How to install an SSL certificate on a Synology NAS
In short
In DSM, open “Control Panel” → “Security” → “Certificate” → “Add” → “Import certificate”, select privkey.pem, cert.pem and chain.pem, then assign the certificate to your services.
For a Synology NAS running DSM 7. The certificate works when you open the NAS at an address on your own domain (for example nas.yourdomain.com). If you open it by its IP address, the browser will still show a warning. In DSM 7, QuickConnect connections use their own certificate from Synology, and our certificate does not affect them.
Files you need
privkey.pem, cert.pem and chain.pem. DSM reads them from files on your computer, so you do not paste anything.
Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.
Before you start
- DSM can get a Let's Encrypt certificate by itself and renew it automatically, but it needs port 80 open on your router and on the NAS, and it issues wildcard certificates (*.domain) only for Synology DDNS addresses. Our generator is useful when you do not want to open port 80 (you then confirm your domain with a DNS record) or when you need a wildcard certificate for your own domain.
Step by step
- Sign in to DSM and open “Control Panel” → “Security” → “Certificate”.
- Click “Add”, select “Add a new certificate” and click “Next”.
- Enter a description (for example the domain name) and select “Import certificate”. If the certificate should be used for all NAS services, tick “Set as default certificate”. Click “Next”.
- Select the files in the three fields of the wizard (see below for which file goes where) and finish the wizard.
- If the certificate is not the default one, assign it to your services: click “Settings”, go to the “Configure” tab, click the current certificate of a service, choose the new certificate from the drop-down menu and click “OK”.
Which file goes into which field
- Private Key: the privkey.pem file
- Certificate: the cert.pem file
- Intermediate certificate: the chain.pem file. DSM describes this field as optional, but without it some devices will show a warning about an incomplete certificate chain.
Checking the result
Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.
If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.
Good to know
- If DSM shows the message “Invalid private key” or “Illegal private key”, generate the certificate again with an RSA 2048 key (step 1 of the generator, “Key type”). If that does not help either, contact us: according to Synology, the key sometimes has to start with “-----BEGIN RSA PRIVATE KEY-----”, while the file from our generator starts with “-----BEGIN PRIVATE KEY-----”.
- DSM does not renew a certificate imported from files by itself. When it is time to renew, you replace it manually.
When you renew
“Control Panel” → “Security” → “Certificate” → “Add” → “Replace an existing certificate”. Choose the old certificate from the drop-down menu, click “Next”, select “Import certificate” and select the new files. The certificate should stay assigned to the same services; you can check this in “Settings” → “Configure”.
Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.