “Certificate & Private Key”).
Go to “Server Certificate”, click “Replace Certificate”, select “Import certificate” and click “Next”.
Use the “Browse” buttons to select the files in the three fields (see below for which file goes where) and click “Apply”.

Which file goes into which field

cert.pemCertificate

privkey.pemPrivate key

chain.pemIntermediate certificate

The file from the generator and the panel field its content goes into.

Certificate: the cert.pem file
Private key: the privkey.pem file
Intermediate certificate: the chain.pem file

Checking the result

Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.

If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.

Good to know

If QTS rejects the private key (for example with a message that the private key is incorrect), check that you chose “RSA 2048” in step 1 of the generator.

When you renew

Follow the same steps: click “Replace Certificate” again and select the new files.

Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.